Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    52s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/09/2024, 15:07

General

  • Target

    java-se-devolpment-kit_8-update-66_201082_32.exe

  • Size

    3.5MB

  • MD5

    d71930c5e91a5e39b3645629b2ec11e9

  • SHA1

    cb4d9d7dc4bddfedb85df5f3985786c88ea3dfb9

  • SHA256

    c2bb9fa0dc16902993052818ec6267d78edda1fa3d484603fc66625da5666fd0

  • SHA512

    5852b03559b1d4feaccb90d27904f209a1c92a819763d177fb88b67b8abd4cfbd59d3e80e2d5d560addde850710515e1fb01a41ed35db528e0c538efe5829fda

  • SSDEEP

    98304:y1RvSndGBWsFcYQVArv4MnBpVgNhVRw+GI6:QRKdzUJQVArvb3gRRw+C

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\java-se-devolpment-kit_8-update-66_201082_32.exe
    "C:\Users\Admin\AppData\Local\Temp\java-se-devolpment-kit_8-update-66_201082_32.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2244

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2244-0-0x00007FF8A6D53000-0x00007FF8A6D55000-memory.dmp

    Filesize

    8KB

  • memory/2244-1-0x0000024E22220000-0x0000024E225A6000-memory.dmp

    Filesize

    3.5MB

  • memory/2244-6-0x0000024E3D280000-0x0000024E3D476000-memory.dmp

    Filesize

    2.0MB

  • memory/2244-7-0x00007FF8A6D50000-0x00007FF8A7812000-memory.dmp

    Filesize

    10.8MB

  • memory/2244-8-0x00007FF8A6D50000-0x00007FF8A7812000-memory.dmp

    Filesize

    10.8MB

  • memory/2244-9-0x00007FF8A6D50000-0x00007FF8A7812000-memory.dmp

    Filesize

    10.8MB

  • memory/2244-10-0x00007FF8A6D53000-0x00007FF8A6D55000-memory.dmp

    Filesize

    8KB

  • memory/2244-11-0x00007FF8A6D50000-0x00007FF8A7812000-memory.dmp

    Filesize

    10.8MB

  • memory/2244-12-0x00007FF8A6D50000-0x00007FF8A7812000-memory.dmp

    Filesize

    10.8MB

  • memory/2244-13-0x00007FF8A6D50000-0x00007FF8A7812000-memory.dmp

    Filesize

    10.8MB

  • memory/2244-14-0x0000024E22AF0000-0x0000024E22B00000-memory.dmp

    Filesize

    64KB

  • memory/2244-15-0x0000024E3D5C0000-0x0000024E3D5DA000-memory.dmp

    Filesize

    104KB

  • memory/2244-16-0x0000024E22B00000-0x0000024E22B0A000-memory.dmp

    Filesize

    40KB

  • memory/2244-17-0x0000024E3DB10000-0x0000024E3DB36000-memory.dmp

    Filesize

    152KB

  • memory/2244-18-0x0000024E3CD00000-0x0000024E3CD12000-memory.dmp

    Filesize

    72KB

  • memory/2244-19-0x0000024E3CE20000-0x0000024E3CE28000-memory.dmp

    Filesize

    32KB

  • memory/2244-20-0x0000024E3D5E0000-0x0000024E3D5E8000-memory.dmp

    Filesize

    32KB

  • memory/2244-21-0x00007FF8A6D50000-0x00007FF8A7812000-memory.dmp

    Filesize

    10.8MB

  • memory/2244-22-0x00007FF8A6D50000-0x00007FF8A7812000-memory.dmp

    Filesize

    10.8MB