Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
32s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
16/07/2020, 12:41
Static task
static1
Behavioral task
behavioral1
Sample
PAYMENT ADVICE.pdf.htm.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
PAYMENT ADVICE.pdf.htm.exe
Resource
win10
General
-
Target
PAYMENT ADVICE.pdf.htm.exe
-
Size
566KB
-
MD5
c4df328f52522f048ca32b7e479fc0ac
-
SHA1
cbb4726598aa012f15ee5191b434f8d29d54851a
-
SHA256
75bf8cf9e7b9b06f08396a6d6ecf3bca428c00cd79e4b9bf6e56619b67d7c4de
-
SHA512
d5908f6e07f25e108c34ea23eae68d76d2d77df9cf4bde346c94b4d9037ffac5ff1387250d42b8721e2a7a3e617ef1b2a01c08e444509fafbed267cdbf76ee51
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.ru - Port:
587 - Username:
[email protected] - Password:
kingmoney12345
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
resource yara_rule behavioral1/memory/1800-2-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1800-3-0x0000000000446DDE-mapping.dmp family_agenttesla behavioral1/memory/1800-4-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1800-5-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1400 set thread context of 1800 1400 PAYMENT ADVICE.pdf.htm.exe 26 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1800 PAYMENT ADVICE.pdf.htm.exe 1800 PAYMENT ADVICE.pdf.htm.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1800 PAYMENT ADVICE.pdf.htm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1800 PAYMENT ADVICE.pdf.htm.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1400 wrote to memory of 1800 1400 PAYMENT ADVICE.pdf.htm.exe 26 PID 1400 wrote to memory of 1800 1400 PAYMENT ADVICE.pdf.htm.exe 26 PID 1400 wrote to memory of 1800 1400 PAYMENT ADVICE.pdf.htm.exe 26 PID 1400 wrote to memory of 1800 1400 PAYMENT ADVICE.pdf.htm.exe 26 PID 1400 wrote to memory of 1800 1400 PAYMENT ADVICE.pdf.htm.exe 26 PID 1400 wrote to memory of 1800 1400 PAYMENT ADVICE.pdf.htm.exe 26 PID 1400 wrote to memory of 1800 1400 PAYMENT ADVICE.pdf.htm.exe 26 PID 1400 wrote to memory of 1800 1400 PAYMENT ADVICE.pdf.htm.exe 26 PID 1400 wrote to memory of 1800 1400 PAYMENT ADVICE.pdf.htm.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.pdf.htm.exe"C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.pdf.htm.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\Temp\PAYMENT ADVICE.pdf.htm.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1800
-