Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/01/2025, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
OP53532 Harumi new order.scr.exe
Resource
win7-20240903-en
General
-
Target
OP53532 Harumi new order.scr.exe
-
Size
217KB
-
MD5
ca2cb33b0542cdba0673c3f0a81a2f7f
-
SHA1
066c0fc9236c6eb5ad69a3f8f095a793a9d5789a
-
SHA256
f3ff932bd931ee266567cd0422a067fd38281164c534026b57d740658aa056c3
-
SHA512
377d2222e3083e07ebf8b19eacf2ce3cb9222ee93c240a6a150c5e2a76a09770a7887e0a65a8cc02902e12da0adcb985d787bcc00b6fb5bb2ca8ed7647d2606d
-
SSDEEP
6144:/Akza3r9r/EDpppppppppppppppppppppppppppppL9:Be3r9r/+pppppppppppppppppppppppd
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.iaa-airferight.com - Port:
587 - Username:
[email protected] - Password:
manlikeyou88 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
description pid Process procid_target PID 1120 created 3460 1120 OP53532 Harumi new order.scr.exe 56 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation OP53532 Harumi new order.scr.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pdf.vbs OP53532 Harumi new order.scr.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1120 set thread context of 3628 1120 OP53532 Harumi new order.scr.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language OP53532 Harumi new order.scr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 1860 ipconfig.exe 3416 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1120 OP53532 Harumi new order.scr.exe 1120 OP53532 Harumi new order.scr.exe 1120 OP53532 Harumi new order.scr.exe 3628 InstallUtil.exe 3628 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1120 OP53532 Harumi new order.scr.exe Token: SeDebugPrivilege 1120 OP53532 Harumi new order.scr.exe Token: SeDebugPrivilege 3628 InstallUtil.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 1120 wrote to memory of 2904 1120 OP53532 Harumi new order.scr.exe 83 PID 1120 wrote to memory of 2904 1120 OP53532 Harumi new order.scr.exe 83 PID 1120 wrote to memory of 2904 1120 OP53532 Harumi new order.scr.exe 83 PID 2904 wrote to memory of 1860 2904 cmd.exe 85 PID 2904 wrote to memory of 1860 2904 cmd.exe 85 PID 2904 wrote to memory of 1860 2904 cmd.exe 85 PID 1120 wrote to memory of 3628 1120 OP53532 Harumi new order.scr.exe 92 PID 1120 wrote to memory of 3628 1120 OP53532 Harumi new order.scr.exe 92 PID 1120 wrote to memory of 3628 1120 OP53532 Harumi new order.scr.exe 92 PID 1120 wrote to memory of 3628 1120 OP53532 Harumi new order.scr.exe 92 PID 1120 wrote to memory of 3628 1120 OP53532 Harumi new order.scr.exe 92 PID 1120 wrote to memory of 3628 1120 OP53532 Harumi new order.scr.exe 92 PID 1120 wrote to memory of 3628 1120 OP53532 Harumi new order.scr.exe 92 PID 1120 wrote to memory of 3628 1120 OP53532 Harumi new order.scr.exe 92 PID 1120 wrote to memory of 3124 1120 OP53532 Harumi new order.scr.exe 94 PID 1120 wrote to memory of 3124 1120 OP53532 Harumi new order.scr.exe 94 PID 1120 wrote to memory of 3124 1120 OP53532 Harumi new order.scr.exe 94 PID 3124 wrote to memory of 3416 3124 cmd.exe 97 PID 3124 wrote to memory of 3416 3124 cmd.exe 97 PID 3124 wrote to memory of 3416 3124 cmd.exe 97
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:3460
-
C:\Users\Admin\AppData\Local\Temp\OP53532 Harumi new order.scr.exe"C:\Users\Admin\AppData\Local\Temp\OP53532 Harumi new order.scr.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Checks computer location settings
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /release4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:1860
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew4⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:3416
-
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3628
-