Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230712-en
  • resource tags

    arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
  • submitted
    18/07/2023, 07:25

General

  • Target

    tmpsizlv9u4.exe

  • Size

    962KB

  • MD5

    4cfe2fae86fb8cce535fbd2234b46c82

  • SHA1

    6ab470e2699bcd59ce5333343ed4980a6a82ac75

  • SHA256

    c79294073204cc9a6fe6ed0559bc939ccca1cd4855603a2b62a480428af7a38e

  • SHA512

    1fc2a60ef8cda806e0a7008507654c5cb93759bdb20690e635a5c1cbb63850fb077726db641f914d039e51579cf4e0674b34882d53249eef9175e971769a90c6

  • SSDEEP

    24576:9k70TrcfEZKYEs67FIq9Wk95pbSwwp4JtW5Xj/x/+dprPgMPWEOkp:9kQTAfEZqsoFIOX3pbZwp4JtM/x/cYYd

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmpsizlv9u4.exe
    "C:\Users\Admin\AppData\Local\Temp\tmpsizlv9u4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2500
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2352

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2352-75-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2352-67-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2352-79-0x0000000004D70000-0x0000000004DB0000-memory.dmp

    Filesize

    256KB

  • memory/2352-78-0x00000000737E0000-0x0000000073ECE000-memory.dmp

    Filesize

    6.9MB

  • memory/2352-77-0x0000000004D70000-0x0000000004DB0000-memory.dmp

    Filesize

    256KB

  • memory/2352-63-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2352-76-0x00000000737E0000-0x0000000073ECE000-memory.dmp

    Filesize

    6.9MB

  • memory/2352-61-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2352-65-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2352-72-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2352-69-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2352-70-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2500-59-0x0000000004A30000-0x0000000004B1C000-memory.dmp

    Filesize

    944KB

  • memory/2500-55-0x0000000073ED0000-0x00000000745BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2500-74-0x0000000073ED0000-0x00000000745BE000-memory.dmp

    Filesize

    6.9MB

  • memory/2500-54-0x0000000004BA0000-0x0000000004C8E000-memory.dmp

    Filesize

    952KB

  • memory/2500-60-0x0000000001EF0000-0x0000000001F02000-memory.dmp

    Filesize

    72KB

  • memory/2500-58-0x0000000004B60000-0x0000000004BA0000-memory.dmp

    Filesize

    256KB

  • memory/2500-57-0x0000000004B60000-0x0000000004BA0000-memory.dmp

    Filesize

    256KB

  • memory/2500-56-0x0000000004B60000-0x0000000004BA0000-memory.dmp

    Filesize

    256KB