Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    54s
  • max time network
    30s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    16/04/2023, 12:08

General

  • Target

    PO#7A68D20.exe

  • Size

    836KB

  • MD5

    b1e8f872bb44b3374f9316e7a0c92a33

  • SHA1

    948a5abbae5d5a92e32b8cd3bd94aaa6d8194d97

  • SHA256

    dda4f1a46d2cdb061159193b085f33cdade6e69c1d25b1fb41dfabbc1f84c5fb

  • SHA512

    58dfde3efdd97f54f64f8eebf55b46a537f6e7e312cbbffda1eb1649a8134a4047d93166345bdc1f33b8d1e14c76c30ec27282a5ffd51cf408fc8a229de93044

  • SSDEEP

    12288:QyrEFmaPEQ3OSuzqHu2XN7NzLEjTfBRfQlTIq0tvIW2e8i2Z:QJMU7NzLEvfBRYCIW242Z

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PO#7A68D20.exe
    "C:\Users\Admin\AppData\Local\Temp\PO#7A68D20.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TcQzOQKIsu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9638.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:284
    • C:\Users\Admin\AppData\Local\Temp\PO#7A68D20.exe
      "{path}"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:520

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp9638.tmp

    Filesize

    1KB

    MD5

    f3d1ea92a3f614ad9126b9ec06be990d

    SHA1

    86cb80c1317a96c1582716bf49836a8488367262

    SHA256

    476a48a6261a58361477e3430e8519f9895af45d21b331a98a369a426ab26101

    SHA512

    99d62b337d833ca588152bc1db570c7e322b9e8a4680c410b2eca0de1794d5236e3abc54fd09841b8830c7e9f8a08bde9808476cdbd12ed932a437c4f0e285b0

  • memory/520-68-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/520-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/520-74-0x0000000004C10000-0x0000000004C50000-memory.dmp

    Filesize

    256KB

  • memory/520-73-0x0000000004C10000-0x0000000004C50000-memory.dmp

    Filesize

    256KB

  • memory/520-72-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/520-70-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/520-63-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/520-66-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/520-65-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/520-64-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1740-56-0x00000000001E0000-0x00000000001EC000-memory.dmp

    Filesize

    48KB

  • memory/1740-54-0x0000000001040000-0x0000000001118000-memory.dmp

    Filesize

    864KB

  • memory/1740-55-0x0000000004EE0000-0x0000000004F20000-memory.dmp

    Filesize

    256KB

  • memory/1740-59-0x0000000000870000-0x00000000008A0000-memory.dmp

    Filesize

    192KB

  • memory/1740-58-0x00000000052B0000-0x000000000532C000-memory.dmp

    Filesize

    496KB

  • memory/1740-57-0x0000000004EE0000-0x0000000004F20000-memory.dmp

    Filesize

    256KB