Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/03/2025, 14:34
Behavioral task
behavioral1
Sample
MeshAgent.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
MeshAgent.exe
Resource
win10v2004-20250217-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
MeshAgent.exe
-
Size
3.6MB
-
MD5
8f42db3fe160e033893829e1fc2db62b
-
SHA1
b46d26f7e820e70a6f1956997d4ce66c0285b5c5
-
SHA256
f2e08e2fac3a3eed619ae5373499304e90413d4ccc31665e29cecada8dc6fabc
-
SHA512
71d93c7cb6938f3c2bd08e7a0a08e085cd2469fc32fcc3b3d7217eb881b89de41822663993e566e965ce7b28e02affd7b65e3da20951d1264b18fd30c67a4bd9
-
SSDEEP
49152:O8o8bZjyJVD0s9Mr3XIfRviWkgEOaxfCbCMcXGtSgvZPOQ5QO:O8o8VOUs9joRbMc2tSW6O
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MeshAgent.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language wmic.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2504 wmic.exe Token: SeSecurityPrivilege 2504 wmic.exe Token: SeTakeOwnershipPrivilege 2504 wmic.exe Token: SeLoadDriverPrivilege 2504 wmic.exe Token: SeSystemProfilePrivilege 2504 wmic.exe Token: SeSystemtimePrivilege 2504 wmic.exe Token: SeProfSingleProcessPrivilege 2504 wmic.exe Token: SeIncBasePriorityPrivilege 2504 wmic.exe Token: SeCreatePagefilePrivilege 2504 wmic.exe Token: SeBackupPrivilege 2504 wmic.exe Token: SeRestorePrivilege 2504 wmic.exe Token: SeShutdownPrivilege 2504 wmic.exe Token: SeDebugPrivilege 2504 wmic.exe Token: SeSystemEnvironmentPrivilege 2504 wmic.exe Token: SeRemoteShutdownPrivilege 2504 wmic.exe Token: SeUndockPrivilege 2504 wmic.exe Token: SeManageVolumePrivilege 2504 wmic.exe Token: 33 2504 wmic.exe Token: 34 2504 wmic.exe Token: 35 2504 wmic.exe Token: SeIncreaseQuotaPrivilege 2504 wmic.exe Token: SeSecurityPrivilege 2504 wmic.exe Token: SeTakeOwnershipPrivilege 2504 wmic.exe Token: SeLoadDriverPrivilege 2504 wmic.exe Token: SeSystemProfilePrivilege 2504 wmic.exe Token: SeSystemtimePrivilege 2504 wmic.exe Token: SeProfSingleProcessPrivilege 2504 wmic.exe Token: SeIncBasePriorityPrivilege 2504 wmic.exe Token: SeCreatePagefilePrivilege 2504 wmic.exe Token: SeBackupPrivilege 2504 wmic.exe Token: SeRestorePrivilege 2504 wmic.exe Token: SeShutdownPrivilege 2504 wmic.exe Token: SeDebugPrivilege 2504 wmic.exe Token: SeSystemEnvironmentPrivilege 2504 wmic.exe Token: SeRemoteShutdownPrivilege 2504 wmic.exe Token: SeUndockPrivilege 2504 wmic.exe Token: SeManageVolumePrivilege 2504 wmic.exe Token: 33 2504 wmic.exe Token: 34 2504 wmic.exe Token: 35 2504 wmic.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1632 wrote to memory of 2504 1632 MeshAgent.exe 32 PID 1632 wrote to memory of 2504 1632 MeshAgent.exe 32 PID 1632 wrote to memory of 2504 1632 MeshAgent.exe 32 PID 1632 wrote to memory of 2504 1632 MeshAgent.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\MeshAgent.exe"C:\Users\Admin\AppData\Local\Temp\MeshAgent.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Windows\SysWOW64\wbem\wmic.exewmic os get oslanguage /FORMAT:LIST2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2504
-