Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    10/07/2020, 07:10

General

  • Target

    Product Specification And RFQ#78900YG07_pdf.scr

  • Size

    513KB

  • MD5

    0fec2cd1a8286b98d2f134d786123584

  • SHA1

    bc22c817eddc7f3af9f1165f7e39c41fe1ce1b81

  • SHA256

    b274e5bdb1d3f6b09fc4b493ad952f19842c251fe6d6a145df1b722ec1a3be7f

  • SHA512

    cd2673969d9cd0ae4cc0593da9da5ab52e323df450b6bfc766931472c22bdce61de7713058fd15370174c5881c5244431197a1270c75bf490bb643bbe3dff57c

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Product Specification And RFQ#78900YG07_pdf.scr
    "C:\Users\Admin\AppData\Local\Temp\Product Specification And RFQ#78900YG07_pdf.scr" /S
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sfBLTCJwxKLyI" /XML "C:\Users\Admin\AppData\Local\Temp\tmp92DC.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1060

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads