Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/09/2024, 20:58
Behavioral task
behavioral1
Sample
bashoo.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
bashoo.exe
Resource
win10v2004-20240802-en
General
-
Target
bashoo.exe
-
Size
35KB
-
MD5
2db9421577d39c8fdeaab542ee35f483
-
SHA1
346d5db7df5cdbb843e9df60724a55e70a51c018
-
SHA256
9329ac7ceda44f47a90f67ef1e12add90fddb97bbf1be96a6e3e6f66a7002187
-
SHA512
7931796900ba0573733d240d5252d15a4957b1c6251ea359fcfb1c8ef11607948210c2484356b831659158d575c0f848a0b6886b6e177a83370b9c6d0c842969
-
SSDEEP
384:XZirz04kYcm5oRVPUn30CDG1iZMJSalHXeqZhsWIgDWsjxZUtO4f54A:Mi+5uVPUn30gGEZQH5SAXJ4f54A
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Executes dropped EXE 1 IoCs
pid Process 2760 system.exe -
resource yara_rule behavioral1/memory/3012-0-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/3012-10-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2760-11-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x002500000001705d-8.dat upx behavioral1/memory/2760-14-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\MyApp = "C:\\WINDOWS\\system.exe" bashoo.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\system.exe bashoo.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language system.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bashoo.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3012 bashoo.exe 2760 system.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3012 wrote to memory of 2760 3012 bashoo.exe 30 PID 3012 wrote to memory of 2760 3012 bashoo.exe 30 PID 3012 wrote to memory of 2760 3012 bashoo.exe 30 PID 3012 wrote to memory of 2760 3012 bashoo.exe 30 PID 3012 wrote to memory of 2760 3012 bashoo.exe 30 PID 3012 wrote to memory of 2760 3012 bashoo.exe 30 PID 3012 wrote to memory of 2760 3012 bashoo.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\bashoo.exe"C:\Users\Admin\AppData\Local\Temp\bashoo.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\WINDOWS\system.exe"C:\WINDOWS\system.exe" 02⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD59e64056a609af6f66db76d1dc17e0675
SHA132e900856a8366a4d579b53f00a95edc45637116
SHA256be945fbfb6a5045a730d35e288cb049e2040cbc8c871a6aebca8bf65672e7a41
SHA5125a3aa6470df3bcf3cb337505d78240d62d14c551ec3b31d85a655f1dfd18cb9de917f442ce39fe39eacee7442a950a760fbe31fd51700eb26c7726549c4503c1