Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
170s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
-
submitted
24/08/2023, 13:52
General
-
Target
97fd0ea2f2ebe8dc9decafa546e62a5225feca31893c1e1dd820540d4211a594.exe
-
Size
701KB
-
MD5
81d1d9cf8554391462923fb0cc59bd99
-
SHA1
85a80bd672c95adf95a846d9866376b06607c0ef
-
SHA256
97fd0ea2f2ebe8dc9decafa546e62a5225feca31893c1e1dd820540d4211a594
-
SHA512
8084b99f3fa4f2a66b4b24d76711c8300db6ffeccc75eaca5f8dc7a379a6055b5bef0f104e32f3b525a8a61ebdd23aac1a012f3e7b594152847e15fbe9987547
-
SSDEEP
12288:2Iql3qaz3KVcgN72g1g361TEp+N/NpiJna7QMaF/90Qhtz3VU60S9bjGP:6NjuqM72g1gcI0N/WEpS9qzwbj
Malware Config
Extracted
Protocol: smtp- Host:
mail.pingente.pt - Port:
587 - Username:
[email protected] - Password:
Pingente#2o21
Extracted
agenttesla
Protocol: smtp- Host:
mail.pingente.pt - Port:
587 - Username:
[email protected] - Password:
Pingente#2o21 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\97fd0ea2f2ebe8dc9decafa546e62a5225feca31893c1e1dd820540d4211a594.exe"C:\Users\Admin\AppData\Local\Temp\97fd0ea2f2ebe8dc9decafa546e62a5225feca31893c1e1dd820540d4211a594.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\97fd0ea2f2ebe8dc9decafa546e62a5225feca31893c1e1dd820540d4211a594.exe"C:\Users\Admin\AppData\Local\Temp\97fd0ea2f2ebe8dc9decafa546e62a5225feca31893c1e1dd820540d4211a594.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e56ec378251cd65923ad88c1e14d0b6e
SHA17f5d986e0a34dd81487f6439fb0446ffa52a712e
SHA25632ccf567c07b62b6078cf03d097e21cbf7ef67a4ce312c9c34a47f865b3ad0a0
SHA5122737a622ca45b532aebc202184b3e35cde8684e5296cb1f008e7831921be2895a43f952c1df88d33011a7b9586aafbd88483f6c134cb5e8e98c236f5abb5f3aa
-
Filesize
163KB
MD519399ab248018076e27957e772bcfbab
SHA1faef897e02d9501146beb49f75da1caf12967b88
SHA256326842dd8731e37c8c27a08373c7ac341e6c72226cc850084e3a17d26675f3c9
SHA5126d5b12ec637ef4223fdd0e271cdc9f860b060ff08d380bba546ac6962b1d672003f9ae9556d65282d8083e830d4277bad8d16443720716077e542ab0262b0103
-
Filesize
6.9MB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
104KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
48KB
-
Filesize
56KB
-
Filesize
504KB
-
Filesize
720KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
272KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
272KB
-
Filesize
4KB