Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
05/06/2023, 10:11
Static task
static1
Behavioral task
behavioral1
Sample
QUOTE #21440170.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
QUOTE #21440170.exe
Resource
win10v2004-20230220-en
General
-
Target
QUOTE #21440170.exe
-
Size
689KB
-
MD5
6f20bdc25100357d2696eb7b48f6fb18
-
SHA1
b6bdd55fe0b158ac6073001270188441feab9ad4
-
SHA256
4024305f22679e7580e906744bba5ad9193fbe444c9b30b24845f135886a3c86
-
SHA512
ffb1df83d229f917e90368d6c406b73dc020ada95386d2ba109f4c712964cbf7e9e275a5ed45fb32c1d467bde119f00672f2a9ef4cda8bcfd23591c089952d58
-
SSDEEP
12288:lro7WxISxii8tnmH8FHLMMUAi9gC9ymc1pBWMm:l3xIYirtnW8FHM/9LB6M
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
iebtzpacgzyullvo - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows\CurrentVersion\Run\YLcqPJe = "C:\\Users\\Admin\\AppData\\Roaming\\YLcqPJe\\YLcqPJe.exe" MSBuild.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2000 set thread context of 588 2000 QUOTE #21440170.exe 29 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 732 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2000 QUOTE #21440170.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2000 QUOTE #21440170.exe Token: SeDebugPrivilege 588 MSBuild.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2000 wrote to memory of 732 2000 QUOTE #21440170.exe 27 PID 2000 wrote to memory of 732 2000 QUOTE #21440170.exe 27 PID 2000 wrote to memory of 732 2000 QUOTE #21440170.exe 27 PID 2000 wrote to memory of 732 2000 QUOTE #21440170.exe 27 PID 2000 wrote to memory of 588 2000 QUOTE #21440170.exe 29 PID 2000 wrote to memory of 588 2000 QUOTE #21440170.exe 29 PID 2000 wrote to memory of 588 2000 QUOTE #21440170.exe 29 PID 2000 wrote to memory of 588 2000 QUOTE #21440170.exe 29 PID 2000 wrote to memory of 588 2000 QUOTE #21440170.exe 29 PID 2000 wrote to memory of 588 2000 QUOTE #21440170.exe 29 PID 2000 wrote to memory of 588 2000 QUOTE #21440170.exe 29 PID 2000 wrote to memory of 588 2000 QUOTE #21440170.exe 29 PID 2000 wrote to memory of 588 2000 QUOTE #21440170.exe 29 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1563773381-2037468142-1146002597-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\QUOTE #21440170.exe"C:\Users\Admin\AppData\Local\Temp\QUOTE #21440170.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\jvHHTwCVEuk" /XML "C:\Users\Admin\AppData\Local\Temp\tmp95EA.tmp"2⤵
- Creates scheduled task(s)
PID:732
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:588
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5029384fa24334cd29a888871db38469f
SHA129b3f76a55414469d243b44ddacc2174a64463f2
SHA256d52c91f16fff063530c7ba7af72ee06ed977ee60b9646c9f9d23e448bd4489f7
SHA51231442cc9099b06cce5767c0c0de793e567218accb7a573986b53d322353e10b51bbe488656ab1c5c32fec3887623cb75d5ba6c1c73f22f29d50baba9657366f8