Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 19:56
Static task
static1
Behavioral task
behavioral1
Sample
AJG2023031161.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
AJG2023031161.exe
Resource
win10v2004-20230703-en
General
-
Target
AJG2023031161.exe
-
Size
852KB
-
MD5
6cc6924c78fdcb06383af80e97539df9
-
SHA1
7418239bc287b32a2243bbad661aecd75f7176c9
-
SHA256
229409f294f2a7102935d415228ff716f06746e313c4d058821a0397518213ad
-
SHA512
21b5324a83bbb8904ba43e292d7bfccfb16a059ee9d140614cd6ce397d93b0755b775477056ff7611ebe032fa3024f0577e52a8512d5566329bd9ccc7e8278f1
-
SSDEEP
12288:BB5KrzwXNvOQlR7RHdhjmC/MVKKGameOrrqTxlaTKnHXlVXQi:BOrsXNmyR7R9Fmx8ameO6BHXlJQi
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.sirisexpress.com - Port:
587 - Username:
[email protected] - Password:
SirisEmails@123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Cmddqar = "C:\\Users\\Admin\\AppData\\Roaming\\Cmddqar.exe" AJG2023031161.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 24 api.ipify.org 25 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 544 set thread context of 456 544 AJG2023031161.exe 89 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 456 MSBuild.exe 456 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 544 AJG2023031161.exe Token: SeDebugPrivilege 456 MSBuild.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 544 wrote to memory of 456 544 AJG2023031161.exe 89 PID 544 wrote to memory of 456 544 AJG2023031161.exe 89 PID 544 wrote to memory of 456 544 AJG2023031161.exe 89 PID 544 wrote to memory of 456 544 AJG2023031161.exe 89 PID 544 wrote to memory of 456 544 AJG2023031161.exe 89 PID 544 wrote to memory of 456 544 AJG2023031161.exe 89 PID 544 wrote to memory of 456 544 AJG2023031161.exe 89 PID 544 wrote to memory of 456 544 AJG2023031161.exe 89 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-4176143399-3250363947-192774652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\AJG2023031161.exe"C:\Users\Admin\AppData\Local\Temp\AJG2023031161.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:544 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:456
-