Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    42s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    22/09/2022, 13:28

General

  • Target

    Vereisten voor bestellijst 220922.xlxs.pdf(~67KB).exe

  • Size

    206KB

  • MD5

    782766d8fb64ac0de4accb3d971cb63b

  • SHA1

    4eca0095a47c936adf2357100a73a8b89b8aa388

  • SHA256

    52d2abb85de115be28c584f6801451e67ffb745e1a2bba4589cc42430e6029aa

  • SHA512

    76c4e9f13987f1bf28745e4cb53d8aaf8ef864f481399ed3115e8267f79fcc14b299a8ba94d7a06a71167e2e12809a8cba1092b0511d429c60adf66008b40ff9

  • SSDEEP

    3072:WUa1zwTgRXMD1W01qfIUlrB3+f0+aZrC7X126+AEgFTQdP78jyhcHm:RqlRXMD1WrIUlowZmLh+AHTg8dG

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    %2B
  • Port:
    21
  • Username:
    application/x-www-form-urlencoded
  • Password:
    image/jpg
C2

p=

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Vereisten voor bestellijst 220922.xlxs.pdf(~67KB).exe
    "C:\Users\Admin\AppData\Local\Temp\Vereisten voor bestellijst 220922.xlxs.pdf(~67KB).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1784
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2040

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1784-54-0x0000000000030000-0x0000000000066000-memory.dmp

    Filesize

    216KB

  • memory/1784-55-0x0000000000230000-0x0000000000236000-memory.dmp

    Filesize

    24KB

  • memory/1784-56-0x0000000000290000-0x000000000029C000-memory.dmp

    Filesize

    48KB

  • memory/1784-57-0x00000000002A0000-0x00000000002A8000-memory.dmp

    Filesize

    32KB

  • memory/2040-58-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2040-59-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2040-61-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2040-62-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2040-63-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2040-66-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2040-68-0x0000000000400000-0x000000000043A000-memory.dmp

    Filesize

    232KB

  • memory/2040-69-0x00000000753C1000-0x00000000753C3000-memory.dmp

    Filesize

    8KB