Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2023, 13:18

General

  • Target

    POexe.exe

  • Size

    609KB

  • MD5

    3f7a1be06f9e81b2a64cd84dbf00039d

  • SHA1

    adb70d3b81ac28fbb3b277fe7e75bdbd52ebada0

  • SHA256

    c95706e9e36c1532f18cb25f4f98abab9164da9cfd25965f76ee3187dd95494e

  • SHA512

    aeef19e54d7bf1c1071c1ba8585a3a8b010dbb5b43d04f65733f6b07030ed582563a6dd95898140ba45e70623c9bd564ddd4f6169136f4bdcb9528f5204f20fc

  • SSDEEP

    12288:5/DzR6Raa0ydviUOqk+AwvW/TBAIKmbx/1G18Zx4m:ZsRaa0jUK+Aw+/1AIKmx1NZx4m

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot5757748605:AAHI9rc9CYWMivLuImcQ_ENpJzN7mD9DYis/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\POexe.exe
    "C:\Users\Admin\AppData\Local\Temp\POexe.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4364
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\POexe.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1544
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\tFNfTrEp.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1008
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\tFNfTrEp" /XML "C:\Users\Admin\AppData\Local\Temp\tmp21EB.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:3648
    • C:\Users\Admin\AppData\Local\Temp\POexe.exe
      "C:\Users\Admin\AppData\Local\Temp\POexe.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1680

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    31d7cc7953c3a0f7a22d956bf0faf8d9

    SHA1

    a4bd7e97f17db1cdaea7812a1c4e8c9777cbfefb

    SHA256

    5a4a3926fe89843fcb4371887325ecb025573f55f7e0d93a93a8038b7886b2f4

    SHA512

    bb8c6730ec8cb27c9bb0770bba87bf3d46817e11fe7a02e587e8d4f2fd40e5ea35900da21d5de5083d3eeb524e21fb64cb0258879299258b109cd8a4fc6d6605

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ugq4mv5v.k33.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmp21EB.tmp

    Filesize

    1KB

    MD5

    d1de92dabb48c8c296e60f965e01041d

    SHA1

    ae2bacd5aa6a6b234579bdc62f402d2b1a7230a5

    SHA256

    8eea20f00dd65adada1313e2443ac038b007f5baf630e651ed204ed2aef5cf8c

    SHA512

    c2f34bb1c96a993b827ed3f69a8a69c32d35738981d49048f1e410ab94b8b6785c5834bf618a82892724e71be778e8c788de9a985587966df298139c747d7884

  • memory/1008-173-0x0000000006770000-0x000000000678E000-memory.dmp

    Filesize

    120KB

  • memory/1008-174-0x0000000002E70000-0x0000000002E80000-memory.dmp

    Filesize

    64KB

  • memory/1008-208-0x0000000007DB0000-0x0000000007DB8000-memory.dmp

    Filesize

    32KB

  • memory/1008-207-0x0000000007DD0000-0x0000000007DEA000-memory.dmp

    Filesize

    104KB

  • memory/1008-145-0x00000000058A0000-0x0000000005EC8000-memory.dmp

    Filesize

    6.2MB

  • memory/1008-178-0x0000000002E70000-0x0000000002E80000-memory.dmp

    Filesize

    64KB

  • memory/1008-147-0x0000000005F00000-0x0000000005F22000-memory.dmp

    Filesize

    136KB

  • memory/1008-205-0x000000007FC30000-0x000000007FC40000-memory.dmp

    Filesize

    64KB

  • memory/1008-204-0x0000000007D10000-0x0000000007DA6000-memory.dmp

    Filesize

    600KB

  • memory/1008-202-0x00000000080D0000-0x000000000874A000-memory.dmp

    Filesize

    6.5MB

  • memory/1008-191-0x0000000071930000-0x000000007197C000-memory.dmp

    Filesize

    304KB

  • memory/1008-175-0x0000000002E70000-0x0000000002E80000-memory.dmp

    Filesize

    64KB

  • memory/1544-148-0x0000000006220000-0x0000000006286000-memory.dmp

    Filesize

    408KB

  • memory/1544-160-0x0000000006290000-0x00000000062F6000-memory.dmp

    Filesize

    408KB

  • memory/1544-171-0x00000000054B0000-0x00000000054C0000-memory.dmp

    Filesize

    64KB

  • memory/1544-144-0x0000000002FE0000-0x0000000003016000-memory.dmp

    Filesize

    216KB

  • memory/1544-206-0x0000000007E40000-0x0000000007E4E000-memory.dmp

    Filesize

    56KB

  • memory/1544-177-0x00000000054B0000-0x00000000054C0000-memory.dmp

    Filesize

    64KB

  • memory/1544-203-0x0000000007C80000-0x0000000007C8A000-memory.dmp

    Filesize

    40KB

  • memory/1544-179-0x0000000071930000-0x000000007197C000-memory.dmp

    Filesize

    304KB

  • memory/1544-172-0x00000000054B0000-0x00000000054C0000-memory.dmp

    Filesize

    64KB

  • memory/1544-180-0x000000007FA30000-0x000000007FA40000-memory.dmp

    Filesize

    64KB

  • memory/1544-190-0x0000000007860000-0x000000000787E000-memory.dmp

    Filesize

    120KB

  • memory/1544-176-0x0000000007880000-0x00000000078B2000-memory.dmp

    Filesize

    200KB

  • memory/1544-201-0x0000000007C10000-0x0000000007C2A000-memory.dmp

    Filesize

    104KB

  • memory/1680-155-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/1680-170-0x0000000004D60000-0x0000000004D70000-memory.dmp

    Filesize

    64KB

  • memory/1680-215-0x00000000069C0000-0x0000000006A10000-memory.dmp

    Filesize

    320KB

  • memory/1680-216-0x0000000006BE0000-0x0000000006DA2000-memory.dmp

    Filesize

    1.8MB

  • memory/1680-217-0x0000000004D60000-0x0000000004D70000-memory.dmp

    Filesize

    64KB

  • memory/4364-137-0x0000000005A30000-0x0000000005A3A000-memory.dmp

    Filesize

    40KB

  • memory/4364-138-0x0000000005AB0000-0x0000000005AC0000-memory.dmp

    Filesize

    64KB

  • memory/4364-136-0x0000000005AB0000-0x0000000005AC0000-memory.dmp

    Filesize

    64KB

  • memory/4364-133-0x0000000000F10000-0x0000000000FAE000-memory.dmp

    Filesize

    632KB

  • memory/4364-139-0x000000000AFB0000-0x000000000B04C000-memory.dmp

    Filesize

    624KB

  • memory/4364-135-0x0000000005860000-0x00000000058F2000-memory.dmp

    Filesize

    584KB

  • memory/4364-134-0x0000000005D30000-0x00000000062D4000-memory.dmp

    Filesize

    5.6MB