Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/10/2024, 02:02
Static task
static1
Behavioral task
behavioral1
Sample
9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe
Resource
win7-20240903-en
General
-
Target
9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe
-
Size
1.2MB
-
MD5
56e68d8bcd3f1cdde361be4cb038e0fe
-
SHA1
96c6e802499baf1530dde3720184a5d0044b06fb
-
SHA256
9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036
-
SHA512
163279de5e0836037496471a5ce76ec36f6bd66fd67dc8e852d5d2a3d2e542347f867722a2cc5015167793d27eeab1d116ce224ed2b24ad1ba9a1c118b86656a
-
SSDEEP
24576:ffmMv6Ckr7Mny5QL+eYpzH2he1mlAdEq91nNlU:f3v+7/5QLoFH2h+5EUnNlU
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1656 set thread context of 2332 1656 9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2332 RegSvcs.exe 2332 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1656 9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2332 RegSvcs.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1656 wrote to memory of 2332 1656 9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe 29 PID 1656 wrote to memory of 2332 1656 9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe 29 PID 1656 wrote to memory of 2332 1656 9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe 29 PID 1656 wrote to memory of 2332 1656 9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe 29 PID 1656 wrote to memory of 2332 1656 9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe 29 PID 1656 wrote to memory of 2332 1656 9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe 29 PID 1656 wrote to memory of 2332 1656 9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe 29 PID 1656 wrote to memory of 2332 1656 9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe"C:\Users\Admin\AppData\Local\Temp\9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\9a9d325dff86bf2b672b9aa003e29b024f6c7fa1c158e2b704affbcb4568b036.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2332
-