Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
135s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2023, 03:55
Static task
static1
Behavioral task
behavioral1
Sample
083965a90714725c4f6fd725d87e7d06.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
083965a90714725c4f6fd725d87e7d06.exe
Resource
win10v2004-20230220-en
General
-
Target
083965a90714725c4f6fd725d87e7d06.exe
-
Size
206KB
-
MD5
083965a90714725c4f6fd725d87e7d06
-
SHA1
aeed390a90c21d43f4d860db8532183b9f1b94b8
-
SHA256
3b9720e19ad5d4eb9d5d4a02823671962c7d763c74e7ffc34fc689a3ec61051f
-
SHA512
eeb36c004ca7578fd8ee2a163c1102f3b337d86051bbc01b7eaa87e51724b309bbf742b722293c17bbc787483443707fb2651911be1d536c14732f2252854c24
-
SSDEEP
6144:Jv5I6kaDdUV8FUQHXaIHxELGrEeO/UjABHRvj5:dC6kaZUYKuWLQEn8kBHj
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.ocp.mx - Port:
21 - Username:
[email protected] - Password:
lasco4000
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1192 set thread context of 700 1192 083965a90714725c4f6fd725d87e7d06.exe 85 -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 700 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1192 wrote to memory of 700 1192 083965a90714725c4f6fd725d87e7d06.exe 85 PID 1192 wrote to memory of 700 1192 083965a90714725c4f6fd725d87e7d06.exe 85 PID 1192 wrote to memory of 700 1192 083965a90714725c4f6fd725d87e7d06.exe 85 PID 1192 wrote to memory of 700 1192 083965a90714725c4f6fd725d87e7d06.exe 85 PID 1192 wrote to memory of 700 1192 083965a90714725c4f6fd725d87e7d06.exe 85 PID 1192 wrote to memory of 700 1192 083965a90714725c4f6fd725d87e7d06.exe 85 PID 1192 wrote to memory of 700 1192 083965a90714725c4f6fd725d87e7d06.exe 85 PID 1192 wrote to memory of 700 1192 083965a90714725c4f6fd725d87e7d06.exe 85 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2275444769-3691835758-4097679484-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\083965a90714725c4f6fd725d87e7d06.exe"C:\Users\Admin\AppData\Local\Temp\083965a90714725c4f6fd725d87e7d06.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:700
-