Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
102s -
max time network
48s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
09/07/2020, 06:30
Static task
static1
Behavioral task
behavioral1
Sample
AWB070820206533.exe
Resource
win7v200430
Behavioral task
behavioral2
Sample
AWB070820206533.exe
Resource
win10
General
-
Target
AWB070820206533.exe
-
Size
690KB
-
MD5
3dfec10d4f1fe6f29a6b81c2c6501be2
-
SHA1
185e5ecf817c7e5c65356b301fb7e23c96567dae
-
SHA256
510b5fe7628cdd6f15e04907dca1cac201192853e26be4ee279b2d8f90c4e25c
-
SHA512
f5aa17fdc3eeb5ccad123749a16f94122554cb1c1d5207c5e8a75363f34991831483b13f4f31b34d111bdce49535dc4a6703e3ee2d9198cc3721322b08e4b107
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.ashpraskills.com - Port:
587 - Username:
[email protected] - Password:
TC041018$4321
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla Payload 4 IoCs
resource yara_rule behavioral1/memory/1596-14-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1596-15-0x0000000000446E3E-mapping.dmp family_agenttesla behavioral1/memory/1596-17-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla behavioral1/memory/1596-18-0x0000000000400000-0x000000000044C000-memory.dmp family_agenttesla -
Executes dropped EXE 2 IoCs
pid Process 1864 .exe 1596 RegAsm.exe -
Loads dropped DLL 3 IoCs
pid Process 1500 AWB070820206533.exe 1864 .exe 1596 RegAsm.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\neme = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\Desktop\\.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1864 set thread context of 1596 1864 .exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 1500 AWB070820206533.exe 1500 AWB070820206533.exe 1500 AWB070820206533.exe 1864 .exe 1864 .exe 1864 .exe 1596 RegAsm.exe 1596 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1500 AWB070820206533.exe Token: SeDebugPrivilege 1864 .exe Token: SeDebugPrivilege 1596 RegAsm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1596 RegAsm.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1500 wrote to memory of 1020 1500 AWB070820206533.exe 24 PID 1500 wrote to memory of 1020 1500 AWB070820206533.exe 24 PID 1500 wrote to memory of 1020 1500 AWB070820206533.exe 24 PID 1500 wrote to memory of 1020 1500 AWB070820206533.exe 24 PID 1020 wrote to memory of 1064 1020 cmd.exe 26 PID 1020 wrote to memory of 1064 1020 cmd.exe 26 PID 1020 wrote to memory of 1064 1020 cmd.exe 26 PID 1020 wrote to memory of 1064 1020 cmd.exe 26 PID 1500 wrote to memory of 1864 1500 AWB070820206533.exe 28 PID 1500 wrote to memory of 1864 1500 AWB070820206533.exe 28 PID 1500 wrote to memory of 1864 1500 AWB070820206533.exe 28 PID 1500 wrote to memory of 1864 1500 AWB070820206533.exe 28 PID 1864 wrote to memory of 1596 1864 .exe 31 PID 1864 wrote to memory of 1596 1864 .exe 31 PID 1864 wrote to memory of 1596 1864 .exe 31 PID 1864 wrote to memory of 1596 1864 .exe 31 PID 1864 wrote to memory of 1596 1864 .exe 31 PID 1864 wrote to memory of 1596 1864 .exe 31 PID 1864 wrote to memory of 1596 1864 .exe 31 PID 1864 wrote to memory of 1596 1864 .exe 31 PID 1864 wrote to memory of 1596 1864 .exe 31 PID 1864 wrote to memory of 1596 1864 .exe 31 PID 1864 wrote to memory of 1596 1864 .exe 31 PID 1864 wrote to memory of 1596 1864 .exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB070820206533.exe"C:\Users\Admin\AppData\Local\Temp\AWB070820206533.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v neme /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v neme /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\Desktop\.exe"3⤵
- Adds Run key to start application
PID:1064
-
-
-
C:\Users\Admin\Desktop\.exe"C:\Users\Admin\Desktop\.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"C:\Users\Admin\AppData\Local\Temp\RegAsm.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1596
-
-