Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

24/07/2023, 06:32

230724-haylwaag65 10

16/07/2023, 18:15

230716-wwbacshb7z 10

Analysis

  • max time kernel
    137s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/07/2023, 06:32

General

  • Target

    1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67.exe

  • Size

    898KB

  • MD5

    02cc74d9cac7d52bf1c63c43f017bcee

  • SHA1

    3ac771f8343e45ac63b5802535d179b2f574532c

  • SHA256

    1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67

  • SHA512

    98f15f8de33757d52d408690880eb7c2425274433ca9c0c315edb7451b73a701f0aa02012c04d9b0fb7392e7b986ae01a87acb40b94a9bb7fdd59da9e4e9c646

  • SSDEEP

    24576:QIhzYOPW2rEloDwdMRHP4/LBmf74RWoJ:wOzrsocdMRv4/LW74RWoJ

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    IZmBVEm3

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    IZmBVEm3

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67.exe
    "C:\Users\Admin\AppData\Local\Temp\1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:868
    • C:\Users\Admin\AppData\Local\Temp\1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67.exe
      "{path}"
      2⤵
        PID:1632
      • C:\Users\Admin\AppData\Local\Temp\1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67.exe
        "{path}"
        2⤵
        • Accesses Microsoft Outlook profiles
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        • outlook_office_path
        • outlook_win_path
        PID:3904

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1b7f039e2beb71993aa281ed8137e45b1b9708531b54e3b46d347baa3cc6fc67.exe.log

      Filesize

      507B

      MD5

      ab4c71d3ff6255edd4e5c1e09540f49e

      SHA1

      22e06bf4e258741b5df918061871cba998c50cea

      SHA256

      1690fec628f775dd3c3385b800eed126b37978ef2ffd592b024052724caafb5a

      SHA512

      8fa7d0045796e6cda7c28e2b9a690ef550619828c1b5d0ebf8e8367aff4bf4d9f63121e5b4f199d30cb8006eb584c6767f4c59150749b8256dab9dd0ebd9f1af

    • memory/868-137-0x0000000074DA0000-0x0000000075550000-memory.dmp

      Filesize

      7.7MB

    • memory/868-135-0x0000000007DC0000-0x0000000007E5C000-memory.dmp

      Filesize

      624KB

    • memory/868-136-0x0000000007F50000-0x0000000007FE2000-memory.dmp

      Filesize

      584KB

    • memory/868-133-0x0000000074DA0000-0x0000000075550000-memory.dmp

      Filesize

      7.7MB

    • memory/868-138-0x0000000007F40000-0x0000000007F50000-memory.dmp

      Filesize

      64KB

    • memory/868-139-0x0000000008BC0000-0x0000000009164000-memory.dmp

      Filesize

      5.6MB

    • memory/868-143-0x0000000074DA0000-0x0000000075550000-memory.dmp

      Filesize

      7.7MB

    • memory/868-134-0x0000000000E80000-0x0000000000F68000-memory.dmp

      Filesize

      928KB

    • memory/3904-145-0x0000000005800000-0x0000000005810000-memory.dmp

      Filesize

      64KB

    • memory/3904-140-0x0000000000400000-0x000000000044C000-memory.dmp

      Filesize

      304KB

    • memory/3904-144-0x0000000074DA0000-0x0000000075550000-memory.dmp

      Filesize

      7.7MB

    • memory/3904-146-0x0000000074DA0000-0x0000000075550000-memory.dmp

      Filesize

      7.7MB

    • memory/3904-147-0x0000000005800000-0x0000000005810000-memory.dmp

      Filesize

      64KB

    • memory/3904-148-0x0000000006390000-0x00000000063F6000-memory.dmp

      Filesize

      408KB

    • memory/3904-150-0x0000000006AD0000-0x0000000006B20000-memory.dmp

      Filesize

      320KB

    • memory/3904-151-0x0000000005800000-0x0000000005810000-memory.dmp

      Filesize

      64KB

    • memory/3904-152-0x0000000006D80000-0x0000000006D8A000-memory.dmp

      Filesize

      40KB

    • memory/3904-153-0x0000000005800000-0x0000000005810000-memory.dmp

      Filesize

      64KB