Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
24/09/2024, 12:23
Static task
static1
Behavioral task
behavioral1
Sample
PO-A1702108.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
PO-A1702108.exe
Resource
win10v2004-20240802-en
General
-
Target
PO-A1702108.exe
-
Size
1.2MB
-
MD5
514233f0589be5d977a1ee164fe8db1d
-
SHA1
bf713daec188be3a005e1a2097b4f5cb68ccc222
-
SHA256
6abd474c86db77c6943522762f5658eb58c523bb84d68fcc6495a2cbbff72e9e
-
SHA512
6f5b4d6175b593e2d287d25369dfdbba7bca44ea487ad7e7d39628670480eb63f8795f6ef56478d215b5f05ef76d74af26fe184d2d434416b657d1ba694b3261
-
SSDEEP
24576:uRmJkcoQricOIQxiZY1iaCbLRWEjIQeK88hCPbkfX6Jp:7JZoQrbTFZY1iaCbNkQN8SPap
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lards.vbs lards.exe -
Executes dropped EXE 3 IoCs
pid Process 1708 lards.exe 2340 lards.exe 2760 lards.exe -
Loads dropped DLL 1 IoCs
pid Process 2120 PO-A1702108.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0007000000016d5a-4.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2760 set thread context of 2892 2760 lards.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PO-A1702108.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lards.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lards.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lards.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2892 RegSvcs.exe 2892 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 1708 lards.exe 2340 lards.exe 2760 lards.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2892 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 2120 PO-A1702108.exe 2120 PO-A1702108.exe 1708 lards.exe 1708 lards.exe 2340 lards.exe 2340 lards.exe 2760 lards.exe 2760 lards.exe -
Suspicious use of SendNotifyMessage 8 IoCs
pid Process 2120 PO-A1702108.exe 2120 PO-A1702108.exe 1708 lards.exe 1708 lards.exe 2340 lards.exe 2340 lards.exe 2760 lards.exe 2760 lards.exe -
Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 2120 wrote to memory of 1708 2120 PO-A1702108.exe 30 PID 2120 wrote to memory of 1708 2120 PO-A1702108.exe 30 PID 2120 wrote to memory of 1708 2120 PO-A1702108.exe 30 PID 2120 wrote to memory of 1708 2120 PO-A1702108.exe 30 PID 1708 wrote to memory of 2072 1708 lards.exe 31 PID 1708 wrote to memory of 2072 1708 lards.exe 31 PID 1708 wrote to memory of 2072 1708 lards.exe 31 PID 1708 wrote to memory of 2072 1708 lards.exe 31 PID 1708 wrote to memory of 2072 1708 lards.exe 31 PID 1708 wrote to memory of 2072 1708 lards.exe 31 PID 1708 wrote to memory of 2072 1708 lards.exe 31 PID 1708 wrote to memory of 2340 1708 lards.exe 32 PID 1708 wrote to memory of 2340 1708 lards.exe 32 PID 1708 wrote to memory of 2340 1708 lards.exe 32 PID 1708 wrote to memory of 2340 1708 lards.exe 32 PID 2340 wrote to memory of 2452 2340 lards.exe 33 PID 2340 wrote to memory of 2452 2340 lards.exe 33 PID 2340 wrote to memory of 2452 2340 lards.exe 33 PID 2340 wrote to memory of 2452 2340 lards.exe 33 PID 2340 wrote to memory of 2452 2340 lards.exe 33 PID 2340 wrote to memory of 2452 2340 lards.exe 33 PID 2340 wrote to memory of 2452 2340 lards.exe 33 PID 2340 wrote to memory of 2760 2340 lards.exe 34 PID 2340 wrote to memory of 2760 2340 lards.exe 34 PID 2340 wrote to memory of 2760 2340 lards.exe 34 PID 2340 wrote to memory of 2760 2340 lards.exe 34 PID 2760 wrote to memory of 2892 2760 lards.exe 35 PID 2760 wrote to memory of 2892 2760 lards.exe 35 PID 2760 wrote to memory of 2892 2760 lards.exe 35 PID 2760 wrote to memory of 2892 2760 lards.exe 35 PID 2760 wrote to memory of 2892 2760 lards.exe 35 PID 2760 wrote to memory of 2892 2760 lards.exe 35 PID 2760 wrote to memory of 2892 2760 lards.exe 35 PID 2760 wrote to memory of 2892 2760 lards.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-A1702108.exe"C:\Users\Admin\AppData\Local\Temp\PO-A1702108.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2120 -
C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"C:\Users\Admin\AppData\Local\Temp\PO-A1702108.exe"2⤵
- Drops startup file
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\PO-A1702108.exe"3⤵PID:2072
-
-
C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"4⤵PID:2452
-
-
C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\hypopygidium\lards.exe"5⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2892
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD5514233f0589be5d977a1ee164fe8db1d
SHA1bf713daec188be3a005e1a2097b4f5cb68ccc222
SHA2566abd474c86db77c6943522762f5658eb58c523bb84d68fcc6495a2cbbff72e9e
SHA5126f5b4d6175b593e2d287d25369dfdbba7bca44ea487ad7e7d39628670480eb63f8795f6ef56478d215b5f05ef76d74af26fe184d2d434416b657d1ba694b3261