Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
-
submitted
22/11/2022, 12:56
General
-
Target
SecuriteInfo.com.Trojan.Inject4.6572.15229.26543.exe
-
Size
961KB
-
MD5
37ec92d6d742fadd1d398d92153bcf70
-
SHA1
e80d54c9b7bc5ea5dd717122a380ac62f631e532
-
SHA256
7b2c22135a593218b38f180ac6147283ef45f35965caacec43cfb4db3aead0c8
-
SHA512
2cf907a39b1f3aab74a5ce96f0c26839fd38c9edb476910baa66d42d48155a36a510eb7fe7c2193409eaf18f2b30411b56267700efe0fccb7132be625813ca3d
-
SSDEEP
12288:GqSSSgsEoLpvkoYyBLeNATTO56Cfp9PyUZvkOjkTwA6j9MvFnJh8uyrTSJeAzO4q:cbEwxfiNATqvx9P9WO1GvFJn+TyI48
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot5303328165:AAF7HxnjN67EBIegVs-MwZqBsR_i0699CXE/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
-
outlook_office_path 1 IoCs
-
outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.6572.15229.26543.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.6572.15229.26543.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.6572.15229.26543.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Inject4.6572.15229.26543.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
984KB
-
Filesize
776KB
-
Filesize
8KB
-
Filesize
88KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB
-
Filesize
432KB