Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19/12/2024, 01:05

General

  • Target

    0ac8d579962fc7d34cfa57d83ddfd84abbf073226b043a547d962f838cad074e.exe

  • Size

    237KB

  • MD5

    65cd3f7056aea6ee5d7acc4bb91b89f3

  • SHA1

    1618c3fac9690643ceb6fa5929a81bfc57db972d

  • SHA256

    0ac8d579962fc7d34cfa57d83ddfd84abbf073226b043a547d962f838cad074e

  • SHA512

    de260750eeb4b5830720cc0f120de2c741e4853661f1fb5995ef29c5dd5408695213759cebf83786206cbebf4fab3b0d25093458b6216f3f7eab0b49a7baa0a0

  • SSDEEP

    3072:3aHGsiszDDtdz4SyVefNTufMl0EPLHdVILEiAfcGQV5V7vcP3Hq:qH+szDDtdz4S5FjPf9cGQNvY3

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://s4.serv00.com
  • Port:
    21
  • Username:
    f2241_evico
  • Password:
    Doll650#@

Signatures

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ac8d579962fc7d34cfa57d83ddfd84abbf073226b043a547d962f838cad074e.exe
    "C:\Users\Admin\AppData\Local\Temp\0ac8d579962fc7d34cfa57d83ddfd84abbf073226b043a547d962f838cad074e.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:2884

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2884-0-0x000000007460E000-0x000000007460F000-memory.dmp

    Filesize

    4KB

  • memory/2884-1-0x0000000000E10000-0x0000000000E52000-memory.dmp

    Filesize

    264KB

  • memory/2884-2-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB

  • memory/2884-5-0x000000007460E000-0x000000007460F000-memory.dmp

    Filesize

    4KB

  • memory/2884-6-0x0000000074600000-0x0000000074CEE000-memory.dmp

    Filesize

    6.9MB