Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    129s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    23/09/2022, 07:47

General

  • Target

    Copia de pago.exe

  • Size

    1.7MB

  • MD5

    6d231b98f7bc3098fd9797c0e1d6744f

  • SHA1

    ee54b5f53f5f9a8cdf7970a051b5b61bf33ce7aa

  • SHA256

    b61c01986b22368ac8981d54811a6c7c1355b6e0f40c51b5ceba65229989d7a3

  • SHA512

    1773cb371c399d04804eb8670529b5483c0c28e53bbe2dac870c937c63de76e76dec5076c83189e4adff26df548b807b2bb2794144a41c15368dcf2f9994b17e

  • SSDEEP

    49152:DhaduXrt6WEHuWGP+llufXP4fthV0lJGseTp:Faw7t61Ot3H4ft34Js

Malware Config

Extracted

Family

agenttesla

Credentials

Extracted

Family

wshrat

C2

http://goods.camdvr.org:2888

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • WSHRAT

    WSHRAT is a variant of Houdini worm and has vbs and js variants.

  • WSHRAT payload 1 IoCs
  • Blocklisted process makes network request 11 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Copia de pago.exe
    "C:\Users\Admin\AppData\Local\Temp\Copia de pago.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Users\Admin\AppData\Local\Temp\Copia de pago.exe
      "C:\Users\Admin\AppData\Local\Temp\Copia de pago.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:852
      • C:\Windows\SysWOW64\wscript.exe
        "C:\Windows\System32\wscript.exe" "C:\Users\Admin\AppData\Roaming\MGosm.vbs"
        3⤵
        • Blocklisted process makes network request
        • Loads dropped DLL
        • Adds Run key to start application
        • Suspicious use of WriteProcessMemory
        PID:1280
        • C:\Users\Admin\AppData\Roaming\nicon4.0origin.exe
          "C:\Users\Admin\AppData\Roaming\nicon4.0origin.exe"
          4⤵
          • Drops file in Drivers directory
          • Executes dropped EXE
          • Accesses Microsoft Outlook profiles
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • outlook_office_path
          • outlook_win_path
          PID:1552

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\MGosm.vbs

    Filesize

    461KB

    MD5

    42bc41987e5e104aafa3570d52cd4b0c

    SHA1

    5e4f3309ef9155827e8063a0f28efc30400d64d7

    SHA256

    1355642926463f9b14c8b40fcafeed3f1dec0c771692ec7fdb76c0e1976d8f58

    SHA512

    60a2cb5608d95206f50a6f57ddd8e6c2a69b7cab61fb031b8cdc1b87be2c98e4b27540ff4dcf1d0e46bad335570c55b13491a408e3f6d668ab937a6a3e2af22d

  • C:\Users\Admin\AppData\Roaming\nicon4.0origin.exe

    Filesize

    211KB

    MD5

    993c330b4f0e94b46664f2f0bf3309c2

    SHA1

    39927969b78ab13d5fe3a3888145204a1e13afd8

    SHA256

    6aba8a03fd93b96c073cfc3cd2801926f9a6f25bc2afb95a686237e6900a184e

    SHA512

    a0c38f039d21bda0a800b5453d3e96bc5e8ef0b9bdc4756756b426de866f288e5dd25ea449faf48e61c535a9b0942993467976d350da37f0f55f9af9828af186

  • C:\Users\Admin\AppData\Roaming\nicon4.0origin.exe

    Filesize

    211KB

    MD5

    993c330b4f0e94b46664f2f0bf3309c2

    SHA1

    39927969b78ab13d5fe3a3888145204a1e13afd8

    SHA256

    6aba8a03fd93b96c073cfc3cd2801926f9a6f25bc2afb95a686237e6900a184e

    SHA512

    a0c38f039d21bda0a800b5453d3e96bc5e8ef0b9bdc4756756b426de866f288e5dd25ea449faf48e61c535a9b0942993467976d350da37f0f55f9af9828af186

  • \Users\Admin\AppData\Roaming\nicon4.0origin.exe

    Filesize

    211KB

    MD5

    993c330b4f0e94b46664f2f0bf3309c2

    SHA1

    39927969b78ab13d5fe3a3888145204a1e13afd8

    SHA256

    6aba8a03fd93b96c073cfc3cd2801926f9a6f25bc2afb95a686237e6900a184e

    SHA512

    a0c38f039d21bda0a800b5453d3e96bc5e8ef0b9bdc4756756b426de866f288e5dd25ea449faf48e61c535a9b0942993467976d350da37f0f55f9af9828af186

  • memory/852-66-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/852-72-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/852-70-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/852-61-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/852-62-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/852-64-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/852-67-0x0000000000400000-0x0000000000552000-memory.dmp

    Filesize

    1.3MB

  • memory/1552-80-0x00000000000D0000-0x000000000010C000-memory.dmp

    Filesize

    240KB

  • memory/1660-60-0x0000000008590000-0x00000000086E4000-memory.dmp

    Filesize

    1.3MB

  • memory/1660-59-0x00000000082B0000-0x0000000008426000-memory.dmp

    Filesize

    1.5MB

  • memory/1660-54-0x0000000000BB0000-0x0000000000D72000-memory.dmp

    Filesize

    1.8MB

  • memory/1660-58-0x0000000000420000-0x000000000042C000-memory.dmp

    Filesize

    48KB

  • memory/1660-57-0x0000000000410000-0x0000000000424000-memory.dmp

    Filesize

    80KB

  • memory/1660-56-0x00000000003C0000-0x00000000003D4000-memory.dmp

    Filesize

    80KB

  • memory/1660-55-0x0000000075FB1000-0x0000000075FB3000-memory.dmp

    Filesize

    8KB