Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
09/09/2024, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
tmp1nhfhbl9.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
tmp1nhfhbl9.exe
Resource
win10v2004-20240802-en
General
-
Target
tmp1nhfhbl9.exe
-
Size
859KB
-
MD5
61136861ddae7d53a0165c710bab05fe
-
SHA1
3e001e090821562908369a797feb14da17199747
-
SHA256
8ccca04fe86f770d8057a7209a6d31da8df7bace6f4a3d8e04d5bbfefc2661f3
-
SHA512
0ecb011c573972f3ceef4ed12413f4f207094fb9d36daac3a727783058f7401946e678809f4ed436b8b54d0adec46f28c83df90a55bf588228d5e87769a67c23
-
SSDEEP
12288:qZ9sUz1S6QUxvBKXbGiQOp8j8VQaZrWOreSuNe9PE4Xbm9i72lGP7r9r/+pppppL:AVdeQO2CQaZrA5EdE4rmkEG1q
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
manlikeyou88 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2480 powershell.exe 2848 powershell.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3032 set thread context of 2808 3032 tmp1nhfhbl9.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp1nhfhbl9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2828 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2480 powershell.exe 2848 powershell.exe 2808 RegSvcs.exe 2808 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2480 powershell.exe Token: SeDebugPrivilege 2848 powershell.exe Token: SeDebugPrivilege 2808 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3032 wrote to memory of 2480 3032 tmp1nhfhbl9.exe 31 PID 3032 wrote to memory of 2480 3032 tmp1nhfhbl9.exe 31 PID 3032 wrote to memory of 2480 3032 tmp1nhfhbl9.exe 31 PID 3032 wrote to memory of 2480 3032 tmp1nhfhbl9.exe 31 PID 3032 wrote to memory of 2848 3032 tmp1nhfhbl9.exe 33 PID 3032 wrote to memory of 2848 3032 tmp1nhfhbl9.exe 33 PID 3032 wrote to memory of 2848 3032 tmp1nhfhbl9.exe 33 PID 3032 wrote to memory of 2848 3032 tmp1nhfhbl9.exe 33 PID 3032 wrote to memory of 2828 3032 tmp1nhfhbl9.exe 35 PID 3032 wrote to memory of 2828 3032 tmp1nhfhbl9.exe 35 PID 3032 wrote to memory of 2828 3032 tmp1nhfhbl9.exe 35 PID 3032 wrote to memory of 2828 3032 tmp1nhfhbl9.exe 35 PID 3032 wrote to memory of 2808 3032 tmp1nhfhbl9.exe 37 PID 3032 wrote to memory of 2808 3032 tmp1nhfhbl9.exe 37 PID 3032 wrote to memory of 2808 3032 tmp1nhfhbl9.exe 37 PID 3032 wrote to memory of 2808 3032 tmp1nhfhbl9.exe 37 PID 3032 wrote to memory of 2808 3032 tmp1nhfhbl9.exe 37 PID 3032 wrote to memory of 2808 3032 tmp1nhfhbl9.exe 37 PID 3032 wrote to memory of 2808 3032 tmp1nhfhbl9.exe 37 PID 3032 wrote to memory of 2808 3032 tmp1nhfhbl9.exe 37 PID 3032 wrote to memory of 2808 3032 tmp1nhfhbl9.exe 37 PID 3032 wrote to memory of 2808 3032 tmp1nhfhbl9.exe 37 PID 3032 wrote to memory of 2808 3032 tmp1nhfhbl9.exe 37 PID 3032 wrote to memory of 2808 3032 tmp1nhfhbl9.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp1nhfhbl9.exe"C:\Users\Admin\AppData\Local\Temp\tmp1nhfhbl9.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3032 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\tmp1nhfhbl9.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GWanLXwQAKvmjC.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2848
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GWanLXwQAKvmjC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDF09.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2828
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD596412dec47e833103b4a17eaadd81706
SHA1e44dfa8b4cdcb3c371ee8ae17f23c96a350e8c40
SHA25666e9e1057066475444007f654bda8e545a135383d410efeb04e71cc6190d2383
SHA512a2778ec100f871c8ab1298f8a6509c4f01ba1eb8e88c9727899281bcd6a465376912906bfdb4cb0c9271163150cca611ed92df7354f269789af377d70f269b96
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD58d514adb4a67e6be060574e4f0687db8
SHA1482e71b16de15c977a81f2a2f7122309d8b98419
SHA2568048e45e564e40696f7cace3f8b86afa5b868cd7599ce8859ba3e53642514f32
SHA5123fa246acd940cf3b2130ed80f8364967ce71106a1520eca2b1d4aaa2825916f6e26b0b1f432707128a2e52c3e0d9529072399d9879bbd2e169cc048b30cf69a0