Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
104s -
max time network
108s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/09/2022, 12:15
Static task
static1
Behavioral task
behavioral1
Sample
Invoice-OM Telentia-YX20220926A00224.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Invoice-OM Telentia-YX20220926A00224.exe
Resource
win10v2004-20220901-en
General
-
Target
Invoice-OM Telentia-YX20220926A00224.exe
-
Size
652KB
-
MD5
99789bc5320508920ea1c5cdbd05737b
-
SHA1
5f4eb9eb8b8cb946a42dab79441bead2d20c68f2
-
SHA256
511af8c57f0d44cb50d6560c0e820a5c9f6da27c307c698ffc5ccfbc57269e7d
-
SHA512
906f3aa2e74321d570dece33b84da1f718fc11f174eb41b836d6cde9e8da566226024a6620c22612225c7e3cae2a026f0f267687f9270b400106d6a1f8d00e43
-
SSDEEP
12288:ICe+6uFJ8mfqKtmO62/WJh71I1W6cYVl9v4QjFMsZNSs864:ICe1uFSbKwOz31W6cK7JjFMsZN26
Malware Config
Extracted
Protocol: smtp- Host:
multimetals.cfd - Port:
587 - Username:
[email protected] - Password:
[email protected]
Extracted
agenttesla
Protocol: smtp- Host:
multimetals.cfd - Port:
587 - Username:
application/x-www-form-urlencoded - Password:
[email protected] - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Word = "C:\\Users\\Admin\\AppData\\Roaming\\Word\\Word.exe" InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1980 set thread context of 624 1980 dapi.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 968 Invoice-OM Telentia-YX20220926A00224.exe 1980 dapi.exe 1980 dapi.exe 1980 dapi.exe 624 InstallUtil.exe 624 InstallUtil.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 968 Invoice-OM Telentia-YX20220926A00224.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 968 Invoice-OM Telentia-YX20220926A00224.exe Token: SeDebugPrivilege 1980 dapi.exe Token: SeDebugPrivilege 624 InstallUtil.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 968 wrote to memory of 1980 968 Invoice-OM Telentia-YX20220926A00224.exe 27 PID 968 wrote to memory of 1980 968 Invoice-OM Telentia-YX20220926A00224.exe 27 PID 968 wrote to memory of 1980 968 Invoice-OM Telentia-YX20220926A00224.exe 27 PID 968 wrote to memory of 1980 968 Invoice-OM Telentia-YX20220926A00224.exe 27 PID 1980 wrote to memory of 1232 1980 dapi.exe 28 PID 1980 wrote to memory of 1232 1980 dapi.exe 28 PID 1980 wrote to memory of 1232 1980 dapi.exe 28 PID 1980 wrote to memory of 1232 1980 dapi.exe 28 PID 1980 wrote to memory of 1232 1980 dapi.exe 28 PID 1980 wrote to memory of 1232 1980 dapi.exe 28 PID 1980 wrote to memory of 1232 1980 dapi.exe 28 PID 1980 wrote to memory of 1232 1980 dapi.exe 28 PID 1980 wrote to memory of 1232 1980 dapi.exe 28 PID 1980 wrote to memory of 1232 1980 dapi.exe 28 PID 1980 wrote to memory of 1232 1980 dapi.exe 28 PID 1980 wrote to memory of 1232 1980 dapi.exe 28 PID 1980 wrote to memory of 624 1980 dapi.exe 29 PID 1980 wrote to memory of 624 1980 dapi.exe 29 PID 1980 wrote to memory of 624 1980 dapi.exe 29 PID 1980 wrote to memory of 624 1980 dapi.exe 29 PID 1980 wrote to memory of 624 1980 dapi.exe 29 PID 1980 wrote to memory of 624 1980 dapi.exe 29 PID 1980 wrote to memory of 624 1980 dapi.exe 29 PID 1980 wrote to memory of 624 1980 dapi.exe 29 PID 1980 wrote to memory of 624 1980 dapi.exe 29 PID 1980 wrote to memory of 624 1980 dapi.exe 29 PID 1980 wrote to memory of 624 1980 dapi.exe 29 PID 1980 wrote to memory of 624 1980 dapi.exe 29 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice-OM Telentia-YX20220926A00224.exe"C:\Users\Admin\AppData\Local\Temp\Invoice-OM Telentia-YX20220926A00224.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Users\Admin\AppData\Local\Temp\dapi.exe"C:\Users\Admin\AppData\Local\Temp\dapi.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵PID:1232
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:624
-
-