Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
23/05/2024, 02:03
Static task
static1
Behavioral task
behavioral1
Sample
PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe
Resource
win10v2004-20240226-en
General
-
Target
PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe
-
Size
876KB
-
MD5
ef371eec27b49ddba4332cda7f5c3738
-
SHA1
6a7568498c09068e845c3341ea34d2ef8cb9eb15
-
SHA256
2e927bdc3e5bd50e16ec9b7c94a48a9bd6baf129728b8171e2f14f452ca476f7
-
SHA512
bd2d21126aafd328d3e48abd228cc0e1896b8a5e903ae3528f53bc3850f2c0e42262415978e0ac97395248fcb8a1627713956073544e2eae93c2b89a2f54814d
-
SSDEEP
12288:J7EhaAryXcd/C5gsunYMHag+30SypS41zBb9YfRcoIcvi7ZNeP71zjsxiY0LWxyi:XdMagsuV6lUL19+c0eWxz5Y0SxgUAq
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.nwac.com.ng - Port:
21 - Username:
[email protected] - Password:
Foundation+111
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2068 powershell.exe 2696 powershell.exe -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Run\hWgMNz = "C:\\Users\\Admin\\AppData\\Roaming\\hWgMNz\\hWgMNz.exe" vbc.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org 13 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2416 set thread context of 2700 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2648 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 2068 powershell.exe 2696 powershell.exe 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 2700 vbc.exe 2700 vbc.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe Token: SeDebugPrivilege 2068 powershell.exe Token: SeDebugPrivilege 2696 powershell.exe Token: SeDebugPrivilege 2700 vbc.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2700 vbc.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2416 wrote to memory of 2068 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 28 PID 2416 wrote to memory of 2068 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 28 PID 2416 wrote to memory of 2068 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 28 PID 2416 wrote to memory of 2068 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 28 PID 2416 wrote to memory of 2696 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 30 PID 2416 wrote to memory of 2696 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 30 PID 2416 wrote to memory of 2696 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 30 PID 2416 wrote to memory of 2696 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 30 PID 2416 wrote to memory of 2648 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 31 PID 2416 wrote to memory of 2648 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 31 PID 2416 wrote to memory of 2648 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 31 PID 2416 wrote to memory of 2648 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 31 PID 2416 wrote to memory of 2568 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 34 PID 2416 wrote to memory of 2568 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 34 PID 2416 wrote to memory of 2568 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 34 PID 2416 wrote to memory of 2568 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 34 PID 2416 wrote to memory of 2700 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 35 PID 2416 wrote to memory of 2700 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 35 PID 2416 wrote to memory of 2700 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 35 PID 2416 wrote to memory of 2700 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 35 PID 2416 wrote to memory of 2700 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 35 PID 2416 wrote to memory of 2700 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 35 PID 2416 wrote to memory of 2700 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 35 PID 2416 wrote to memory of 2700 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 35 PID 2416 wrote to memory of 2700 2416 PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe"C:\Users\Admin\AppData\Local\Temp\PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO 20567812_PDF Kumaran Industries PVT LTD iGST_eH2mYaM.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fTaIHxljaWVCs.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fTaIHxljaWVCs" /XML "C:\Users\Admin\AppData\Local\Temp\tmp517A.tmp"2⤵
- Creates scheduled task(s)
PID:2648
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵PID:2568
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2700
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scripting
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD539761af18af6c6596a6ffdc07ca30a09
SHA18c60b53af5bca4156aef68da226d267295a3a35e
SHA256b1d8f6ae4c9bb528fb5ff9235c4a56d0a7855c193c25638d79b29fddbc031ff0
SHA512f5e868aa9addb20299c228804e7e8c0c5acde3635fdf081c00d05c7e08248970f3efb2964fb7ffff278bb042c9d3079da262a463834c4bd5ae096bc5c18c3d84
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD57c859f3206461041c25e0d2db5bec8ef
SHA171f50b0a2dc97dbeb2119a39bc5e2fec932c4f43
SHA256face4163cf4659bcc6f6db2ff5cd8909fe36682878ef973b2b28b5149e6b8d8d
SHA51207061cd82435662d4610987d0855e51b62742c3ed7461fb6ec6a03527b5ac8f710db396584aa2d93a363bf493451fab66221a6d183353b04a04a1ee4c84ab10e