Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    23/08/2023, 13:12

General

  • Target

    overdue invoice pdf.exe

  • Size

    847KB

  • MD5

    a3976a8131593cd5f257e1609cba021c

  • SHA1

    1e761268105bc1613d697d9941447c3241463029

  • SHA256

    0f350d7a72e30d6fa7234e953e127b426ffabb6960446a90a53d6c0dd6392138

  • SHA512

    d8b5c3b2d39b1fe89a5db1fc273527c163ebac5f2933799cc279b76def0eecd7e3047bb29b0b7c9feb6b6fe92ca8d302e52cd277da08f07f75f1676d0dac75eb

  • SSDEEP

    12288:LUVv25w+n42d1mbTzFgaJmv3xnPBtDPLd4o8wTrQ2lIC6swoeXGkDkNMw+gtYaIS:LdcBmvxLLFHIvtXGkDkSwvYmZf

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\overdue invoice pdf.exe
    "C:\Users\Admin\AppData\Local\Temp\overdue invoice pdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2600
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\overdue invoice pdf.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2984
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\artlkRu.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2012
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\artlkRu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp14B9.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2884
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
        PID:2700
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        2⤵
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2132

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmp14B9.tmp

      Filesize

      1KB

      MD5

      99733f193fccd8fb39e584269104d6e3

      SHA1

      3264487f6a5e3f0f366170a279e079415dc328ce

      SHA256

      875898d28472f800aed52cb3ab1f4a99ac662cd3e3588c9a951e214d08e50f52

      SHA512

      dc2651ec97db4541d477915a415fcfdc10683440e9d69230e9e83965c538494208364de289ff1448e397aae54ca065984535bdec36e8319f45dd67584a138166

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\6CAV34SFG2A5KTZ4QXQ8.temp

      Filesize

      7KB

      MD5

      0211855bb477b089f5bb25e44f19839e

      SHA1

      68caf658e74e7d55180c6bb0224d2c670a3cc4f8

      SHA256

      98449db521151fccaa8a6089c738973f2cbe8706f563c5dc2e7ccaace89f2076

      SHA512

      5aea6fcaeec2ac646e63db8dcd0bab1b00703a1cb2f05f847acb4dbd9e46596b4a5db65c54fc8f9dd68db35b3f41b199d837d098331f968ddde855432a83334c

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

      Filesize

      7KB

      MD5

      0211855bb477b089f5bb25e44f19839e

      SHA1

      68caf658e74e7d55180c6bb0224d2c670a3cc4f8

      SHA256

      98449db521151fccaa8a6089c738973f2cbe8706f563c5dc2e7ccaace89f2076

      SHA512

      5aea6fcaeec2ac646e63db8dcd0bab1b00703a1cb2f05f847acb4dbd9e46596b4a5db65c54fc8f9dd68db35b3f41b199d837d098331f968ddde855432a83334c

    • memory/2012-42-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

      Filesize

      5.7MB

    • memory/2012-25-0x0000000002580000-0x00000000025C0000-memory.dmp

      Filesize

      256KB

    • memory/2012-23-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

      Filesize

      5.7MB

    • memory/2012-22-0x0000000002580000-0x00000000025C0000-memory.dmp

      Filesize

      256KB

    • memory/2012-20-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

      Filesize

      5.7MB

    • memory/2132-29-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2132-30-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2132-46-0x00000000047D0000-0x0000000004810000-memory.dmp

      Filesize

      256KB

    • memory/2132-45-0x0000000074810000-0x0000000074EFE000-memory.dmp

      Filesize

      6.9MB

    • memory/2132-41-0x00000000047D0000-0x0000000004810000-memory.dmp

      Filesize

      256KB

    • memory/2132-40-0x0000000074810000-0x0000000074EFE000-memory.dmp

      Filesize

      6.9MB

    • memory/2132-36-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2132-38-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2132-34-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2132-31-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2132-32-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2132-28-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2600-39-0x0000000074810000-0x0000000074EFE000-memory.dmp

      Filesize

      6.9MB

    • memory/2600-7-0x0000000007DD0000-0x0000000007E4C000-memory.dmp

      Filesize

      496KB

    • memory/2600-2-0x0000000000E50000-0x0000000000E90000-memory.dmp

      Filesize

      256KB

    • memory/2600-6-0x0000000000530000-0x000000000053E000-memory.dmp

      Filesize

      56KB

    • memory/2600-0-0x0000000001140000-0x0000000001218000-memory.dmp

      Filesize

      864KB

    • memory/2600-5-0x0000000000E50000-0x0000000000E90000-memory.dmp

      Filesize

      256KB

    • memory/2600-3-0x0000000000510000-0x000000000052C000-memory.dmp

      Filesize

      112KB

    • memory/2600-1-0x0000000074810000-0x0000000074EFE000-memory.dmp

      Filesize

      6.9MB

    • memory/2600-4-0x0000000074810000-0x0000000074EFE000-memory.dmp

      Filesize

      6.9MB

    • memory/2984-21-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

      Filesize

      5.7MB

    • memory/2984-43-0x000000006F6C0000-0x000000006FC6B000-memory.dmp

      Filesize

      5.7MB

    • memory/2984-27-0x0000000002150000-0x0000000002190000-memory.dmp

      Filesize

      256KB

    • memory/2984-24-0x0000000002150000-0x0000000002190000-memory.dmp

      Filesize

      256KB

    • memory/2984-26-0x0000000002150000-0x0000000002190000-memory.dmp

      Filesize

      256KB