Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
145s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04/09/2024, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe
Resource
win10v2004-20240802-en
General
-
Target
3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe
-
Size
973KB
-
MD5
5c476a26f9288899b8c5df769549dc3b
-
SHA1
cb7794062569e0ca10e1588fbc454b6ba0f59f37
-
SHA256
3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86
-
SHA512
56e415db49c949d1853e92f0626e95413d194e38c21fc8bc59809f76c73ef3d634ac9bde868a8328971706797a103e2955102e00945d736451e1fd6af657536c
-
SSDEEP
24576:YCXTaMLTuPwXGHCiNN41J9hAd+nl7InbXwjrET3Xyy/vh0:YCjo+91dAd+l/jfuh0
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
manlikeyou88 - Email To:
[email protected]
Extracted
redline
bigpay
204.10.160.140:7001
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral1/files/0x00060000000191ad-46.dat family_redline behavioral1/memory/2000-48-0x00000000003E0000-0x0000000000432000-memory.dmp family_redline -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2788 powershell.exe 2508 powershell.exe -
Executes dropped EXE 2 IoCs
pid Process 2148 newfile.exe 2000 build.exe -
Loads dropped DLL 2 IoCs
pid Process 2180 RegSvcs.exe 2180 RegSvcs.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2756 set thread context of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language newfile.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2604 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2508 powershell.exe 2788 powershell.exe 2148 newfile.exe 2148 newfile.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2508 powershell.exe Token: SeDebugPrivilege 2788 powershell.exe Token: SeDebugPrivilege 2148 newfile.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2756 wrote to memory of 2788 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 31 PID 2756 wrote to memory of 2788 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 31 PID 2756 wrote to memory of 2788 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 31 PID 2756 wrote to memory of 2788 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 31 PID 2756 wrote to memory of 2508 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 33 PID 2756 wrote to memory of 2508 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 33 PID 2756 wrote to memory of 2508 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 33 PID 2756 wrote to memory of 2508 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 33 PID 2756 wrote to memory of 2604 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 35 PID 2756 wrote to memory of 2604 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 35 PID 2756 wrote to memory of 2604 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 35 PID 2756 wrote to memory of 2604 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 35 PID 2756 wrote to memory of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 PID 2756 wrote to memory of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 PID 2756 wrote to memory of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 PID 2756 wrote to memory of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 PID 2756 wrote to memory of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 PID 2756 wrote to memory of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 PID 2756 wrote to memory of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 PID 2756 wrote to memory of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 PID 2756 wrote to memory of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 PID 2756 wrote to memory of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 PID 2756 wrote to memory of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 PID 2756 wrote to memory of 2180 2756 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 37 PID 2180 wrote to memory of 2148 2180 RegSvcs.exe 38 PID 2180 wrote to memory of 2148 2180 RegSvcs.exe 38 PID 2180 wrote to memory of 2148 2180 RegSvcs.exe 38 PID 2180 wrote to memory of 2148 2180 RegSvcs.exe 38 PID 2180 wrote to memory of 2000 2180 RegSvcs.exe 39 PID 2180 wrote to memory of 2000 2180 RegSvcs.exe 39 PID 2180 wrote to memory of 2000 2180 RegSvcs.exe 39 PID 2180 wrote to memory of 2000 2180 RegSvcs.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe"C:\Users\Admin\AppData\Local\Temp\3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tSYPqhw.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tSYPqhw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpBA4.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2604
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Users\Admin\AppData\Local\Temp\newfile.exe"C:\Users\Admin\AppData\Local\Temp\newfile.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2148
-
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2000
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
300KB
MD5f438d85cb04ea1b9fa4e32cfd4b28d0f
SHA13a0dd7cd2036b41fb5982e98c798802f8af619ac
SHA256fada9b55d3b3995f6bddb357370843fced984832063945eac08b6eb182fced52
SHA512e21c8b975c3a5de7500ffd4dc97e8a3062ce4314bf749df5ab3c9f09bbc9f94324afca9149ee11769efd5e76971b0e67baf39c3961f3a1dfec8596c20fa7069b
-
Filesize
1KB
MD5e2a2e655e879b01ef1e6743ef7648f6c
SHA19f2deae4b5e4bcf7c4345d05fb67ec1c31a5b107
SHA256c31fb23ccbbd7c60698817c70a69580dfad02e9e1e8b2c315e5d564c346999f7
SHA5124c81ca8e6418a9ff877dda8504a1f70e493ec97c2ee646fedc5ce67f7df6ee2a4716ac19d37aac3aeb360389d348ca78820e31bec9bf34b75320da0e85be67ae
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\NI02Z4WOA77XYIR6T7TB.temp
Filesize7KB
MD589e587bad6508134628b87c53ca8e3cf
SHA1218c206e339d132e96360e5405321dc980047302
SHA25670abc32e610f575e2d277b8e8bc7b43471481ab7d541bd652621382c495caa9c
SHA5123f71b93f4c9102deb9c4f0d5c4636dece44d76d273889b2b83cabfc5ccfd7c512899186b912c4506c21b07878d7e5207739116af5c38f9246bb8fc98e4c77b1f
-
Filesize
234KB
MD58234c3ec3aba620ca36e9d5629e3db74
SHA109d5b639a270fb4cbf45b2b454db96cc1035a768
SHA256acff54dc41a4f979a5054bc43649e097472904293fa9c4d23048b30a57bc3149
SHA512651c26e080b704189266ecb1daca88d1a3f4e67075f362055bd57b1bea52dbb181c299129b503b8674e9c89af5c1455a03abcf7ad417ed8cbbc7c0f7311f6c16