Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
31/05/2023, 06:31
230531-g974xsdf9t 10Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31/05/2023, 06:31
Static task
static1
Behavioral task
behavioral1
Sample
02035499.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
02035499.exe
Resource
win10v2004-20230220-en
General
-
Target
02035499.exe
-
Size
815KB
-
MD5
ea4a5870ea5b2417a6ac0bbc7cc44be3
-
SHA1
5e605904d1b0c797aac2b798319bb0c145a1b646
-
SHA256
202494911805344069ceb189e70db6f89e17f55febe24dc4f42b3736c5b457a4
-
SHA512
a96149dbfbce51b12c135428eefb05fa686d6fbf30e997c5e80ed3ae5f4f40bfb029aaf120ac43fbdb639ef876a6f20a32c5d904767349d4eedb62a29b4111d9
-
SSDEEP
12288:zAMTihh6xhZ6OrlZKZXzlKwkHaG0M+NHG12wQ0l2qaMMJfiRoCJqJ7gwJBT3qrb+:0MUgh8ylZKhRC5J2Qle9JKRFJZw
Malware Config
Extracted
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
marcellinus360
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
marcellinus360
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation 02035499.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 40 api.ipify.org 41 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1400 set thread context of 1372 1400 02035499.exe 96 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1824 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1400 02035499.exe 1400 02035499.exe 4416 powershell.exe 4416 powershell.exe 1372 RegSvcs.exe 1372 RegSvcs.exe 1372 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1400 02035499.exe Token: SeDebugPrivilege 4416 powershell.exe Token: SeDebugPrivilege 1372 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1372 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1400 wrote to memory of 4416 1400 02035499.exe 91 PID 1400 wrote to memory of 4416 1400 02035499.exe 91 PID 1400 wrote to memory of 4416 1400 02035499.exe 91 PID 1400 wrote to memory of 1824 1400 02035499.exe 93 PID 1400 wrote to memory of 1824 1400 02035499.exe 93 PID 1400 wrote to memory of 1824 1400 02035499.exe 93 PID 1400 wrote to memory of 4120 1400 02035499.exe 95 PID 1400 wrote to memory of 4120 1400 02035499.exe 95 PID 1400 wrote to memory of 4120 1400 02035499.exe 95 PID 1400 wrote to memory of 1372 1400 02035499.exe 96 PID 1400 wrote to memory of 1372 1400 02035499.exe 96 PID 1400 wrote to memory of 1372 1400 02035499.exe 96 PID 1400 wrote to memory of 1372 1400 02035499.exe 96 PID 1400 wrote to memory of 1372 1400 02035499.exe 96 PID 1400 wrote to memory of 1372 1400 02035499.exe 96 PID 1400 wrote to memory of 1372 1400 02035499.exe 96 PID 1400 wrote to memory of 1372 1400 02035499.exe 96 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02035499.exe"C:\Users\Admin\AppData\Local\Temp\02035499.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\jibLAybKs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jibLAybKs" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCD04.tmp"2⤵
- Creates scheduled task(s)
PID:1824
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:4120
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1372
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5d4bf268e85934ae32dddde674b77d52c
SHA1d00b3f6fc11fe89af24a7c7aeb64a1aefa38b62d
SHA2569bb4dd3ee681351ca7a59f41efc4c8697d963d07ee0fbafff59cb2123ed72c88
SHA5120fb1c09c58ef7614e427d28433f0230329bc10f40c5707c694c89b72b0091b667c94aa256f32d10b208bf7f2e443c6327605390dcab2c1e7f30c161126c4ddf6