Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
11/07/2024, 11:00
Static task
static1
Behavioral task
behavioral1
Sample
MalwareBazaar.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
MalwareBazaar.exe
Resource
win10v2004-20240709-en
General
-
Target
MalwareBazaar.exe
-
Size
1.0MB
-
MD5
f5bac2ef87aec0f350664e196e8a9419
-
SHA1
afd8029edd667d1ddfbf187a087f13e036f7fa85
-
SHA256
5336ea09a652db0033ba0afe10a112e07e92ec31b9083b3bb0589c0bbcb6042f
-
SHA512
7caf8d892c33fb046d17691e549bf1a8ee93c322933a901d92d2eeba813336c94bdb647201ee5ef32f9f1be72db197bb43edbc50155215a6b849e7784f086201
-
SSDEEP
24576:jAHnh+eWsN3skA4RV1Hom2KXMmHagKTB3KtpQ5:uh+ZkldoPK8Yagc30c
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.myhydropowered.com - Port:
587 - Username:
[email protected] - Password:
0TFiRgPxmCJcdSB - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 2 api.ipify.org 3 api.ipify.org 4 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2676 set thread context of 1736 2676 MalwareBazaar.exe 30 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1736 RegSvcs.exe 1736 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2676 MalwareBazaar.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1736 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2676 MalwareBazaar.exe 2676 MalwareBazaar.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2676 MalwareBazaar.exe 2676 MalwareBazaar.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2676 wrote to memory of 1736 2676 MalwareBazaar.exe 30 PID 2676 wrote to memory of 1736 2676 MalwareBazaar.exe 30 PID 2676 wrote to memory of 1736 2676 MalwareBazaar.exe 30 PID 2676 wrote to memory of 1736 2676 MalwareBazaar.exe 30 PID 2676 wrote to memory of 1736 2676 MalwareBazaar.exe 30 PID 2676 wrote to memory of 1736 2676 MalwareBazaar.exe 30 PID 2676 wrote to memory of 1736 2676 MalwareBazaar.exe 30 PID 2676 wrote to memory of 1736 2676 MalwareBazaar.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2676 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\MalwareBazaar.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1736
-