Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
19/05/2023, 11:49
Static task
static1
Behavioral task
behavioral1
Sample
PI.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
PI.exe
Resource
win10v2004-20230220-en
General
-
Target
PI.exe
-
Size
873KB
-
MD5
22a9b282c0942875f9f99aeeb7503bf1
-
SHA1
b563cc1c326699fc8556bb13b3bd9265beedc0de
-
SHA256
48a9074aa2eebe724b1e9d3828e2eb3ab0fde8d370ef71652b5ffe44cf51322e
-
SHA512
753366f0512df3654fa28c48e30f2abb3693c372c9746c08659c58811b3f87aa88a30d3a67e059c0a8ee6afe582de2eff16d6c8f33200e11499f0acb04e2cea4
-
SSDEEP
12288:v2iNfUFotEvZ412FX6vGIJ4XWfiTBSC8WU0UtuH5T2J3jHuR:v1Bs0qZ4MHJmsoCy0UtugJDS
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.rapidcheckng.com - Port:
587 - Username:
[email protected] - Password:
@Rapidcheckng# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 25 api.ipify.org 27 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1728 set thread context of 400 1728 PI.exe 87 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1728 PI.exe 1728 PI.exe 1728 PI.exe 1728 PI.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1728 PI.exe Token: SeDebugPrivilege 400 RegSvcs.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2804 1728 PI.exe 86 PID 1728 wrote to memory of 2804 1728 PI.exe 86 PID 1728 wrote to memory of 2804 1728 PI.exe 86 PID 1728 wrote to memory of 400 1728 PI.exe 87 PID 1728 wrote to memory of 400 1728 PI.exe 87 PID 1728 wrote to memory of 400 1728 PI.exe 87 PID 1728 wrote to memory of 400 1728 PI.exe 87 PID 1728 wrote to memory of 400 1728 PI.exe 87 PID 1728 wrote to memory of 400 1728 PI.exe 87 PID 1728 wrote to memory of 400 1728 PI.exe 87 PID 1728 wrote to memory of 400 1728 PI.exe 87 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1013461898-3711306144-4198452673-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PI.exe"C:\Users\Admin\AppData\Local\Temp\PI.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2804
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:400
-