Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
03/01/2025, 23:07
250103-2344xa1kcj 1003/01/2025, 12:42
250103-pxdcsatray 1003/01/2025, 12:26
250103-pmhvhstlhw 10Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/01/2025, 12:26
Static task
static1
Behavioral task
behavioral1
Sample
Invoice Confirmation.exe
Resource
win7-20240903-en
General
-
Target
Invoice Confirmation.exe
-
Size
810.6MB
-
MD5
63395033fc8d13ddd17e74e4bb13d5d6
-
SHA1
0a65c313504c8bcac8dc2eec944dd078a71ce384
-
SHA256
c322c179201974d21315230539606d1292a9159527f3f2eafa9d6167e8f51ae2
-
SHA512
4a1eb33f370ac2ba32bea1af287abe753edfa63e493e9045960303b1990c1cbdb289dd3ebd273ff87ad68b912b4e016877dd3f78b8ed5ce373a3f20b581a0718
-
SSDEEP
12288:mIR4R52J+XtyfG+Lzb6C65feSfSecDAMEnLwh8aFfxc1C0rmZdXm8qzd9p2MIR:mIeeJfG+LNzecKiVfaBiHXU9pTI
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6882044231:AAEdfz6RtcLc5FDAwOwS8UYabnK3tQ7x4bs/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 572 powershell.exe 320 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2280 set thread context of 2600 2280 Invoice Confirmation.exe 40 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Invoice Confirmation.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Invoice Confirmation.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WINWORD.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 292 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 2964 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 320 powershell.exe 572 powershell.exe 2280 Invoice Confirmation.exe 2280 Invoice Confirmation.exe 2600 Invoice Confirmation.exe 2600 Invoice Confirmation.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 320 powershell.exe Token: SeDebugPrivilege 572 powershell.exe Token: SeDebugPrivilege 2280 Invoice Confirmation.exe Token: SeDebugPrivilege 2600 Invoice Confirmation.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2964 WINWORD.EXE 2964 WINWORD.EXE 2964 WINWORD.EXE -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2552 2964 WINWORD.EXE 32 PID 2964 wrote to memory of 2552 2964 WINWORD.EXE 32 PID 2964 wrote to memory of 2552 2964 WINWORD.EXE 32 PID 2964 wrote to memory of 2552 2964 WINWORD.EXE 32 PID 2280 wrote to memory of 320 2280 Invoice Confirmation.exe 33 PID 2280 wrote to memory of 320 2280 Invoice Confirmation.exe 33 PID 2280 wrote to memory of 320 2280 Invoice Confirmation.exe 33 PID 2280 wrote to memory of 320 2280 Invoice Confirmation.exe 33 PID 2280 wrote to memory of 572 2280 Invoice Confirmation.exe 35 PID 2280 wrote to memory of 572 2280 Invoice Confirmation.exe 35 PID 2280 wrote to memory of 572 2280 Invoice Confirmation.exe 35 PID 2280 wrote to memory of 572 2280 Invoice Confirmation.exe 35 PID 2280 wrote to memory of 292 2280 Invoice Confirmation.exe 37 PID 2280 wrote to memory of 292 2280 Invoice Confirmation.exe 37 PID 2280 wrote to memory of 292 2280 Invoice Confirmation.exe 37 PID 2280 wrote to memory of 292 2280 Invoice Confirmation.exe 37 PID 2280 wrote to memory of 2832 2280 Invoice Confirmation.exe 39 PID 2280 wrote to memory of 2832 2280 Invoice Confirmation.exe 39 PID 2280 wrote to memory of 2832 2280 Invoice Confirmation.exe 39 PID 2280 wrote to memory of 2832 2280 Invoice Confirmation.exe 39 PID 2280 wrote to memory of 2600 2280 Invoice Confirmation.exe 40 PID 2280 wrote to memory of 2600 2280 Invoice Confirmation.exe 40 PID 2280 wrote to memory of 2600 2280 Invoice Confirmation.exe 40 PID 2280 wrote to memory of 2600 2280 Invoice Confirmation.exe 40 PID 2280 wrote to memory of 2600 2280 Invoice Confirmation.exe 40 PID 2280 wrote to memory of 2600 2280 Invoice Confirmation.exe 40 PID 2280 wrote to memory of 2600 2280 Invoice Confirmation.exe 40 PID 2280 wrote to memory of 2600 2280 Invoice Confirmation.exe 40 PID 2280 wrote to memory of 2600 2280 Invoice Confirmation.exe 40
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice Confirmation.exe"C:\Users\Admin\AppData\Local\Temp\Invoice Confirmation.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Invoice Confirmation.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:320
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KmihxwKU.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:572
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KmihxwKU" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA525.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:292
-
-
C:\Users\Admin\AppData\Local\Temp\Invoice Confirmation.exe"C:\Users\Admin\AppData\Local\Temp\Invoice Confirmation.exe"2⤵PID:2832
-
-
C:\Users\Admin\AppData\Local\Temp\Invoice Confirmation.exe"C:\Users\Admin\AppData\Local\Temp\Invoice Confirmation.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\UnpublishTest.docx"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:2552
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a7de85b97e79ca11b1988487705ff49e
SHA14518d22bbae33fa5594070cef2a21bb83fb4d17f
SHA2568623ab758d88bb6a53f814297e16b80c112750367ad6df1f7176bef6a32390f5
SHA5122f4751f353b1230b2fcd4215ad5d3688b9f45505526f080396389415eede86680591972caa19e531c3deb3b619ce7c55de942ed92a8d69c51e833035135d13f1
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5cbc7e602dba733286e553d5498eac3f1
SHA1aa67d022370dc49894081e5684b11da8d59ab11e
SHA2563976d01499305982d7d4a949976388154ad2938061398187371565accff45b75
SHA512bf6d6d7ac857886aeba5e4b639be4f712e8e6cc03409ba420d6dcb17f19040125900f7238d5506b1681274f0aa484a663c2852bc09e99aad10a63c9d8042464b