Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    146s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2023, 14:12

General

  • Target

    file.exe

  • Size

    87KB

  • MD5

    51594d6b7e82c4971ded4889197cc587

  • SHA1

    f5271aa81fdd5fdad6c385b691788bb66bc576eb

  • SHA256

    b2e3994ebb72e0dccce7114c073f2917889fa09a3036d21a0f7a8b715ea77a8d

  • SHA512

    e22cca36abd573cdd3cab9a94def51a38be75b412b2d0b093c9312f7d45912f3c8645c386be218404715810fbfc65291f0b2d8fec34751e11667e8c0ebd88368

  • SSDEEP

    1536:IkS07t1MVRZo4lgQ4Bj4ozyXt3sydyc4F9nY++cq7EQQ9dcfS95ct4KY6lLiHnJH:5SY8Vi23tmFpJq7OcS95c7leHR

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6381763542:AAGPjs0vqAwhS1NRGwd5klpiWT8aP65rMm4/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Drops startup file 1 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Drops startup file
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Users\Admin\AppData\Local\Temp\file.exe
      C:\Users\Admin\AppData\Local\Temp\file.exe
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:1888

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\file.exe.log

    Filesize

    1KB

    MD5

    a13312e452bb67b8b110b6d7fbc6cf6f

    SHA1

    057c5cc1d9b4c48eb1cb78463d8d7599f8fd8a50

    SHA256

    d5e1315b62697659a967e9aaac291e96ab9cc7d90bab47bc30e6c338a81f479b

    SHA512

    1e60ceb2af03e9eb8a347bf0ae2e57601ca82e51ec14962eba368393da46f939ff0429d54d59c8a90fbc8f32ed71c880634e0239ccc26c86c40496acdac7b9b0

  • memory/1888-1472-0x0000000005220000-0x0000000005230000-memory.dmp

    Filesize

    64KB

  • memory/1888-1471-0x0000000006820000-0x000000000682A000-memory.dmp

    Filesize

    40KB

  • memory/1888-1470-0x0000000006680000-0x0000000006712000-memory.dmp

    Filesize

    584KB

  • memory/1888-1469-0x0000000006590000-0x00000000065E0000-memory.dmp

    Filesize

    320KB

  • memory/1888-1468-0x0000000005220000-0x0000000005230000-memory.dmp

    Filesize

    64KB

  • memory/1888-1467-0x0000000004F00000-0x0000000004F66000-memory.dmp

    Filesize

    408KB

  • memory/1888-1466-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2304-173-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-183-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-147-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-151-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-153-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-155-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-157-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-159-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-161-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-163-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-165-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-167-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-169-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-171-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-133-0x0000000000300000-0x000000000031C000-memory.dmp

    Filesize

    112KB

  • memory/2304-175-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-177-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-179-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-181-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-149-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-185-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-187-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-189-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-191-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-193-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-195-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-197-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-199-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-1458-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB

  • memory/2304-1459-0x0000000005650000-0x0000000005651000-memory.dmp

    Filesize

    4KB

  • memory/2304-1460-0x0000000006D00000-0x00000000072A4000-memory.dmp

    Filesize

    5.6MB

  • memory/2304-145-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-143-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-141-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-139-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-137-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-136-0x00000000060A0000-0x0000000006177000-memory.dmp

    Filesize

    860KB

  • memory/2304-135-0x00000000061C0000-0x00000000061E2000-memory.dmp

    Filesize

    136KB

  • memory/2304-134-0x0000000004DC0000-0x0000000004DD0000-memory.dmp

    Filesize

    64KB