Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24/10/2024, 11:32
Behavioral task
behavioral1
Sample
meshagent64-Agents.exe
Resource
win7-20241010-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
meshagent64-Agents.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
meshagent64-Agents.exe
-
Size
3.3MB
-
MD5
5f2673342f7b252551dd063118bad41f
-
SHA1
c64c1f88c9f1a526c6d09d62a253252c139fa644
-
SHA256
b38f5abfa480b45c46d3eed7e8a6b4859888921358e57bd7649a70c4a3be5f90
-
SHA512
35ce5b6d8a3376452d2ec4409e2b3f79e7f4a0b28d04cccb1f2a5cf2391d7b791909e0ddff0c8290e0889908973384408ed1f2a21605f65a6d89a061bafe6a67
-
SSDEEP
49152:/X3YnLOQYsZfQ74C6SkgSbXP31+frjUYuHi7nT8poTMFvfuJ1kZ7NrjHQe85Q7:/lRsZ47/QXoHUOfAoj1x67
Score
1/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4488 wmic.exe Token: SeSecurityPrivilege 4488 wmic.exe Token: SeTakeOwnershipPrivilege 4488 wmic.exe Token: SeLoadDriverPrivilege 4488 wmic.exe Token: SeSystemProfilePrivilege 4488 wmic.exe Token: SeSystemtimePrivilege 4488 wmic.exe Token: SeProfSingleProcessPrivilege 4488 wmic.exe Token: SeIncBasePriorityPrivilege 4488 wmic.exe Token: SeCreatePagefilePrivilege 4488 wmic.exe Token: SeBackupPrivilege 4488 wmic.exe Token: SeRestorePrivilege 4488 wmic.exe Token: SeShutdownPrivilege 4488 wmic.exe Token: SeDebugPrivilege 4488 wmic.exe Token: SeSystemEnvironmentPrivilege 4488 wmic.exe Token: SeRemoteShutdownPrivilege 4488 wmic.exe Token: SeUndockPrivilege 4488 wmic.exe Token: SeManageVolumePrivilege 4488 wmic.exe Token: 33 4488 wmic.exe Token: 34 4488 wmic.exe Token: 35 4488 wmic.exe Token: 36 4488 wmic.exe Token: SeIncreaseQuotaPrivilege 4488 wmic.exe Token: SeSecurityPrivilege 4488 wmic.exe Token: SeTakeOwnershipPrivilege 4488 wmic.exe Token: SeLoadDriverPrivilege 4488 wmic.exe Token: SeSystemProfilePrivilege 4488 wmic.exe Token: SeSystemtimePrivilege 4488 wmic.exe Token: SeProfSingleProcessPrivilege 4488 wmic.exe Token: SeIncBasePriorityPrivilege 4488 wmic.exe Token: SeCreatePagefilePrivilege 4488 wmic.exe Token: SeBackupPrivilege 4488 wmic.exe Token: SeRestorePrivilege 4488 wmic.exe Token: SeShutdownPrivilege 4488 wmic.exe Token: SeDebugPrivilege 4488 wmic.exe Token: SeSystemEnvironmentPrivilege 4488 wmic.exe Token: SeRemoteShutdownPrivilege 4488 wmic.exe Token: SeUndockPrivilege 4488 wmic.exe Token: SeManageVolumePrivilege 4488 wmic.exe Token: 33 4488 wmic.exe Token: 34 4488 wmic.exe Token: 35 4488 wmic.exe Token: 36 4488 wmic.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 184 wrote to memory of 4488 184 meshagent64-Agents.exe 85 PID 184 wrote to memory of 4488 184 meshagent64-Agents.exe 85