Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    70s
  • max time network
    49s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19/10/2022, 07:25

General

  • Target

    76.exe

  • Size

    6KB

  • MD5

    4df280fea800291ab943f10909194e74

  • SHA1

    022a5f042e3db04009dad89006532618fbed8808

  • SHA256

    026b11037329ad5ff8cda17668d30b59366df051ab09ab35790f2d2e8324a85d

  • SHA512

    b39f2a0796e0cc915a68d284f5c8b2eb7737368e8aba1fcbac754c5f653d26e9286436bb033e2e9fdd46015dd8d5fc4716984541518f89f394aa3dd013d263e8

  • SSDEEP

    96:Giete33Zahzeo7yycaw1H+AUn2YQrtbszNt:ets3uz1bw1HelQrxW

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\76.exe
    "C:\Users\Admin\AppData\Local\Temp\76.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:392
    • C:\Users\Admin\AppData\Local\Temp\76.exe
      C:\Users\Admin\AppData\Local\Temp\76.exe
      2⤵
        PID:800
      • C:\Users\Admin\AppData\Local\Temp\76.exe
        C:\Users\Admin\AppData\Local\Temp\76.exe
        2⤵
        • Accesses Microsoft Outlook profiles
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:304

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/304-63-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/304-70-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/304-72-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/304-67-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/304-66-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/304-65-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/304-62-0x0000000000400000-0x000000000043C000-memory.dmp

      Filesize

      240KB

    • memory/392-61-0x000000006EDD0000-0x000000006F37B000-memory.dmp

      Filesize

      5.7MB

    • memory/392-60-0x000000006EDD0000-0x000000006F37B000-memory.dmp

      Filesize

      5.7MB

    • memory/1204-54-0x0000000000BC0000-0x0000000000BC8000-memory.dmp

      Filesize

      32KB

    • memory/1204-57-0x0000000005030000-0x00000000050C2000-memory.dmp

      Filesize

      584KB

    • memory/1204-56-0x00000000054C0000-0x000000000558A000-memory.dmp

      Filesize

      808KB

    • memory/1204-55-0x0000000074E41000-0x0000000074E43000-memory.dmp

      Filesize

      8KB