Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
08/08/2024, 05:47
Static task
static1
Behavioral task
behavioral1
Sample
IlluminatiFree.exe
Resource
win7-20240704-en
General
-
Target
IlluminatiFree.exe
-
Size
3.4MB
-
MD5
0d2b81676d5454aa2d64f4e3d5492065
-
SHA1
da217be8be81f371c35c949b067306d58bc7edc4
-
SHA256
3159c15e685d17e6349b5b23487380cfa8b2f18a0d8e6db72b5a64ef6eb0a694
-
SHA512
d92805b3cdc418b22a31439b4d494d014c15b58500af028f8398a006dac0c71e264e30ae25007a3662bac10eb02337db0e5974bdc94971df88d639070a3e6b34
-
SSDEEP
98304:RtZ1Bb/WtqjM/ECMPXpJxPDREVUTpybRyVpKGXdfW1c:T/E04/FMPXLl2WyRop7Xdfd
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral1/memory/2812-4-0x0000000007B60000-0x0000000007D74000-memory.dmp family_agenttesla -
Program crash 1 IoCs
pid pid_target Process procid_target 2596 2812 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language IlluminatiFree.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2812 IlluminatiFree.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2812 IlluminatiFree.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2812 wrote to memory of 2596 2812 IlluminatiFree.exe 30 PID 2812 wrote to memory of 2596 2812 IlluminatiFree.exe 30 PID 2812 wrote to memory of 2596 2812 IlluminatiFree.exe 30 PID 2812 wrote to memory of 2596 2812 IlluminatiFree.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\IlluminatiFree.exe"C:\Users\Admin\AppData\Local\Temp\IlluminatiFree.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2812 -s 6842⤵
- Program crash
PID:2596
-