Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    25/12/2024, 16:52

General

  • Target

    ff5e3bb8f76eae7317ad5ff1b46b04f4ac3a9c9437c7b983e6a8889c6d96ea56N.exe

  • Size

    35KB

  • MD5

    9ae685efdf4a33b7b452d74c14e033a0

  • SHA1

    65a624966c7c3829a845a6646d7453b06d7d5618

  • SHA256

    ff5e3bb8f76eae7317ad5ff1b46b04f4ac3a9c9437c7b983e6a8889c6d96ea56

  • SHA512

    fd9106bd7c84bb7a8421fb9561dfebeed235582662cffd6c5ec0347c9a3653671e6795e84a18e86b834aeb3bd127ab84cf83054d3c36b74c7e98f61d88b5d8d7

  • SSDEEP

    384:XZirz04kYcm5oRVPUn30CDG1iZMJSalHXeqZhsWIgDWsjxZUtO4f54A:Mi+5uVPUn30gGEZQH5SAXJ4f54A

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ff5e3bb8f76eae7317ad5ff1b46b04f4ac3a9c9437c7b983e6a8889c6d96ea56N.exe
    "C:\Users\Admin\AppData\Local\Temp\ff5e3bb8f76eae7317ad5ff1b46b04f4ac3a9c9437c7b983e6a8889c6d96ea56N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1544
    • C:\WINDOWS\system.exe
      "C:\WINDOWS\system.exe" 0
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:2516

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\system.exe

    Filesize

    35KB

    MD5

    db4183f36ac7f52f3df8e6976d398fa0

    SHA1

    0be82aa6c5ed2a884a4e0065b31f3a89953823e5

    SHA256

    ed04c4c25fbe443ce084014b0defde86282004afbb00a8671f4ad808498776ba

    SHA512

    323a51a5a1848d7f4ae37ee3f575b410e02e51364ddbf5a16ed8cf7689c28f286b82b352cbd69d8125999202fcd8239772e9bcd6d6824d2803755fffd06583b3

  • memory/1544-0-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/1544-3-0x0000000000020000-0x000000000002B000-memory.dmp

    Filesize

    44KB

  • memory/1544-2-0x0000000000020000-0x000000000002B000-memory.dmp

    Filesize

    44KB

  • memory/1544-7-0x0000000000390000-0x0000000000399000-memory.dmp

    Filesize

    36KB

  • memory/1544-11-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB

  • memory/2516-14-0x0000000000400000-0x000000000040B000-memory.dmp

    Filesize

    44KB