Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2024, 12:45
Static task
static1
Behavioral task
behavioral1
Sample
3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe
Resource
win10v2004-20240802-en
General
-
Target
3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe
-
Size
973KB
-
MD5
5c476a26f9288899b8c5df769549dc3b
-
SHA1
cb7794062569e0ca10e1588fbc454b6ba0f59f37
-
SHA256
3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86
-
SHA512
56e415db49c949d1853e92f0626e95413d194e38c21fc8bc59809f76c73ef3d634ac9bde868a8328971706797a103e2955102e00945d736451e1fd6af657536c
-
SSDEEP
24576:YCXTaMLTuPwXGHCiNN41J9hAd+nl7InbXwjrET3Xyy/vh0:YCjo+91dAd+l/jfuh0
Malware Config
Extracted
redline
bigpay
204.10.160.140:7001
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
manlikeyou88 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
resource yara_rule behavioral2/files/0x00090000000234c2-74.dat family_redline behavioral2/memory/1772-76-0x0000000000C50000-0x0000000000CA2000-memory.dmp family_redline -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2840 powershell.exe 4756 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe -
Executes dropped EXE 2 IoCs
pid Process 2848 newfile.exe 1772 build.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1960 set thread context of 4384 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language newfile.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language build.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2740 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2840 powershell.exe 4756 powershell.exe 2840 powershell.exe 4756 powershell.exe 2848 newfile.exe 2848 newfile.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2840 powershell.exe Token: SeDebugPrivilege 4756 powershell.exe Token: SeDebugPrivilege 2848 newfile.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1960 wrote to memory of 2840 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 93 PID 1960 wrote to memory of 2840 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 93 PID 1960 wrote to memory of 2840 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 93 PID 1960 wrote to memory of 4756 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 95 PID 1960 wrote to memory of 4756 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 95 PID 1960 wrote to memory of 4756 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 95 PID 1960 wrote to memory of 2740 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 97 PID 1960 wrote to memory of 2740 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 97 PID 1960 wrote to memory of 2740 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 97 PID 1960 wrote to memory of 4384 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 99 PID 1960 wrote to memory of 4384 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 99 PID 1960 wrote to memory of 4384 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 99 PID 1960 wrote to memory of 4384 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 99 PID 1960 wrote to memory of 4384 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 99 PID 1960 wrote to memory of 4384 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 99 PID 1960 wrote to memory of 4384 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 99 PID 1960 wrote to memory of 4384 1960 3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe 99 PID 4384 wrote to memory of 2848 4384 RegSvcs.exe 100 PID 4384 wrote to memory of 2848 4384 RegSvcs.exe 100 PID 4384 wrote to memory of 2848 4384 RegSvcs.exe 100 PID 4384 wrote to memory of 1772 4384 RegSvcs.exe 101 PID 4384 wrote to memory of 1772 4384 RegSvcs.exe 101 PID 4384 wrote to memory of 1772 4384 RegSvcs.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe"C:\Users\Admin\AppData\Local\Temp\3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\3b5e5fb317040ff6197982f73c65426ea39e48f0108a4349acfc27468cef1e86.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2840
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tSYPqhw.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tSYPqhw" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE61A.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Users\Admin\AppData\Local\Temp\newfile.exe"C:\Users\Admin\AppData\Local\Temp\newfile.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Users\Admin\AppData\Local\Temp\build.exe"C:\Users\Admin\AppData\Local\Temp\build.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1772
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD5642b6cd3ace4d5959a6d6bd1c1517c2e
SHA1829b8072af1040d6d9dcfac4beda74ffcb5164d1
SHA2567e8a5afd4d7b30cc977e93829a2ac9cb0a982f1855fe4e8c35f25058480663fd
SHA5128f161bec92e8aa36dbe72692dbfa079fb8a57ef00dfcf0228ed9067fa637bec7d33b5b6a0857b60e2c6f716f569e64b660284b8edbc898b45269286627e0797b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
300KB
MD5f438d85cb04ea1b9fa4e32cfd4b28d0f
SHA13a0dd7cd2036b41fb5982e98c798802f8af619ac
SHA256fada9b55d3b3995f6bddb357370843fced984832063945eac08b6eb182fced52
SHA512e21c8b975c3a5de7500ffd4dc97e8a3062ce4314bf749df5ab3c9f09bbc9f94324afca9149ee11769efd5e76971b0e67baf39c3961f3a1dfec8596c20fa7069b
-
Filesize
234KB
MD58234c3ec3aba620ca36e9d5629e3db74
SHA109d5b639a270fb4cbf45b2b454db96cc1035a768
SHA256acff54dc41a4f979a5054bc43649e097472904293fa9c4d23048b30a57bc3149
SHA512651c26e080b704189266ecb1daca88d1a3f4e67075f362055bd57b1bea52dbb181c299129b503b8674e9c89af5c1455a03abcf7ad417ed8cbbc7c0f7311f6c16
-
Filesize
1KB
MD5d70c7befefaa6d36a4e66ae6494132b6
SHA15d67eec95b5f0c4e8bd897f8a1cfc910331d3e5f
SHA256a218cb53ff5269040c949414a014a959fc3e3f058a81bf93da0d1e3a160201af
SHA5126ff074d09d8f3911a61eee3502fc14b14dc94293d5ee5aba5f9ed142783ff6c58d50a09b992e4e185a20e78453c9b9082c7aa64fdc40a4cd1b366419c51cfc6d