Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
106s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
02/11/2022, 16:02
General
-
Target
288f17e9e8e87a96b274cf1afae41f60.exe
-
Size
216KB
-
MD5
288f17e9e8e87a96b274cf1afae41f60
-
SHA1
bbbdf9998fb0c8345a73b3945e15c557c31b0fdd
-
SHA256
982b6350bb158c2e96fadc0cb7a07395aa4131721117b5d884004b05dad79f1b
-
SHA512
f2016139c70e8f5c3868732f1e436c920666c028c0e90b889231413090b6ee2a870d04fc138886106e016d6b624876c8bf06a7de333ee0db300a6efb3d1c7953
-
SSDEEP
3072:x8P9B8IKm9/IRWMFNDH20aHRUUsDKC7FbULm6/V7qeOn+38+UKuVhs6dH/Ilh:xICm9juxaaU8dhpU8D+3WKuVhpdfIl
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\288f17e9e8e87a96b274cf1afae41f60.exe"C:\Users\Admin\AppData\Local\Temp\288f17e9e8e87a96b274cf1afae41f60.exe"1⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240KB
-
Filesize
5.6MB
-
Filesize
624KB
-
Filesize
408KB
-
Filesize
320KB
-
Filesize
584KB
-
Filesize
40KB