Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    65s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    12/10/2022, 05:59

General

  • Target

    PO#1135 - 裕偉.exe

  • Size

    201KB

  • MD5

    904c9f952de691e5ee9b979d0916079d

  • SHA1

    fc9059be19919980ae5df7921fe37981bea10b26

  • SHA256

    f8e71f18713a21ba7b1f935a745a5321f9bdaadb565cb40b7055e3dc25b43d3e

  • SHA512

    a5445cfc4f6a474e9a5177d9861aab9d03f103544e9e30e6dad5801bb6ad1743f1525d2a6e6e5045c07997d8f04a4e8ff5eeecfefb7eb266c225d1bbf204d07c

  • SSDEEP

    3072:P85g3O9SYeSypEII/9UmPWuGDXIpAKWV3JAzfOUQmd4NDVoe/u0x81kXQpB5UULJ:k2SzhRosCj9TV

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.aquariushotelboutique.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    k,eufv#mMklw

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 6 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO#1135 - 裕偉.exe
    "C:\Users\Admin\AppData\Local\Temp\PO#1135 - 裕偉.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      2⤵
        PID:960
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1692

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1692-58-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/1692-59-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/1692-62-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/1692-63-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/1692-61-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/1692-68-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/1692-66-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/1884-54-0x0000000001290000-0x00000000012C8000-memory.dmp

      Filesize

      224KB

    • memory/1884-55-0x0000000075201000-0x0000000075203000-memory.dmp

      Filesize

      8KB

    • memory/1884-56-0x0000000005DE0000-0x0000000005EB2000-memory.dmp

      Filesize

      840KB

    • memory/1884-57-0x0000000004F80000-0x0000000005012000-memory.dmp

      Filesize

      584KB