Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/06/2024, 09:19
Static task
static1
Behavioral task
behavioral1
Sample
493084369.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
493084369.exe
Resource
win10v2004-20240508-en
General
-
Target
493084369.exe
-
Size
1.1MB
-
MD5
a465bc6b95811da2d8112bed68fffacc
-
SHA1
8b5602d34a179e789c580b1a145e6e559b864a9a
-
SHA256
75be4773c9254d78bf52593da0360ba351cdc5fffcabc645da352c8413c8b223
-
SHA512
06e2731a460ca9ddffaca7278ae491ab83a6a6170a84e4277eb4fbfe4cd85b6f2edce244a1219227dbba47ea0c721d40dd8eee5d97d963c65a38d8ca6b33cae4
-
SSDEEP
24576:BAHnh+eWsN3skA4RV1Hom2KXMmHaFaqC1f5XzdTZ83Z5:Yh+ZkldoPK8YaFOhlzdV8z
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2224 set thread context of 1344 2224 493084369.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1344 RegSvcs.exe 1344 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2224 493084369.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1344 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2224 493084369.exe 2224 493084369.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2224 493084369.exe 2224 493084369.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2224 wrote to memory of 1344 2224 493084369.exe 28 PID 2224 wrote to memory of 1344 2224 493084369.exe 28 PID 2224 wrote to memory of 1344 2224 493084369.exe 28 PID 2224 wrote to memory of 1344 2224 493084369.exe 28 PID 2224 wrote to memory of 1344 2224 493084369.exe 28 PID 2224 wrote to memory of 1344 2224 493084369.exe 28 PID 2224 wrote to memory of 1344 2224 493084369.exe 28 PID 2224 wrote to memory of 1344 2224 493084369.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\493084369.exe"C:\Users\Admin\AppData\Local\Temp\493084369.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\493084369.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1344
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD5950bea0dd4004bb5d932d590c34905f6
SHA1506a892a4b5547cf1a29cfd663dc336068b2edc5
SHA2567b6f3078cee69939bd2e870368a6615937b29e390b7850addc6a7a40423d706d
SHA512445ec818024bbe8bdff6f524df277e1d415a4855ecc1a279437bc75100759cf02439d805ed781ba254bd4634c1804c857a5676538a1a615bed4055954131cbc4