Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
14/10/2023, 01:25
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe
Resource
win10v2004-20230915-en
General
-
Target
SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe
-
Size
401KB
-
MD5
f111e4ac9108f1bdbb1205b23abe1d28
-
SHA1
66484a2da4e8a5c63c2f0ff551c281b9b9e031cc
-
SHA256
0817f4e9a329fa90fba9136d6ba89a75cd7c3e78dffdd4d75f116f18c9610e25
-
SHA512
b2c032ba315415b15ef8e020f4472c29e56e3a1de69a2e126bfd5c5ca2581ffdcd7cb17fffb0656c4306b058fc740d1bb31dc165eaff447896faf9254bd7bdf7
-
SSDEEP
12288:GYIro7VTc2oUVyl793J0rUrWbcG9m+gkOYTth:GYKo5Tcu0993Sgi94gOGth
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 4 IoCs
pid Process 2372 qjtrdfqx.exe 2756 qjtrdfqx.exe 2956 qjtrdfqx.exe 2668 qjtrdfqx.exe -
Loads dropped DLL 4 IoCs
pid Process 3052 SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe 2372 qjtrdfqx.exe 2372 qjtrdfqx.exe 2372 qjtrdfqx.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 qjtrdfqx.exe Key opened \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 qjtrdfqx.exe Key opened \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 qjtrdfqx.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2372 set thread context of 2668 2372 qjtrdfqx.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2668 qjtrdfqx.exe 2668 qjtrdfqx.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 2372 qjtrdfqx.exe 2372 qjtrdfqx.exe 2372 qjtrdfqx.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2668 qjtrdfqx.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2668 qjtrdfqx.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 3052 wrote to memory of 2372 3052 SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe 28 PID 3052 wrote to memory of 2372 3052 SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe 28 PID 3052 wrote to memory of 2372 3052 SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe 28 PID 3052 wrote to memory of 2372 3052 SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe 28 PID 2372 wrote to memory of 2756 2372 qjtrdfqx.exe 29 PID 2372 wrote to memory of 2756 2372 qjtrdfqx.exe 29 PID 2372 wrote to memory of 2756 2372 qjtrdfqx.exe 29 PID 2372 wrote to memory of 2756 2372 qjtrdfqx.exe 29 PID 2372 wrote to memory of 2956 2372 qjtrdfqx.exe 30 PID 2372 wrote to memory of 2956 2372 qjtrdfqx.exe 30 PID 2372 wrote to memory of 2956 2372 qjtrdfqx.exe 30 PID 2372 wrote to memory of 2956 2372 qjtrdfqx.exe 30 PID 2372 wrote to memory of 2668 2372 qjtrdfqx.exe 31 PID 2372 wrote to memory of 2668 2372 qjtrdfqx.exe 31 PID 2372 wrote to memory of 2668 2372 qjtrdfqx.exe 31 PID 2372 wrote to memory of 2668 2372 qjtrdfqx.exe 31 PID 2372 wrote to memory of 2668 2372 qjtrdfqx.exe 31 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 qjtrdfqx.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3513876443-2771975297-1923446376-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 qjtrdfqx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.TrojanX-gen.32587.28932.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052 -
C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"3⤵
- Executes dropped EXE
PID:2756
-
-
C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"3⤵
- Executes dropped EXE
PID:2956
-
-
C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"C:\Users\Admin\AppData\Local\Temp\qjtrdfqx.exe"3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2668
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336KB
MD5dc6713ed93b2207523fc05e463708bf9
SHA13f06025d52cde6af57781f3977908c26cc23b38d
SHA2565de782b12df19e55fffb73f425c4ee16ee0cb351dc2de3f2e96d921b026528b8
SHA51231df1193a563f68879bffd51d15b799327e389cec57dc4c5f451abfc703e15d08c06ffb313967b1cce1cd734396fd6766f5f6838b2753c07f4d88ed18348bb2e
-
Filesize
165KB
MD513c5a699c800ce394b83653875357e42
SHA1747f3d620a23fc89ce381316e02cb5b0096bd471
SHA256a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be
SHA512f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9
-
Filesize
165KB
MD513c5a699c800ce394b83653875357e42
SHA1747f3d620a23fc89ce381316e02cb5b0096bd471
SHA256a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be
SHA512f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9
-
Filesize
165KB
MD513c5a699c800ce394b83653875357e42
SHA1747f3d620a23fc89ce381316e02cb5b0096bd471
SHA256a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be
SHA512f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9
-
Filesize
165KB
MD513c5a699c800ce394b83653875357e42
SHA1747f3d620a23fc89ce381316e02cb5b0096bd471
SHA256a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be
SHA512f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9
-
Filesize
165KB
MD513c5a699c800ce394b83653875357e42
SHA1747f3d620a23fc89ce381316e02cb5b0096bd471
SHA256a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be
SHA512f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9
-
Filesize
165KB
MD513c5a699c800ce394b83653875357e42
SHA1747f3d620a23fc89ce381316e02cb5b0096bd471
SHA256a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be
SHA512f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9
-
Filesize
165KB
MD513c5a699c800ce394b83653875357e42
SHA1747f3d620a23fc89ce381316e02cb5b0096bd471
SHA256a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be
SHA512f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9
-
Filesize
165KB
MD513c5a699c800ce394b83653875357e42
SHA1747f3d620a23fc89ce381316e02cb5b0096bd471
SHA256a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be
SHA512f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9
-
Filesize
165KB
MD513c5a699c800ce394b83653875357e42
SHA1747f3d620a23fc89ce381316e02cb5b0096bd471
SHA256a64300aad7826895f5e75bef649d58aaeabb180b482d13812efcac6fa658e0be
SHA512f1be67fceaaf7908b4382a45cdfd08cf5d3dc651145db9ac0fc0a4ba33c8d5809420f87d594ca06b15f1b754378f45367f85d9137b562e9d0cb43d7f192739a9