Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system -
submitted
08/12/2023, 02:01
Static task
static1
Behavioral task
behavioral1
Sample
2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe
Resource
win7-20231201-en
Behavioral task
behavioral2
Sample
2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe
Resource
win10v2004-20231130-en
General
-
Target
2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe
-
Size
776KB
-
MD5
b9c88d71dcfa414a7b180fb9d8cdc893
-
SHA1
5ea001d2bb016c92f19e8eb2811e69a9e5a2567e
-
SHA256
2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c
-
SHA512
dd3e66e1ee44341633a91a44aa4dc9d5f414af6b84e6574d96f7c615323193827250d42f58bb6024012523f488a559c7648bd0d21b2d8c1843c41695123d99e4
-
SSDEEP
12288:8GXhkZ5PQEnlGQrF0ddBJryaOAenjVTgBS5LCj:82K/H/ZQWjVkBS
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.gimpex-imerys.com - Port:
587 - Username:
[email protected] - Password:
h45ZVRb6(IMF - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2504 set thread context of 2576 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2912 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 2796 powershell.exe 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe Token: SeDebugPrivilege 2796 powershell.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2796 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 28 PID 2504 wrote to memory of 2796 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 28 PID 2504 wrote to memory of 2796 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 28 PID 2504 wrote to memory of 2796 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 28 PID 2504 wrote to memory of 2912 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 30 PID 2504 wrote to memory of 2912 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 30 PID 2504 wrote to memory of 2912 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 30 PID 2504 wrote to memory of 2912 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 30 PID 2504 wrote to memory of 2576 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 32 PID 2504 wrote to memory of 2576 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 32 PID 2504 wrote to memory of 2576 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 32 PID 2504 wrote to memory of 2576 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 32 PID 2504 wrote to memory of 2576 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 32 PID 2504 wrote to memory of 2576 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 32 PID 2504 wrote to memory of 2576 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 32 PID 2504 wrote to memory of 2576 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 32 PID 2504 wrote to memory of 2576 2504 2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe"C:\Users\Admin\AppData\Local\Temp\2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\bDGvQJrECc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2796
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\bDGvQJrECc" /XML "C:\Users\Admin\AppData\Local\Temp\tmp537D.tmp"2⤵
- Creates scheduled task(s)
PID:2912
-
-
C:\Users\Admin\AppData\Local\Temp\2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe"C:\Users\Admin\AppData\Local\Temp\2be3900ebc7aed3c08b27ac96e699d6a3a498a6bc2e826334470abf50b90502c.exe"2⤵PID:2576
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5df82ad85bf51c3e4b50e46c0fff97bbb
SHA185327358e5bcb67dc398feb7bf48781b11001abe
SHA256ed981d16c4136229f4219e54d11e5297658500b81caaff7f75a1722420fd004c
SHA5120052fc0fe651dd2553157a7b6fe9d5f55b4055e9628f996b529e6cff7f56e01f0868eae3c61dfbb060c2a585b7bc31dd804e14ab7417ac764f84c20333997a47