Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
81s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
30/09/2022, 12:15
Static task
static1
Behavioral task
behavioral1
Sample
Invoice-OM Telentia-YX20220926A00224.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
Invoice-OM Telentia-YX20220926A00224.exe
Resource
win10v2004-20220901-en
General
-
Target
Invoice-OM Telentia-YX20220926A00224.exe
-
Size
652KB
-
MD5
99789bc5320508920ea1c5cdbd05737b
-
SHA1
5f4eb9eb8b8cb946a42dab79441bead2d20c68f2
-
SHA256
511af8c57f0d44cb50d6560c0e820a5c9f6da27c307c698ffc5ccfbc57269e7d
-
SHA512
906f3aa2e74321d570dece33b84da1f718fc11f174eb41b836d6cde9e8da566226024a6620c22612225c7e3cae2a026f0f267687f9270b400106d6a1f8d00e43
-
SSDEEP
12288:ICe+6uFJ8mfqKtmO62/WJh71I1W6cYVl9v4QjFMsZNSs864:ICe1uFSbKwOz31W6cK7JjFMsZN26
Malware Config
Extracted
Protocol: smtp- Host:
multimetals.cfd - Port:
587 - Username:
[email protected] - Password:
[email protected]
Extracted
agenttesla
Protocol: smtp- Host:
multimetals.cfd - Port:
587 - Username:
application/x-www-form-urlencoded - Password:
[email protected] - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation Invoice-OM Telentia-YX20220926A00224.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Word = "C:\\Users\\Admin\\AppData\\Roaming\\Word\\Word.exe" InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4308 set thread context of 1228 4308 dapi.exe 98 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 628 Invoice-OM Telentia-YX20220926A00224.exe 4308 dapi.exe 4308 dapi.exe 1228 InstallUtil.exe 1228 InstallUtil.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 628 Invoice-OM Telentia-YX20220926A00224.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 628 Invoice-OM Telentia-YX20220926A00224.exe Token: SeDebugPrivilege 4308 dapi.exe Token: SeDebugPrivilege 1228 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 628 wrote to memory of 4308 628 Invoice-OM Telentia-YX20220926A00224.exe 91 PID 628 wrote to memory of 4308 628 Invoice-OM Telentia-YX20220926A00224.exe 91 PID 628 wrote to memory of 4308 628 Invoice-OM Telentia-YX20220926A00224.exe 91 PID 4308 wrote to memory of 1228 4308 dapi.exe 98 PID 4308 wrote to memory of 1228 4308 dapi.exe 98 PID 4308 wrote to memory of 1228 4308 dapi.exe 98 PID 4308 wrote to memory of 1228 4308 dapi.exe 98 PID 4308 wrote to memory of 1228 4308 dapi.exe 98 PID 4308 wrote to memory of 1228 4308 dapi.exe 98 PID 4308 wrote to memory of 1228 4308 dapi.exe 98 PID 4308 wrote to memory of 1228 4308 dapi.exe 98 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Invoice-OM Telentia-YX20220926A00224.exe"C:\Users\Admin\AppData\Local\Temp\Invoice-OM Telentia-YX20220926A00224.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\dapi.exe"C:\Users\Admin\AppData\Local\Temp\dapi.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4308 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"3⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1228
-
-