Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/10/2024, 14:22
Static task
static1
Behavioral task
behavioral1
Sample
PO-A1702108.exe
Resource
win7-20240903-en
General
-
Target
PO-A1702108.exe
-
Size
1.2MB
-
MD5
8769dc79d45b0ebbf8472326a073bf78
-
SHA1
55e26136eafdfa41b64c7cc9ce4034745391abbe
-
SHA256
0f29f9bc5ceb4045626862436a2a03310df879e32bb78b20fc1fa83d0fc673b4
-
SHA512
5275d650064c66a33015224220f806168dc7a10a1a3624b829c90b948eae855fb6e3a2ce115558069f1396a177e97cfed50a836b0deffff1049bc30238ebee6b
-
SSDEEP
24576:ffmMv6Ckr7Mny5QLmhz9B5SjlW16dpUzl351mvQshOFLT:f3v+7/5QLm19BglN4sEFLT
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Prober.vbs Prober.exe -
Executes dropped EXE 1 IoCs
pid Process 2652 Prober.exe -
Loads dropped DLL 1 IoCs
pid Process 2360 PO-A1702108.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x00060000000186f8-4.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2652 set thread context of 936 2652 Prober.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PO-A1702108.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Prober.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 936 RegSvcs.exe 936 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2652 Prober.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 936 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2652 2360 PO-A1702108.exe 31 PID 2360 wrote to memory of 2652 2360 PO-A1702108.exe 31 PID 2360 wrote to memory of 2652 2360 PO-A1702108.exe 31 PID 2360 wrote to memory of 2652 2360 PO-A1702108.exe 31 PID 2652 wrote to memory of 936 2652 Prober.exe 32 PID 2652 wrote to memory of 936 2652 Prober.exe 32 PID 2652 wrote to memory of 936 2652 Prober.exe 32 PID 2652 wrote to memory of 936 2652 Prober.exe 32 PID 2652 wrote to memory of 936 2652 Prober.exe 32 PID 2652 wrote to memory of 936 2652 Prober.exe 32 PID 2652 wrote to memory of 936 2652 Prober.exe 32 PID 2652 wrote to memory of 936 2652 Prober.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO-A1702108.exe"C:\Users\Admin\AppData\Local\Temp\PO-A1702108.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Users\Admin\AppData\Local\eupolyzoan\Prober.exe"C:\Users\Admin\AppData\Local\Temp\PO-A1702108.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\PO-A1702108.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:936
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.2MB
MD58769dc79d45b0ebbf8472326a073bf78
SHA155e26136eafdfa41b64c7cc9ce4034745391abbe
SHA2560f29f9bc5ceb4045626862436a2a03310df879e32bb78b20fc1fa83d0fc673b4
SHA5125275d650064c66a33015224220f806168dc7a10a1a3624b829c90b948eae855fb6e3a2ce115558069f1396a177e97cfed50a836b0deffff1049bc30238ebee6b