Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/01/2025, 01:02
Static task
static1
Behavioral task
behavioral1
Sample
revised New order pdf.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
revised New order pdf.exe
Resource
win10v2004-20241007-en
General
-
Target
revised New order pdf.exe
-
Size
811KB
-
MD5
e96ded9d27ec1a49f1c8cb0035ab088b
-
SHA1
5b7e63a762eb0da3c36bacf9076b42db9cd49a8b
-
SHA256
4583e8bd3dc0aae3312813a57cd4a2ab4c1545a3855ce0b4d6e4914a07217569
-
SHA512
d67917bb819697850ff510cb17e81aff970b9b5a93ed048982b2b37869779532fda9862bbe488e1b13a0edb30ad6cbd62eafc6eb4672c20b7f1209a20eeae5bd
-
SSDEEP
12288:YgsDoOIlCJ3yXSl9rbOVaU/VQi+gC3OtsJAS8HnLrAss9DWdMxGkR:JfE8SlhbSQi8p8HnwsyqMxd
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5332853472:AAHdywgWGa_Sq-P5gn5a5U2a1mM20putFi4/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2720 powershell.exe 2864 powershell.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 revised New order pdf.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 revised New order pdf.exe Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 revised New order pdf.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\bmBOz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bmBOz\\bmBOz.exe" revised New order pdf.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 5 api.ipify.org 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2516 set thread context of 2832 2516 revised New order pdf.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language revised New order pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language revised New order pdf.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2512 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2516 revised New order pdf.exe 2516 revised New order pdf.exe 2864 powershell.exe 2720 powershell.exe 2832 revised New order pdf.exe 2832 revised New order pdf.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2516 revised New order pdf.exe Token: SeDebugPrivilege 2832 revised New order pdf.exe Token: SeDebugPrivilege 2864 powershell.exe Token: SeDebugPrivilege 2720 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2832 revised New order pdf.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 2516 wrote to memory of 2720 2516 revised New order pdf.exe 30 PID 2516 wrote to memory of 2720 2516 revised New order pdf.exe 30 PID 2516 wrote to memory of 2720 2516 revised New order pdf.exe 30 PID 2516 wrote to memory of 2720 2516 revised New order pdf.exe 30 PID 2516 wrote to memory of 2864 2516 revised New order pdf.exe 32 PID 2516 wrote to memory of 2864 2516 revised New order pdf.exe 32 PID 2516 wrote to memory of 2864 2516 revised New order pdf.exe 32 PID 2516 wrote to memory of 2864 2516 revised New order pdf.exe 32 PID 2516 wrote to memory of 2512 2516 revised New order pdf.exe 34 PID 2516 wrote to memory of 2512 2516 revised New order pdf.exe 34 PID 2516 wrote to memory of 2512 2516 revised New order pdf.exe 34 PID 2516 wrote to memory of 2512 2516 revised New order pdf.exe 34 PID 2516 wrote to memory of 2832 2516 revised New order pdf.exe 36 PID 2516 wrote to memory of 2832 2516 revised New order pdf.exe 36 PID 2516 wrote to memory of 2832 2516 revised New order pdf.exe 36 PID 2516 wrote to memory of 2832 2516 revised New order pdf.exe 36 PID 2516 wrote to memory of 2832 2516 revised New order pdf.exe 36 PID 2516 wrote to memory of 2832 2516 revised New order pdf.exe 36 PID 2516 wrote to memory of 2832 2516 revised New order pdf.exe 36 PID 2516 wrote to memory of 2832 2516 revised New order pdf.exe 36 PID 2516 wrote to memory of 2832 2516 revised New order pdf.exe 36 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 revised New order pdf.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 revised New order pdf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\revised New order pdf.exe"C:\Users\Admin\AppData\Local\Temp\revised New order pdf.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2516 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\revised New order pdf.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IeelBzKVdesRKo.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IeelBzKVdesRKo" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4B81.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2512
-
-
C:\Users\Admin\AppData\Local\Temp\revised New order pdf.exe"C:\Users\Admin\AppData\Local\Temp\revised New order pdf.exe"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2832
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59e351a85db44d59fa2c4d98bf237a00e
SHA14ad7ec40a8612a5fa0a47e7a70d4455051b6a210
SHA256d165f71f9a30651cc9bb562ca0f43b115fbc43e389bf53a24a537bc69e00a78b
SHA512c01434cc360925454d6b2a086dc389784fe949a52a98400cdefe01642f35b8d8df9481ade2cbf5a9fa907c9afff384e67b0cfc130627cc60197aded17eff8129
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD5d79d5d2904d4e0c7d0ed080d7ca9f635
SHA19545eb0064fc4de2473337da0882a22f8bd9fc0d
SHA256d77b590e26eaa151207f56050cfbcacae7669544873007b8809dc3cce7663ec9
SHA5120aace7036cd77874b6b0d6b05870dcb59887b5f7f0afef3b95670bcb528431cc83613cd18f1a1658a9652f5ec082b92cf7bf909ab344da3b5d62bb83d0633cae