Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    142s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    22/11/2023, 11:31

General

  • Target

    f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe

  • Size

    354KB

  • MD5

    07342ab8145b8873d7f16d937dee1e5f

  • SHA1

    76b48b5a9b65fb540444db1bd40ab272340170e9

  • SHA256

    f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b

  • SHA512

    7418f053add33028343ec8913515a44dfb083db645154c9ca82410786c92cd622ee0520e0328abb367119187e0b332f1815099b9cac7df3d57196a5861edf78e

  • SSDEEP

    6144:QBlL/Mf7ZfvDwnOREsssuSh2xDcsqznzhs4OUTU1YtbsBbh2ZmKpw:ikF7wnOVR/icskny4OKb2b0JO

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    mail.nmsltd.com.tr
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    nms190019

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe
    "C:\Users\Admin\AppData\Local\Temp\f38eafdd884c8454807dffb00f7642d637e212a65225d212b55c03890588c77b.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1272
    • C:\Users\Admin\AppData\Local\Temp\pqyrbtz.exe
      "C:\Users\Admin\AppData\Local\Temp\pqyrbtz.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2088
      • C:\Users\Admin\AppData\Local\Temp\pqyrbtz.exe
        "C:\Users\Admin\AppData\Local\Temp\pqyrbtz.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:2076

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\jkgohtl.mdj

    Filesize

    339KB

    MD5

    f57fc2b5206b6a305bb213ca7cc963ef

    SHA1

    d78ca34cc003102d0a952ccbe8b53cf05e494bc7

    SHA256

    400ab7cc63c610699a0dd5f98f02ab89d5867ca434fafe27c347d470361386a4

    SHA512

    9fc7c13c48dd067417be6ce871470d5adadeffd67b5125c45ef4a2ade8f67d278af3998464da91133a52ae50c9d230ac154cce44fa62a3cc9cb6391101017b33

  • C:\Users\Admin\AppData\Local\Temp\pqyrbtz.exe

    Filesize

    188KB

    MD5

    f99b29d5643bc8978d66d78c839fd7d9

    SHA1

    4292bac993ab3315636748e565f1b0a374c2f2a2

    SHA256

    cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09

    SHA512

    0c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1

  • C:\Users\Admin\AppData\Local\Temp\pqyrbtz.exe

    Filesize

    188KB

    MD5

    f99b29d5643bc8978d66d78c839fd7d9

    SHA1

    4292bac993ab3315636748e565f1b0a374c2f2a2

    SHA256

    cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09

    SHA512

    0c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1

  • C:\Users\Admin\AppData\Local\Temp\pqyrbtz.exe

    Filesize

    188KB

    MD5

    f99b29d5643bc8978d66d78c839fd7d9

    SHA1

    4292bac993ab3315636748e565f1b0a374c2f2a2

    SHA256

    cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09

    SHA512

    0c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1

  • C:\Users\Admin\AppData\Local\Temp\pqyrbtz.exe

    Filesize

    188KB

    MD5

    f99b29d5643bc8978d66d78c839fd7d9

    SHA1

    4292bac993ab3315636748e565f1b0a374c2f2a2

    SHA256

    cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09

    SHA512

    0c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1

  • \Users\Admin\AppData\Local\Temp\pqyrbtz.exe

    Filesize

    188KB

    MD5

    f99b29d5643bc8978d66d78c839fd7d9

    SHA1

    4292bac993ab3315636748e565f1b0a374c2f2a2

    SHA256

    cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09

    SHA512

    0c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1

  • \Users\Admin\AppData\Local\Temp\pqyrbtz.exe

    Filesize

    188KB

    MD5

    f99b29d5643bc8978d66d78c839fd7d9

    SHA1

    4292bac993ab3315636748e565f1b0a374c2f2a2

    SHA256

    cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09

    SHA512

    0c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1

  • \Users\Admin\AppData\Local\Temp\pqyrbtz.exe

    Filesize

    188KB

    MD5

    f99b29d5643bc8978d66d78c839fd7d9

    SHA1

    4292bac993ab3315636748e565f1b0a374c2f2a2

    SHA256

    cb00674347d7327a569221ce990303f6bcc1d4b4af43756e34b91877c5cf9c09

    SHA512

    0c584896e02d43d1ec2a82072c9b5c9a3c627a3ae4088b7900a11d9cb534854cd707a79cc45efca90f2e9f3268c6ef0d17cc6b0015b93151fde219491f81dec1

  • memory/2076-18-0x0000000001ED0000-0x0000000001F12000-memory.dmp

    Filesize

    264KB

  • memory/2076-13-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2076-16-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2076-17-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2076-19-0x0000000074110000-0x00000000747FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2076-20-0x00000000045B0000-0x00000000045F0000-memory.dmp

    Filesize

    256KB

  • memory/2076-21-0x00000000045B0000-0x00000000045F0000-memory.dmp

    Filesize

    256KB

  • memory/2076-22-0x0000000000400000-0x0000000000454000-memory.dmp

    Filesize

    336KB

  • memory/2076-23-0x0000000074110000-0x00000000747FE000-memory.dmp

    Filesize

    6.9MB

  • memory/2088-9-0x0000000000220000-0x0000000000222000-memory.dmp

    Filesize

    8KB