Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
73s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
07/02/2023, 15:22
Static task
static1
Behavioral task
behavioral1
Sample
AWB NO. 8148557141.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
AWB NO. 8148557141.exe
Resource
win10v2004-20221111-en
General
-
Target
AWB NO. 8148557141.exe
-
Size
792KB
-
MD5
a169ae631ac877e4e89d595b6ba03600
-
SHA1
4589dd4afc4a6c9423ddba7442137e5beb502fb0
-
SHA256
c1add17549206e0ea3e1025ec81ff8d7e5ae994381600ec84d33eeab50ea7232
-
SHA512
f2a639c226a6e092c664921fcb99dba63ca564e024f0be3b364951c55a842a5767a95c79f7afd1d61400c01c396eb346346e110f18e744613008def4d0e0bcf3
-
SSDEEP
12288:Nrt0wdeWKBp5gYcjzioNo5IhMbmfEJhJm6I6awHRr/CB06KuLpgbDDlG:NrGV7p55Ki7WhMKfCm6xawxO5dgZ
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot6191932863:AAEw6WZfMHSbIiilSKsmAnJOgaZwvnoMVh8/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AWB NO. 8148557141.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AWB NO. 8148557141.exe Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AWB NO. 8148557141.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1516 set thread context of 1192 1516 AWB NO. 8148557141.exe 27 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1516 AWB NO. 8148557141.exe 1516 AWB NO. 8148557141.exe 1516 AWB NO. 8148557141.exe 1516 AWB NO. 8148557141.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1516 AWB NO. 8148557141.exe Token: SeDebugPrivilege 1192 AWB NO. 8148557141.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1516 wrote to memory of 1192 1516 AWB NO. 8148557141.exe 27 PID 1516 wrote to memory of 1192 1516 AWB NO. 8148557141.exe 27 PID 1516 wrote to memory of 1192 1516 AWB NO. 8148557141.exe 27 PID 1516 wrote to memory of 1192 1516 AWB NO. 8148557141.exe 27 PID 1516 wrote to memory of 1192 1516 AWB NO. 8148557141.exe 27 PID 1516 wrote to memory of 1192 1516 AWB NO. 8148557141.exe 27 PID 1516 wrote to memory of 1192 1516 AWB NO. 8148557141.exe 27 PID 1516 wrote to memory of 1192 1516 AWB NO. 8148557141.exe 27 PID 1516 wrote to memory of 1192 1516 AWB NO. 8148557141.exe 27 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AWB NO. 8148557141.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 AWB NO. 8148557141.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AWB NO. 8148557141.exe"C:\Users\Admin\AppData\Local\Temp\AWB NO. 8148557141.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\AppData\Local\Temp\AWB NO. 8148557141.exe"C:\Users\Admin\AppData\Local\Temp\AWB NO. 8148557141.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:1192
-