Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
125s -
platform
windows10_x64 -
resource
win10 -
submitted
07/07/2020, 12:52
General
-
Target
New Order.exe
-
Size
427KB
-
MD5
9fa90422f13ff85f849c28367ad97e11
-
SHA1
7c920bb3c70c1f133d7b7a12df8f4ce6f1a262fa
-
SHA256
23f570b95cb1580bf303918349c89d37bfefa19c76dc269b8af9be2438693da4
-
SHA512
5aa6e87e75eeb356135b907a913e63289cf4465b7134c89f40b8d8046b5c99323781e754bda8eed0097f3f8788d01ca695af90620779f1f9034a870cfca412d9
Score
10/10
Malware Config
Extracted
Credentials
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
ikem123456789
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"C:\Users\Admin\AppData\Local\Temp\New Order.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\New Order.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
304KB