Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
04/07/2023, 19:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Quotation.exe
Resource
win7-20230703-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
Quotation.exe
Resource
win10v2004-20230703-en
9 signatures
150 seconds
General
-
Target
Quotation.exe
-
Size
831KB
-
MD5
0b01741f707a7204f673814ed3257bd0
-
SHA1
e3a26c4e967ea85eeb07bede52ad99d07b1f5258
-
SHA256
e3a4d27630c1d1f5f57a8d490047380ffd6f813b6ffa9eb554632ac915a61447
-
SHA512
be5c717978de2422c6b227fca411a3da058429546502f1911cc2a85c11d2b4b0ea858e8d0f3ca5bc1d3c5a6da3378190e2e676157299777e0edb01c297ed428a
-
SSDEEP
12288:cfGb3nsa9x1LsqbkGweSJ3hs0bUZEZ1BthUhCmdjRlilfa6PkQ4:UGwJ3hfbUyt0lOc77
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: smtp- Host:
sh003.webhostbox.net - Port:
587 - Username:
[email protected] - Password:
bl e ss ing 2 0 2 3 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2312 set thread context of 1416 2312 Quotation.exe 28 -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2312 Quotation.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2312 Quotation.exe Token: SeDebugPrivilege 1416 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2312 wrote to memory of 1416 2312 Quotation.exe 28 PID 2312 wrote to memory of 1416 2312 Quotation.exe 28 PID 2312 wrote to memory of 1416 2312 Quotation.exe 28 PID 2312 wrote to memory of 1416 2312 Quotation.exe 28 PID 2312 wrote to memory of 1416 2312 Quotation.exe 28 PID 2312 wrote to memory of 1416 2312 Quotation.exe 28 PID 2312 wrote to memory of 1416 2312 Quotation.exe 28 PID 2312 wrote to memory of 1416 2312 Quotation.exe 28 PID 2312 wrote to memory of 1416 2312 Quotation.exe 28 PID 2312 wrote to memory of 1416 2312 Quotation.exe 28 PID 2312 wrote to memory of 1416 2312 Quotation.exe 28 PID 2312 wrote to memory of 1416 2312 Quotation.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Quotation.exe"C:\Users\Admin\AppData\Local\Temp\Quotation.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2312 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1416
-