Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231020-en -
resource tags
arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system -
submitted
22/11/2023, 11:31
Static task
static1
Behavioral task
behavioral1
Sample
f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe
Resource
win10v2004-20231020-en
General
-
Target
f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe
-
Size
354KB
-
MD5
07342ab8145b8873d7f16d937dee1e5f
-
SHA1
76b48b5a9b65fb540444db1bd40ab272340170e9
-
SHA256
f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b
-
SHA512
7418f053add33028343ec8913515a44dfb083db645154c9ca82410786c92cd622ee0520e0328abb367119187e0b332f1815099b9cac7df3d57196a5861edf78e
-
SSDEEP
6144:QBlL/Mf7ZfvDwnOREsssuSh2xDcsqznzhs4OUTU1YtbsBbh2ZmKpw:ikF7wnOVR/icskny4OKb2b0JO
Malware Config
Extracted
Protocol: smtp- Host:
mail.nmsltd.com.tr - Port:
587 - Username:
[email protected] - Password:
nms190019
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 2 IoCs
pid Process 2088 pqyrbtz.exe 2076 pqyrbtz.exe -
Loads dropped DLL 3 IoCs
pid Process 1272 f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe 1272 f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe 2088 pqyrbtz.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2088 set thread context of 2076 2088 pqyrbtz.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2076 pqyrbtz.exe 2076 pqyrbtz.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2088 pqyrbtz.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2076 pqyrbtz.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2076 pqyrbtz.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1272 wrote to memory of 2088 1272 f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe 28 PID 1272 wrote to memory of 2088 1272 f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe 28 PID 1272 wrote to memory of 2088 1272 f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe 28 PID 1272 wrote to memory of 2088 1272 f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe 28 PID 2088 wrote to memory of 2076 2088 pqyrbtz.exe 29 PID 2088 wrote to memory of 2076 2088 pqyrbtz.exe 29 PID 2088 wrote to memory of 2076 2088 pqyrbtz.exe 29 PID 2088 wrote to memory of 2076 2088 pqyrbtz.exe 29 PID 2088 wrote to memory of 2076 2088 pqyrbtz.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe"C:\Users\Admin\AppData\Local\Temp\f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\pqyrbtz.exe"C:\Users\Admin\AppData\Local\Temp\pqyrbtz.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Temp\pqyrbtz.exe"C:\Users\Admin\AppData\Local\Temp\pqyrbtz.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2076
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
339KB
MD5f57fc2b5206b6a305bb213ca7cc963ef
SHA1d78ca34cc003102d0a952ccbe8b53cf05e494bc7
SHA256400ab7cc63c610699a0dd5f98f02ab89d5867ca434fafe27c347d470361386a4
SHA5129fc7c13c48dd067417be6ce871470d5adadeffd67b5125c45ef4a2ade8f67d278af3998464da91133a52ae50c9d230ac154cce44fa62a3cc9cb6391101017b33
-
Filesize
188KB
MD5f99b29d5643bc8978d66d78c839fd7d9
SHA14292bac993ab3315636748e565f1b0a374c2f2a2
SHA256cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09
SHA5120c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1
-
Filesize
188KB
MD5f99b29d5643bc8978d66d78c839fd7d9
SHA14292bac993ab3315636748e565f1b0a374c2f2a2
SHA256cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09
SHA5120c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1
-
Filesize
188KB
MD5f99b29d5643bc8978d66d78c839fd7d9
SHA14292bac993ab3315636748e565f1b0a374c2f2a2
SHA256cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09
SHA5120c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1
-
Filesize
188KB
MD5f99b29d5643bc8978d66d78c839fd7d9
SHA14292bac993ab3315636748e565f1b0a374c2f2a2
SHA256cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09
SHA5120c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1
-
Filesize
188KB
MD5f99b29d5643bc8978d66d78c839fd7d9
SHA14292bac993ab3315636748e565f1b0a374c2f2a2
SHA256cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09
SHA5120c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1
-
Filesize
188KB
MD5f99b29d5643bc8978d66d78c839fd7d9
SHA14292bac993ab3315636748e565f1b0a374c2f2a2
SHA256cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09
SHA5120c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1
-
Filesize
188KB
MD5f99b29d5643bc8978d66d78c839fd7d9
SHA14292bac993ab3315636748e565f1b0a374c2f2a2
SHA256cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09
SHA5120c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1