Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231130-en -
resource tags
arch:x64arch:x86image:win7-20231130-enlocale:en-usos:windows7-x64system -
submitted
12/12/2023, 14:39
Static task
static1
Behavioral task
behavioral1
Sample
attached final docs.exe
Resource
win7-20231130-en
Behavioral task
behavioral2
Sample
attached final docs.exe
Resource
win10v2004-20231130-en
General
-
Target
attached final docs.exe
-
Size
672KB
-
MD5
05bdbf0f45e344ba71847553e4900da0
-
SHA1
108de8169c3e3affadabb29a3da9d953efb79c87
-
SHA256
7f382cc5928a8adf09033a4412af83f103fe25384f7fb39343344432fc71f8c1
-
SHA512
922c275dd6ae6ed21a0a9789343d1848b739ff0dc5d4f0db4f8722b3b5804e0f9061d4ad1a22a7aef83044ed9fa9adbae33014b2df743fa52f364f9f57bd0198
-
SSDEEP
12288:2S3IU8S6eUd+qKo5v8XCQNhtFJXuxgOwZ0GPkqxEvYnfgAJ7pArHaBtUzefE:2IItSAd+qKo96vNxZMeA0tHE
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.precise.co.in - Port:
587 - Username:
[email protected] - Password:
Singh@2022$ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect ZGRat V1 1 IoCs
resource yara_rule behavioral1/memory/2100-3-0x00000000004C0000-0x00000000004D8000-memory.dmp family_zgrat_v1 -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2058106572-1146578376-825901627-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2100 set thread context of 2536 2100 attached final docs.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2588 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2100 attached final docs.exe 2100 attached final docs.exe 2100 attached final docs.exe 2100 attached final docs.exe 2100 attached final docs.exe 2100 attached final docs.exe 2100 attached final docs.exe 2100 attached final docs.exe 2720 powershell.exe 2624 powershell.exe 2100 attached final docs.exe 2536 RegSvcs.exe 2536 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2100 attached final docs.exe Token: SeDebugPrivilege 2720 powershell.exe Token: SeDebugPrivilege 2624 powershell.exe Token: SeDebugPrivilege 2536 RegSvcs.exe -
Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 2100 wrote to memory of 2624 2100 attached final docs.exe 36 PID 2100 wrote to memory of 2624 2100 attached final docs.exe 36 PID 2100 wrote to memory of 2624 2100 attached final docs.exe 36 PID 2100 wrote to memory of 2624 2100 attached final docs.exe 36 PID 2100 wrote to memory of 2720 2100 attached final docs.exe 34 PID 2100 wrote to memory of 2720 2100 attached final docs.exe 34 PID 2100 wrote to memory of 2720 2100 attached final docs.exe 34 PID 2100 wrote to memory of 2720 2100 attached final docs.exe 34 PID 2100 wrote to memory of 2588 2100 attached final docs.exe 33 PID 2100 wrote to memory of 2588 2100 attached final docs.exe 33 PID 2100 wrote to memory of 2588 2100 attached final docs.exe 33 PID 2100 wrote to memory of 2588 2100 attached final docs.exe 33 PID 2100 wrote to memory of 2648 2100 attached final docs.exe 30 PID 2100 wrote to memory of 2648 2100 attached final docs.exe 30 PID 2100 wrote to memory of 2648 2100 attached final docs.exe 30 PID 2100 wrote to memory of 2648 2100 attached final docs.exe 30 PID 2100 wrote to memory of 2648 2100 attached final docs.exe 30 PID 2100 wrote to memory of 2648 2100 attached final docs.exe 30 PID 2100 wrote to memory of 2648 2100 attached final docs.exe 30 PID 2100 wrote to memory of 2536 2100 attached final docs.exe 32 PID 2100 wrote to memory of 2536 2100 attached final docs.exe 32 PID 2100 wrote to memory of 2536 2100 attached final docs.exe 32 PID 2100 wrote to memory of 2536 2100 attached final docs.exe 32 PID 2100 wrote to memory of 2536 2100 attached final docs.exe 32 PID 2100 wrote to memory of 2536 2100 attached final docs.exe 32 PID 2100 wrote to memory of 2536 2100 attached final docs.exe 32 PID 2100 wrote to memory of 2536 2100 attached final docs.exe 32 PID 2100 wrote to memory of 2536 2100 attached final docs.exe 32 PID 2100 wrote to memory of 2536 2100 attached final docs.exe 32 PID 2100 wrote to memory of 2536 2100 attached final docs.exe 32 PID 2100 wrote to memory of 2536 2100 attached final docs.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\attached final docs.exe"C:\Users\Admin\AppData\Local\Temp\attached final docs.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2648
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TbuoHeok" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6690.tmp"2⤵
- Creates scheduled task(s)
PID:2588
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TbuoHeok.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\attached final docs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2624
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a5c199672f186d570d4bf6b8f63e23f9
SHA11b9084e5acfa6a43e46026b804958a81a2295cf6
SHA25639a68430189b8f455fd8b9f2822b93d48248216cee22a4a1bf86b8d4e77b6c02
SHA5129def786bc2424008e4f917474d2322bcf056e8b52877a23d34b6a2f06aa885178f86057824be6aa7f6f31b3b4eae5b0f14841ee88ee3b944e28d5c740149c515
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AMB69OFPCQLYQREJREJU.temp
Filesize7KB
MD5ea702c8ccf0146adee83a192a82ad4f0
SHA120d04efaff3dd9b67043907720e60bcd743ad9d1
SHA25663c9ec68834a300e90f2b288eaeb442ae9144082c36034be50b2943ca60ce9dc
SHA5127c7d0790ece5dd371909e3ffccbe3c69c1575795b48414274cda63971f3d81eb115ff56da8a7997ebd746e067227eeb8fe3f6769829e7c4c3b4364e1da024f24