Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 16:00
Static task
static1
Behavioral task
behavioral1
Sample
tmp1nhfhbl9.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
tmp1nhfhbl9.exe
Resource
win10v2004-20240802-en
General
-
Target
tmp1nhfhbl9.exe
-
Size
859KB
-
MD5
61136861ddae7d53a0165c710bab05fe
-
SHA1
3e001e090821562908369a797feb14da17199747
-
SHA256
8ccca04fe86f770d8057a7209a6d31da8df7bace6f4a3d8e04d5bbfefc2661f3
-
SHA512
0ecb011c573972f3ceef4ed12413f4f207094fb9d36daac3a727783058f7401946e678809f4ed436b8b54d0adec46f28c83df90a55bf588228d5e87769a67c23
-
SSDEEP
12288:qZ9sUz1S6QUxvBKXbGiQOp8j8VQaZrWOreSuNe9PE4Xbm9i72lGP7r9r/+pppppL:AVdeQO2CQaZrA5EdE4rmkEG1q
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
manlikeyou88 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2716 powershell.exe 1172 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation tmp1nhfhbl9.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2096 set thread context of 3004 2096 tmp1nhfhbl9.exe 99 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tmp1nhfhbl9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3496 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1172 powershell.exe 2716 powershell.exe 1172 powershell.exe 2716 powershell.exe 3004 RegSvcs.exe 3004 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2716 powershell.exe Token: SeDebugPrivilege 1172 powershell.exe Token: SeDebugPrivilege 3004 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 2096 wrote to memory of 2716 2096 tmp1nhfhbl9.exe 93 PID 2096 wrote to memory of 2716 2096 tmp1nhfhbl9.exe 93 PID 2096 wrote to memory of 2716 2096 tmp1nhfhbl9.exe 93 PID 2096 wrote to memory of 1172 2096 tmp1nhfhbl9.exe 95 PID 2096 wrote to memory of 1172 2096 tmp1nhfhbl9.exe 95 PID 2096 wrote to memory of 1172 2096 tmp1nhfhbl9.exe 95 PID 2096 wrote to memory of 3496 2096 tmp1nhfhbl9.exe 97 PID 2096 wrote to memory of 3496 2096 tmp1nhfhbl9.exe 97 PID 2096 wrote to memory of 3496 2096 tmp1nhfhbl9.exe 97 PID 2096 wrote to memory of 3004 2096 tmp1nhfhbl9.exe 99 PID 2096 wrote to memory of 3004 2096 tmp1nhfhbl9.exe 99 PID 2096 wrote to memory of 3004 2096 tmp1nhfhbl9.exe 99 PID 2096 wrote to memory of 3004 2096 tmp1nhfhbl9.exe 99 PID 2096 wrote to memory of 3004 2096 tmp1nhfhbl9.exe 99 PID 2096 wrote to memory of 3004 2096 tmp1nhfhbl9.exe 99 PID 2096 wrote to memory of 3004 2096 tmp1nhfhbl9.exe 99 PID 2096 wrote to memory of 3004 2096 tmp1nhfhbl9.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp1nhfhbl9.exe"C:\Users\Admin\AppData\Local\Temp\tmp1nhfhbl9.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\tmp1nhfhbl9.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GWanLXwQAKvmjC.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1172
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GWanLXwQAKvmjC" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2DC2.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3496
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD54ab8365f3102cfd77c7d3cbb8c142a03
SHA104b32ab15ac6982acb7e128753bfa0974696e76c
SHA2561c9281bed294ec1a9ccd117d381394c4ecf521caf08b16deb3a77f9d44bb8b4b
SHA512f2c0218f4a7b56c3c0c994117056af20d61cc63b034be7c5c9264e5b7edc2ebea074555de043f5501e2f62c9e75f5681fe02254712cc758aa47f7805461066c3
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5460bc2d7cd05bf5094b2f6b71792d6e1
SHA153bc78f2de88c257e6e5767e1559c6a2d602c57f
SHA2562b18e9c63d20229237ff550dc4e3a0e6bc167d994a29f44a55b17ea969962eae
SHA5122fce748a8943983efd08ced4ce9701ac1cc542bffb2e932e3d76198b7dd91b39c5b1e7ee58a55026661c257529ca888ae569a515b318860c9f944f17d7a3ca35