Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    91s
  • max time network
    69s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    05/10/2022, 22:18

General

  • Target

    TT Wire.exe

  • Size

    872KB

  • MD5

    276ab8f48c98e1c60608ee43d1825eef

  • SHA1

    b13d5bc0386ee638eb2b4ba1708b6e3674e6eec9

  • SHA256

    f9aa683158e2b07e7fdef14d6cb9c9b8034714a460bf9df6f90c7e58e2b1d47d

  • SHA512

    696aaf81a04a6f1f5ceffdf49d14dcb66c79e718716c5b393b8d5e0ea3d77a91b68f38cd2708f6184b13964b034c840a00f4b73216b18f6dbbde339e9be806a8

  • SSDEEP

    12288:XHKQ4A7s08hR64ngp2NAxGNHXx2ACFw4uTjzWADqjJ5nH:XC08znHNAQdXxSLjrH

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.bluemaster.es
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    F5a&T4w&

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TT Wire.exe
    "C:\Users\Admin\AppData\Local\Temp\TT Wire.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:112
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BFKdBSyxg" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF26B.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:1072
    • C:\Users\Admin\AppData\Local\Temp\TT Wire.exe
      "{path}"
      2⤵
        PID:1020
      • C:\Users\Admin\AppData\Local\Temp\TT Wire.exe
        "{path}"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:912

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpF26B.tmp

      Filesize

      1KB

      MD5

      e5ee4a66b3892788edc55edbc6c8a4a3

      SHA1

      de943b46ab2ca419ef36ce0deff7f09158646c7e

      SHA256

      674ddecccac0c2e58536441eae165949259c0c45190d705c2a6e0104dc0be6b1

      SHA512

      2fe2d2268c2940bba624b09a17604c3b1a02d3f26c7a1c6ec1e0a2ec760eb222287c6403e3bb21aec277415fcb7d8c2a5223f6bcf7509dd53baa35b0a11b05a5

    • memory/112-57-0x0000000004FF0000-0x0000000005074000-memory.dmp

      Filesize

      528KB

    • memory/112-55-0x0000000074C11000-0x0000000074C13000-memory.dmp

      Filesize

      8KB

    • memory/112-54-0x0000000000E20000-0x0000000000F00000-memory.dmp

      Filesize

      896KB

    • memory/112-58-0x0000000000B70000-0x0000000000BAA000-memory.dmp

      Filesize

      232KB

    • memory/112-56-0x0000000000470000-0x0000000000490000-memory.dmp

      Filesize

      128KB

    • memory/912-66-0x0000000000400000-0x000000000043A000-memory.dmp

      Filesize

      232KB

    • memory/912-61-0x0000000000400000-0x000000000043A000-memory.dmp

      Filesize

      232KB

    • memory/912-64-0x0000000000400000-0x000000000043A000-memory.dmp

      Filesize

      232KB

    • memory/912-65-0x0000000000400000-0x000000000043A000-memory.dmp

      Filesize

      232KB

    • memory/912-62-0x0000000000400000-0x000000000043A000-memory.dmp

      Filesize

      232KB

    • memory/912-69-0x0000000000400000-0x000000000043A000-memory.dmp

      Filesize

      232KB

    • memory/912-71-0x0000000000400000-0x000000000043A000-memory.dmp

      Filesize

      232KB