Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    47s
  • max time network
    45s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    22/11/2022, 13:01

General

  • Target

    STATEMENT OF ACCOUNT.exe

  • Size

    314KB

  • MD5

    1427fec2cb5f8c7e4f2af9fe5bb48086

  • SHA1

    a54121f29218dd822503020efae91c9cdfb14643

  • SHA256

    c8676f5a35ecf028d928368d10e861e4c6e803438861ebf02e7256a6f9bb497b

  • SHA512

    19dfa98e331c69ce5c374e8c29a3af48a7757854ea7d2bc34b2d55ae4e8a083b1218707c7dbb3ac8215f84a1563947e1e6a134e4a8e4040c490d3ed677716f19

  • SSDEEP

    6144:MEa0NxCnC74exjZFQTND5d48RZE55ZSJMmiDOEb/95SLRICaTVYEcgbvGyVU42J:XxCCpxFFQTPd48ReDZS86K/9cVIjTVYV

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe
    "C:\Users\Admin\AppData\Local\Temp\STATEMENT OF ACCOUNT.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Users\Admin\AppData\Local\Temp\vgvenv.exe
      "C:\Users\Admin\AppData\Local\Temp\vgvenv.exe" C:\Users\Admin\AppData\Local\Temp\zlbfcobun.g
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1672
      • C:\Users\Admin\AppData\Local\Temp\vgvenv.exe
        "C:\Users\Admin\AppData\Local\Temp\vgvenv.exe" C:\Users\Admin\AppData\Local\Temp\zlbfcobun.g
        3⤵
        • Executes dropped EXE
        • Accesses Microsoft Outlook profiles
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:1660

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\kvidzlfj.gb

    Filesize

    296KB

    MD5

    86865cd90ab3793d650eaef744b38411

    SHA1

    4fa651cb57fbb93eeefd9d10f7c93cb8aa8f2dc5

    SHA256

    becb28209b97fc842142c31e19d7e7262fdac5983a771d4f08aea8ba57d8a396

    SHA512

    aa5c8b35eac6bcfebbc62c9053a985375d914c94ce5fb5334b786c8f9f8b816f6724515da64c954da2b4bff43dec726ccce572dee4585d7a9a49015fbe4d968d

  • C:\Users\Admin\AppData\Local\Temp\vgvenv.exe

    Filesize

    7KB

    MD5

    032fa6d702f61e0551bb37bb5a325db3

    SHA1

    4f48b0be98d60118399383dc87bb3a1a0c384a70

    SHA256

    5d9573dc21ee4fd34d2d2127b515181fcff0926c8fbfbf794daed88ea75c8742

    SHA512

    7c8a25c06ccac4797ec175d9d284ac4716e9315679aab0bafc587bdf0cfbb4c5bd8e970d86ab9a990c0a4785502ccc404aed25e69816f8574a2d4fa1127a71ad

  • C:\Users\Admin\AppData\Local\Temp\vgvenv.exe

    Filesize

    7KB

    MD5

    032fa6d702f61e0551bb37bb5a325db3

    SHA1

    4f48b0be98d60118399383dc87bb3a1a0c384a70

    SHA256

    5d9573dc21ee4fd34d2d2127b515181fcff0926c8fbfbf794daed88ea75c8742

    SHA512

    7c8a25c06ccac4797ec175d9d284ac4716e9315679aab0bafc587bdf0cfbb4c5bd8e970d86ab9a990c0a4785502ccc404aed25e69816f8574a2d4fa1127a71ad

  • C:\Users\Admin\AppData\Local\Temp\vgvenv.exe

    Filesize

    7KB

    MD5

    032fa6d702f61e0551bb37bb5a325db3

    SHA1

    4f48b0be98d60118399383dc87bb3a1a0c384a70

    SHA256

    5d9573dc21ee4fd34d2d2127b515181fcff0926c8fbfbf794daed88ea75c8742

    SHA512

    7c8a25c06ccac4797ec175d9d284ac4716e9315679aab0bafc587bdf0cfbb4c5bd8e970d86ab9a990c0a4785502ccc404aed25e69816f8574a2d4fa1127a71ad

  • C:\Users\Admin\AppData\Local\Temp\zlbfcobun.g

    Filesize

    7KB

    MD5

    d22fdd5018395bf1a71cf8a94ce4304c

    SHA1

    f54083c68ab1a6890e0eb1185666ce03ac2cf440

    SHA256

    5a364ea1e71795f9e887bae20bb2b5f5ff8f21607974b19ab5a8e627f0257f4b

    SHA512

    bf458c3ab20b1504e15b399aff007cd7429f86912a0cffa43bdac9d185d8185f85e5c9d204c7d10aa17f681ccccdc50e5ead29bee90592fb8da379c2c38aa823

  • \Users\Admin\AppData\Local\Temp\vgvenv.exe

    Filesize

    7KB

    MD5

    032fa6d702f61e0551bb37bb5a325db3

    SHA1

    4f48b0be98d60118399383dc87bb3a1a0c384a70

    SHA256

    5d9573dc21ee4fd34d2d2127b515181fcff0926c8fbfbf794daed88ea75c8742

    SHA512

    7c8a25c06ccac4797ec175d9d284ac4716e9315679aab0bafc587bdf0cfbb4c5bd8e970d86ab9a990c0a4785502ccc404aed25e69816f8574a2d4fa1127a71ad

  • \Users\Admin\AppData\Local\Temp\vgvenv.exe

    Filesize

    7KB

    MD5

    032fa6d702f61e0551bb37bb5a325db3

    SHA1

    4f48b0be98d60118399383dc87bb3a1a0c384a70

    SHA256

    5d9573dc21ee4fd34d2d2127b515181fcff0926c8fbfbf794daed88ea75c8742

    SHA512

    7c8a25c06ccac4797ec175d9d284ac4716e9315679aab0bafc587bdf0cfbb4c5bd8e970d86ab9a990c0a4785502ccc404aed25e69816f8574a2d4fa1127a71ad

  • memory/1076-54-0x0000000075C51000-0x0000000075C53000-memory.dmp

    Filesize

    8KB

  • memory/1660-66-0x00000000002E0000-0x000000000031C000-memory.dmp

    Filesize

    240KB

  • memory/1660-67-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB