Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
05/09/2024, 00:20
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Sims4PacksFree.exe
Resource
win7-20240903-en
4 signatures
150 seconds
General
-
Target
Sims4PacksFree.exe
-
Size
838KB
-
MD5
9d17db983dba192d5484f2ce6d3bca67
-
SHA1
10bacfebc2bdb5cd79ded78ab07c20a947e2714c
-
SHA256
85a86918a75e8963a30fe5e6e9ff0e69f12bea3a26345a60bca9223d73c953f0
-
SHA512
cbe05e9aae9f6f49337b20b550330e08c3228129725099762bbb86acf9f7dd39ef6a6b10963d2bb9a315e0e357079e5757b247e0979f06d73c46c3b1cfd2488f
-
SSDEEP
24576:7EW8odvocoQ9i816JzYoJ/8aooznCpzNA3/:7Z9obSQYE8ozIS3
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 1 IoCs
resource yara_rule behavioral1/memory/1608-3-0x0000000004FA0000-0x00000000051B4000-memory.dmp family_agenttesla -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Sims4PacksFree.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Sims4PacksFree.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer Sims4PacksFree.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion Sims4PacksFree.exe