Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
116s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2023, 05:15
Static task
static1
Behavioral task
behavioral1
Sample
Proforma Invoice.exe
Resource
win7-20230621-en
Behavioral task
behavioral2
Sample
Proforma Invoice.exe
Resource
win10v2004-20230621-en
General
-
Target
Proforma Invoice.exe
-
Size
1.3MB
-
MD5
0dcce5c54658fc8e2282b8f737e93be5
-
SHA1
622ed85d5cba99ac24d691b98b71ab7080074161
-
SHA256
eb2e0bf52e69c88784e19aef53a2c0330d3151ce8d448c5c45de44f3fc965aa0
-
SHA512
18307f094d771b865853a821bdb2f1dd885366208e44789787746e0a0b172e61597cb00b60c5e591a8c86aef17cf5241994659c1e92e6d9dc8c8354a876cd05f
-
SSDEEP
24576:uVp0K8s6owsmKZw2XXPUOgnwy45hbCbsfeHzYTuxa1y+ceBwDdplNMn0:uVp0K8s6owzInPUOgwy4fVWa1jceBw9D
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.steamd.in - Port:
587 - Username:
[email protected] - Password:
Purchase321@# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Control Panel\International\Geo\Nation Proforma Invoice.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 44 api.ipify.org 45 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1328 set thread context of 1156 1328 Proforma Invoice.exe 100 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4404 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4880 powershell.exe 3536 powershell.exe 3536 powershell.exe 4880 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 4880 powershell.exe Token: SeDebugPrivilege 3536 powershell.exe Token: SeDebugPrivilege 1156 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1156 RegSvcs.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1328 wrote to memory of 3536 1328 Proforma Invoice.exe 94 PID 1328 wrote to memory of 3536 1328 Proforma Invoice.exe 94 PID 1328 wrote to memory of 3536 1328 Proforma Invoice.exe 94 PID 1328 wrote to memory of 4880 1328 Proforma Invoice.exe 96 PID 1328 wrote to memory of 4880 1328 Proforma Invoice.exe 96 PID 1328 wrote to memory of 4880 1328 Proforma Invoice.exe 96 PID 1328 wrote to memory of 4404 1328 Proforma Invoice.exe 98 PID 1328 wrote to memory of 4404 1328 Proforma Invoice.exe 98 PID 1328 wrote to memory of 4404 1328 Proforma Invoice.exe 98 PID 1328 wrote to memory of 1156 1328 Proforma Invoice.exe 100 PID 1328 wrote to memory of 1156 1328 Proforma Invoice.exe 100 PID 1328 wrote to memory of 1156 1328 Proforma Invoice.exe 100 PID 1328 wrote to memory of 1156 1328 Proforma Invoice.exe 100 PID 1328 wrote to memory of 1156 1328 Proforma Invoice.exe 100 PID 1328 wrote to memory of 1156 1328 Proforma Invoice.exe 100 PID 1328 wrote to memory of 1156 1328 Proforma Invoice.exe 100 PID 1328 wrote to memory of 1156 1328 Proforma Invoice.exe 100 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2177513644-1903222820-241662473-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe"C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1328 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Proforma Invoice.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3536
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\wEQFNT.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4880
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\wEQFNT" /XML "C:\Users\Admin\AppData\Local\Temp\tmp89B2.tmp"2⤵
- Creates scheduled task(s)
PID:4404
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:1156
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD568c117db808a692b1e58fb482fda273e
SHA1423777b6dd74cb89ff5628b665739e1b4c2d1450
SHA2569e3c1f9172bc33701dcce6e6569352b341f72ac18ee8dfdb971c4135fc61a114
SHA51269aa718eb261b6fd252db543f6af41bd4f34de36aff40bce61663161ee998f88bb24cd60c8ffbd300ba2cfefd242d2bc5f4d26f35169a0a69d760947910c7dbb
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5860b89789084bcb4534bc4332c6074bf
SHA16d65d89e762b14628009c89325f1e9c7e2784d09
SHA2565364bd28c95a1431cca7c4d0634077c43e67bf1fd89b3ea33bb23c579278fe59
SHA5125c61440a3e374a2d48077ef43b256de6a9aebfe29f10122eb061b3ec31cc4d17617c212bf6e9680e0954c2a7791f640318a9aedc69748a6990a71c05f4a181a3