Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 09:59
Static task
static1
Behavioral task
behavioral1
Sample
Ödeme Bildirimi.exe
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
Ödeme Bildirimi.exe
Resource
win10v2004-20240802-en
General
-
Target
Ödeme Bildirimi.exe
-
Size
810.6MB
-
MD5
026d2f0bc075aea5b674ee8c8e28c062
-
SHA1
50be7a17f99f47b288aa507a4f4b8175046af7be
-
SHA256
dd6792c5b40433f5fa1e59f4e4b5c067c3f0986346904f9c6fe23bc61ca720a2
-
SHA512
2bc047bc5a32cda240887d8cd19d9aa579e419e268a2678733673e33665fbaa681daaad9e82f4f108702763d4e8eaec03e1f15691d81d1b7add5d3fe0fb01ece
-
SSDEEP
12288:E5MFKLltmvsXEuXfHgYxJig3Qt5qUu34HE1YQ/e9i72l:VFKOv0fHgYxJigKHE1YQWkE
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7000875199:AAGcJDBHFcfVUBvhBO4xZLw34OXk1NWXSe0/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3008 powershell.exe 2892 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2716 set thread context of 2808 2716 Ödeme Bildirimi.exe 38 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ödeme Bildirimi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Ödeme Bildirimi.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2784 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3008 powershell.exe 2892 powershell.exe 2716 Ödeme Bildirimi.exe 2716 Ödeme Bildirimi.exe 2808 Ödeme Bildirimi.exe 2808 Ödeme Bildirimi.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3008 powershell.exe Token: SeDebugPrivilege 2892 powershell.exe Token: SeDebugPrivilege 2716 Ödeme Bildirimi.exe Token: SeDebugPrivilege 2808 Ödeme Bildirimi.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2716 wrote to memory of 3008 2716 Ödeme Bildirimi.exe 31 PID 2716 wrote to memory of 3008 2716 Ödeme Bildirimi.exe 31 PID 2716 wrote to memory of 3008 2716 Ödeme Bildirimi.exe 31 PID 2716 wrote to memory of 3008 2716 Ödeme Bildirimi.exe 31 PID 2716 wrote to memory of 2892 2716 Ödeme Bildirimi.exe 33 PID 2716 wrote to memory of 2892 2716 Ödeme Bildirimi.exe 33 PID 2716 wrote to memory of 2892 2716 Ödeme Bildirimi.exe 33 PID 2716 wrote to memory of 2892 2716 Ödeme Bildirimi.exe 33 PID 2716 wrote to memory of 2784 2716 Ödeme Bildirimi.exe 34 PID 2716 wrote to memory of 2784 2716 Ödeme Bildirimi.exe 34 PID 2716 wrote to memory of 2784 2716 Ödeme Bildirimi.exe 34 PID 2716 wrote to memory of 2784 2716 Ödeme Bildirimi.exe 34 PID 2716 wrote to memory of 2800 2716 Ödeme Bildirimi.exe 37 PID 2716 wrote to memory of 2800 2716 Ödeme Bildirimi.exe 37 PID 2716 wrote to memory of 2800 2716 Ödeme Bildirimi.exe 37 PID 2716 wrote to memory of 2800 2716 Ödeme Bildirimi.exe 37 PID 2716 wrote to memory of 2808 2716 Ödeme Bildirimi.exe 38 PID 2716 wrote to memory of 2808 2716 Ödeme Bildirimi.exe 38 PID 2716 wrote to memory of 2808 2716 Ödeme Bildirimi.exe 38 PID 2716 wrote to memory of 2808 2716 Ödeme Bildirimi.exe 38 PID 2716 wrote to memory of 2808 2716 Ödeme Bildirimi.exe 38 PID 2716 wrote to memory of 2808 2716 Ödeme Bildirimi.exe 38 PID 2716 wrote to memory of 2808 2716 Ödeme Bildirimi.exe 38 PID 2716 wrote to memory of 2808 2716 Ödeme Bildirimi.exe 38 PID 2716 wrote to memory of 2808 2716 Ödeme Bildirimi.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi.exe"C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3008
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uNcbBGFuPZgDr.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uNcbBGFuPZgDr" /XML "C:\Users\Admin\AppData\Local\Temp\tmp760.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2784
-
-
C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi.exe"C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi.exe"2⤵PID:2800
-
-
C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi.exe"C:\Users\Admin\AppData\Local\Temp\Ödeme Bildirimi.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57497ffb79ba8931c821d61baa5fe52c9
SHA14be6f7283bd82e639236684a32ee23b74d58d335
SHA256cc3894cdd29ea4cf8277488dd9a7c3a246c3c0d5078df4a374d81aad3b084e31
SHA5121189a75a2832e4bfe5204e060403f787d893f31e572e28a254de54230577d0caa74168910aa778a3fc1eb67c6ffa27665ea19b441ea09fa86904ffe9de256d2e
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD56b4f707a50d2fe6bab1ede7fa4685e86
SHA1da109febd9d960da1cd7df6efedf0f32c6eb70af
SHA256982acb3d7b1bdc04b42ece873895388a5e29338e4a8082ba6d38bd625cf193d9
SHA512c06a00b3f97d31fab93ab57b9837589ac686b2aec3239c4569f64e264794edbeaaec46adf1d1e53ecf6133610161637439e0993c2de563cc7ee60e2ec23b9ba3