Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
AN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
AN.exe
Resource
win10v2004-20240802-en
General
-
Target
AN.exe
-
Size
730KB
-
MD5
d72520639cb73d3364d7258c15518f55
-
SHA1
6e1ebb649b0e00d4c8ebae01d481b4bd75b64eaf
-
SHA256
ca9f996e829c1e7ad89c66f78bde33741d46a0b7ed03c8892f263937b0e6b400
-
SHA512
207ab7047077f8c29ce24c46c2dc11ea5cbbbc2e00aa5955a3217518ffaf325c4cd2eb101be5d5885d9e78e6599402df7356bf4c02bd2bf8b32a3f62f9049be2
-
SSDEEP
12288:Zb9eGY0igo17oLwnqDUMeEDAYERZu9Kt0ZoV54IqOVEOYCa0qCkR:Zb8G/q1csnIuEobu97a54INCOsB
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.shaktiinstrumentations.in - Port:
587 - Username:
[email protected] - Password:
Shakti54231!@#$%#@! - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2744 powershell.exe 3000 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1840 set thread context of 2636 1840 AN.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2880 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 1840 AN.exe 1840 AN.exe 1840 AN.exe 1840 AN.exe 1840 AN.exe 1840 AN.exe 1840 AN.exe 2636 RegSvcs.exe 2636 RegSvcs.exe 3000 powershell.exe 2744 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1840 AN.exe Token: SeDebugPrivilege 2636 RegSvcs.exe Token: SeDebugPrivilege 2744 powershell.exe Token: SeDebugPrivilege 3000 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1840 wrote to memory of 2744 1840 AN.exe 29 PID 1840 wrote to memory of 2744 1840 AN.exe 29 PID 1840 wrote to memory of 2744 1840 AN.exe 29 PID 1840 wrote to memory of 2744 1840 AN.exe 29 PID 1840 wrote to memory of 3000 1840 AN.exe 31 PID 1840 wrote to memory of 3000 1840 AN.exe 31 PID 1840 wrote to memory of 3000 1840 AN.exe 31 PID 1840 wrote to memory of 3000 1840 AN.exe 31 PID 1840 wrote to memory of 2880 1840 AN.exe 33 PID 1840 wrote to memory of 2880 1840 AN.exe 33 PID 1840 wrote to memory of 2880 1840 AN.exe 33 PID 1840 wrote to memory of 2880 1840 AN.exe 33 PID 1840 wrote to memory of 2636 1840 AN.exe 35 PID 1840 wrote to memory of 2636 1840 AN.exe 35 PID 1840 wrote to memory of 2636 1840 AN.exe 35 PID 1840 wrote to memory of 2636 1840 AN.exe 35 PID 1840 wrote to memory of 2636 1840 AN.exe 35 PID 1840 wrote to memory of 2636 1840 AN.exe 35 PID 1840 wrote to memory of 2636 1840 AN.exe 35 PID 1840 wrote to memory of 2636 1840 AN.exe 35 PID 1840 wrote to memory of 2636 1840 AN.exe 35 PID 1840 wrote to memory of 2636 1840 AN.exe 35 PID 1840 wrote to memory of 2636 1840 AN.exe 35 PID 1840 wrote to memory of 2636 1840 AN.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\AN.exe"C:\Users\Admin\AppData\Local\Temp\AN.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\AN.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2744
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dHTSFxSZNXvPYW.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dHTSFxSZNXvPYW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF586.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2880
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2636
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD52c0b47de83f6ae190d2fe953883946a3
SHA1154c5045ffe4be8d3a75c188158743427ace3021
SHA2566f971256f317c9c0add808a07a6640188cc1b57b586709f53c6d3872c5ba0b78
SHA5128f26975049a52aad737d97162afedf043ae18748302170877907cae07deb286e92f65d4bf70f1c16d3d9cdc055f4cbfe1c981ce0ce7dc83232d6b10d84ba05c8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JH9TUTM0CWV5G2KU55ML.temp
Filesize7KB
MD53702f0b16c0f7e02c98f324d9beba4c6
SHA1ff08ac29bd6eb052f7e4ac73dc744bb30a1ab086
SHA256f874e63745b1cd7cd7bc892bc3fc8e64417e61fdb7defffccab63fead8fcbecd
SHA512bebac4d15add093a2a6ecc752d19534ed26b908f9fd1b91b053d7e25deb9ccac0f2e83f1bea2bd294fc02f1aaca3c3fa1e3363b008b27630b0bdccd2797702b3