Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
57s -
max time network
60s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/01/2023, 13:10
Static task
static1
Behavioral task
behavioral1
Sample
c5e78e9d7fbac0572d8b276968799bbced619cc7.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
c5e78e9d7fbac0572d8b276968799bbced619cc7.exe
Resource
win10v2004-20221111-en
General
-
Target
c5e78e9d7fbac0572d8b276968799bbced619cc7.exe
-
Size
1.1MB
-
MD5
c8f78f4ec916de2a794ada0f74524a92
-
SHA1
c5e78e9d7fbac0572d8b276968799bbced619cc7
-
SHA256
7f7322dd08a3f54e840b31b0c1c01a65676701cb15ed97ea3cdb6b0edf5402db
-
SHA512
b2c2fe87e2a335477a179ef184a0f10c389965e9774a6b4608de24ca2a37cc42592a43d7f7e2a50bc9c5a16dfaacefe970f87454acfdac7b6b4a7d2a338fe009
-
SSDEEP
12288:YV4g0gWsfISQ5KDYmMjlyCwv8GJhzVJMAv5gSi8riwUTiLdw/6WHvYM16ffrifPc:y0gWBSM8j/JhxZiSi8lUTyvWX1Qf+c
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5590596148:AAFELAezvK26mOp3KWIpAgxEVzQMQ56n6zg/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\JxkFp = "C:\\Users\\Admin\\AppData\\Roaming\\JxkFp\\JxkFp.exe" c5e78e9d7fbac0572d8b276968799bbced619cc7.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1508 set thread context of 1784 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1696 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1784 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 1784 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 1168 powershell.exe 1352 powershell.exe 1784 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1784 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe Token: SeDebugPrivilege 1168 powershell.exe Token: SeDebugPrivilege 1352 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1784 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1508 wrote to memory of 1168 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 28 PID 1508 wrote to memory of 1168 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 28 PID 1508 wrote to memory of 1168 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 28 PID 1508 wrote to memory of 1168 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 28 PID 1508 wrote to memory of 1352 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 30 PID 1508 wrote to memory of 1352 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 30 PID 1508 wrote to memory of 1352 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 30 PID 1508 wrote to memory of 1352 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 30 PID 1508 wrote to memory of 1696 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 32 PID 1508 wrote to memory of 1696 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 32 PID 1508 wrote to memory of 1696 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 32 PID 1508 wrote to memory of 1696 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 32 PID 1508 wrote to memory of 1784 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 34 PID 1508 wrote to memory of 1784 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 34 PID 1508 wrote to memory of 1784 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 34 PID 1508 wrote to memory of 1784 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 34 PID 1508 wrote to memory of 1784 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 34 PID 1508 wrote to memory of 1784 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 34 PID 1508 wrote to memory of 1784 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 34 PID 1508 wrote to memory of 1784 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 34 PID 1508 wrote to memory of 1784 1508 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe 34 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 c5e78e9d7fbac0572d8b276968799bbced619cc7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5e78e9d7fbac0572d8b276968799bbced619cc7.exe"C:\Users\Admin\AppData\Local\Temp\c5e78e9d7fbac0572d8b276968799bbced619cc7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\c5e78e9d7fbac0572d8b276968799bbced619cc7.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1168
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\YPAKilfGihHhm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1352
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\YPAKilfGihHhm" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB349.tmp"2⤵
- Creates scheduled task(s)
PID:1696
-
-
C:\Users\Admin\AppData\Local\Temp\c5e78e9d7fbac0572d8b276968799bbced619cc7.exe"C:\Users\Admin\AppData\Local\Temp\c5e78e9d7fbac0572d8b276968799bbced619cc7.exe"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1784
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5844870d645148bc3759321982048f811
SHA18e08b28a9c93133f3deebcd47f6a3efb82b273b5
SHA256c2eae45dc9f9e71de7c66e8c82e848af89917a55d3a81a60a05a8563428e0ac0
SHA5128e8c1600334857c48d662b50aa4dcc0bdef94dd4103ef0d0b6b56d9f18f82b5aa0dd8d2ca1b3881970caa392cdd5e755dd26aa2878b87edc210542876218b649
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5f2e31f3cb56250e5e7802c1119058cc8
SHA164cf0a863dd497768c4b8eec619e792c54af6ed8
SHA256326e552ff01114a5337154ca8055c65379ff310def446fd8942df17437d7735c
SHA51280961c05e4053ed9af4f8798955fab9cdd591cca0b3ccfe3b7dafe7fd1a22255f14d4a2cfbc1f47d70b881b68691dda6a15840ceba880f57b35f0da5fa244b10