Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/12/2024, 01:03
Static task
static1
Behavioral task
behavioral1
Sample
swift copy.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
swift copy.exe
Resource
win10v2004-20241007-en
General
-
Target
swift copy.exe
-
Size
826KB
-
MD5
42e1e411f77d0def61ff0f05bb0d7343
-
SHA1
172b5963847241404f315601f9f694aabc37183c
-
SHA256
3c5917e626220d7eac84a10ae49a289c28146a08d0a4e9bbba85fb1116faed27
-
SHA512
cca406e94c156841a1166dbd3b402c86ccf2a3c959607d62d6948e4e06fc07eeb2646124dfea220eeebc31344c02d7876f068d1ec764cff4fb20caf804f7c519
-
SSDEEP
12288:r8MbD6z47ZwRH46SyI244eAv7bNVdXlVX2EldKwwy9EXX+ikR:cUFwRwyIPpAvvbjL3wFOR
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.azmaplast.com - Port:
587 - Username:
[email protected] - Password:
QAZqaz123@@ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2728 powershell.exe 2864 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2692 set thread context of 1540 2692 swift copy.exe 37 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language swift copy.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2880 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2692 swift copy.exe 2692 swift copy.exe 2692 swift copy.exe 1540 RegSvcs.exe 1540 RegSvcs.exe 2728 powershell.exe 2864 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2692 swift copy.exe Token: SeDebugPrivilege 1540 RegSvcs.exe Token: SeDebugPrivilege 2728 powershell.exe Token: SeDebugPrivilege 2864 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2728 2692 swift copy.exe 31 PID 2692 wrote to memory of 2728 2692 swift copy.exe 31 PID 2692 wrote to memory of 2728 2692 swift copy.exe 31 PID 2692 wrote to memory of 2728 2692 swift copy.exe 31 PID 2692 wrote to memory of 2864 2692 swift copy.exe 33 PID 2692 wrote to memory of 2864 2692 swift copy.exe 33 PID 2692 wrote to memory of 2864 2692 swift copy.exe 33 PID 2692 wrote to memory of 2864 2692 swift copy.exe 33 PID 2692 wrote to memory of 2880 2692 swift copy.exe 34 PID 2692 wrote to memory of 2880 2692 swift copy.exe 34 PID 2692 wrote to memory of 2880 2692 swift copy.exe 34 PID 2692 wrote to memory of 2880 2692 swift copy.exe 34 PID 2692 wrote to memory of 1540 2692 swift copy.exe 37 PID 2692 wrote to memory of 1540 2692 swift copy.exe 37 PID 2692 wrote to memory of 1540 2692 swift copy.exe 37 PID 2692 wrote to memory of 1540 2692 swift copy.exe 37 PID 2692 wrote to memory of 1540 2692 swift copy.exe 37 PID 2692 wrote to memory of 1540 2692 swift copy.exe 37 PID 2692 wrote to memory of 1540 2692 swift copy.exe 37 PID 2692 wrote to memory of 1540 2692 swift copy.exe 37 PID 2692 wrote to memory of 1540 2692 swift copy.exe 37 PID 2692 wrote to memory of 1540 2692 swift copy.exe 37 PID 2692 wrote to memory of 1540 2692 swift copy.exe 37 PID 2692 wrote to memory of 1540 2692 swift copy.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\swift copy.exe"C:\Users\Admin\AppData\Local\Temp\swift copy.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\swift copy.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HWmYbVvdRTA.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HWmYbVvdRTA" /XML "C:\Users\Admin\AppData\Local\Temp\tmp36CE.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2880
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1540
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
70KB
MD549aebf8cbd62d92ac215b2923fb1b9f5
SHA11723be06719828dda65ad804298d0431f6aff976
SHA256b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b
-
Filesize
181KB
MD54ea6026cf93ec6338144661bf1202cd1
SHA1a1dec9044f750ad887935a01430bf49322fbdcb7
SHA2568efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA5126c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b
-
Filesize
1KB
MD5180c791ebe7c81c88ba09d2f419f0570
SHA12135b99b14cc472b6d6dce3e4ac951f94cc73254
SHA25671eedb45e102a6b7ed2ed3a194978b8c1b3f5bb52190bb9e500a43eee322f1ec
SHA512d795f576ce7dd19a72c7c5811bfb76db87eca623da9df748d577ae5ec98b9f1422e59cd156cb59c4cab37fdab7f3c1ae0693a6f394c64980fb10046ea807c5df
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\J9FFMLF2GQTXEFIC7YCW.temp
Filesize7KB
MD5228daf9d3c5e0595db728f981f15a6e2
SHA118f3d23584382bee59f83b7da1b4dbd81510c152
SHA256ca41875686f020594075198c5150747910f3707849da048e0d58d1ba2bd5a227
SHA5129cd87f12131155b9208df26376f3be3f0c72d3af560d841540f7d4319459199e28feb04d5629e7dcf65d8d44fa5c19ba444832f10ce13c91f48a94c3edade99d