Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
07/06/2023, 09:43
Static task
static1
Behavioral task
behavioral1
Sample
draft packing list.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
draft packing list.exe
Resource
win10v2004-20230220-en
General
-
Target
draft packing list.exe
-
Size
751KB
-
MD5
5a9ac906a8372028402081f0e4eb640e
-
SHA1
5350c709b115f24b3144e1da467786d6457a36e0
-
SHA256
1c132ba72408b895776d0e5e21f30de4a546e0bfbe39d7b54fc50a3d5cc0a60a
-
SHA512
a421680482452ac33d8a6b3c7c99124cca8591d6cad59fb8da38e0ec305e4c280a64b6d8dd593fe698d859e848ac7668a60fcc29cf467807029a2e87e53d38ee
-
SSDEEP
12288:5d6L7PVgfLiWbhaDnLMzIL2q+RTdOL86c2owHEqae/FF9b+H8vTugGHqesvFFhuO:vOyqGUL8dZwPwcvFuq
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gimpex-imerys.com - Port:
587 - Username:
[email protected] - Password:
h45ZVRb6(IMF - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 draft packing list.exe Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 draft packing list.exe Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 draft packing list.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2004 set thread context of 1476 2004 draft packing list.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1180 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2004 draft packing list.exe 2004 draft packing list.exe 2004 draft packing list.exe 1404 powershell.exe 1476 draft packing list.exe 1476 draft packing list.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2004 draft packing list.exe Token: SeDebugPrivilege 1476 draft packing list.exe Token: SeDebugPrivilege 1404 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2004 wrote to memory of 1404 2004 draft packing list.exe 28 PID 2004 wrote to memory of 1404 2004 draft packing list.exe 28 PID 2004 wrote to memory of 1404 2004 draft packing list.exe 28 PID 2004 wrote to memory of 1404 2004 draft packing list.exe 28 PID 2004 wrote to memory of 1180 2004 draft packing list.exe 30 PID 2004 wrote to memory of 1180 2004 draft packing list.exe 30 PID 2004 wrote to memory of 1180 2004 draft packing list.exe 30 PID 2004 wrote to memory of 1180 2004 draft packing list.exe 30 PID 2004 wrote to memory of 1476 2004 draft packing list.exe 32 PID 2004 wrote to memory of 1476 2004 draft packing list.exe 32 PID 2004 wrote to memory of 1476 2004 draft packing list.exe 32 PID 2004 wrote to memory of 1476 2004 draft packing list.exe 32 PID 2004 wrote to memory of 1476 2004 draft packing list.exe 32 PID 2004 wrote to memory of 1476 2004 draft packing list.exe 32 PID 2004 wrote to memory of 1476 2004 draft packing list.exe 32 PID 2004 wrote to memory of 1476 2004 draft packing list.exe 32 PID 2004 wrote to memory of 1476 2004 draft packing list.exe 32 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 draft packing list.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3499517378-2376672570-1134980332-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 draft packing list.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\draft packing list.exe"C:\Users\Admin\AppData\Local\Temp\draft packing list.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HnPbakLUi.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1404
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HnPbakLUi" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB25F.tmp"2⤵
- Creates scheduled task(s)
PID:1180
-
-
C:\Users\Admin\AppData\Local\Temp\draft packing list.exe"C:\Users\Admin\AppData\Local\Temp\draft packing list.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1476
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55c91d8b3018da4a237587f6e101546ae
SHA1a554f94a47a5e95dccaf09ee468dd2cc9cb1129e
SHA256220d70f515a6280129410def326719e6f909f0875cd0fe1051a9d0bb839fcd2e
SHA512ff43fc06a9572c0917ea46229c4b0ea5db4958724986bbef024b519e5f73140488dac8e574d13521c3503817de0a18f371d1e5943295f1dbfde26e528278edf2