Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    22/09/2023, 14:55 UTC

General

  • Target

    DOC73287284262.bat.exe

  • Size

    527KB

  • MD5

    7957ee20f42e7158e0fd2cd73e17b436

  • SHA1

    aed7c6736ede54b4d4eda9ff3cbb8e510eef2a88

  • SHA256

    48e030cc0ca1af0e027949d1f16b86226e352065d9bf5eba4ca7719efe61b0cf

  • SHA512

    853ceb5c1465ff9ec2df913f898710795517f5ca7b787dc63e9b9483d72785311f954e886659dc7592ce74269b65fe93e958ffde4935cf2cc7625217dc0f8fff

  • SSDEEP

    12288:wuvgIb5G6uxzXlsjuapg2dKhtjWHmYZeIwEw:Zu52gDbYS

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.yandex.ru
  • Port:
    587
  • Username:
    uaemdx21@yandex.ru
  • Password:
    Chibuonyenze8888
  • Email To:
    uaemdx21@yandex.ru

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\DOC73287284262.bat.exe
    "C:\Users\Admin\AppData\Local\Temp\DOC73287284262.bat.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DaumicSuB" /XML "C:\Users\Admin\AppData\Local\Temp\tmp56D7.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2916
    • C:\Users\Admin\AppData\Local\Temp\DOC73287284262.bat.exe
      "{path}"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • outlook_office_path
      • outlook_win_path
      PID:2448

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp56D7.tmp

    Filesize

    1KB

    MD5

    c6acf04557eeeaf2f9f30bd35fde1514

    SHA1

    f46629ec4f77e895ebefe9be9de523aa42b0f32d

    SHA256

    6083800162d9edc69019539434973e151cb3deb57d9462f5ce7fa9e720f1e508

    SHA512

    e6110aad9e8d6fc5ad1e5adbbdff2ea5ea5eace59d55bda526e6abea526d000591274a66457882e0189fc988ebe08022fbbcc2021ab1a1a993da6332db61e256

  • memory/2296-0-0x0000000074960000-0x000000007504E000-memory.dmp

    Filesize

    6.9MB

  • memory/2296-1-0x0000000000E60000-0x0000000000EEA000-memory.dmp

    Filesize

    552KB

  • memory/2296-2-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

    Filesize

    256KB

  • memory/2296-3-0x0000000000440000-0x000000000044C000-memory.dmp

    Filesize

    48KB

  • memory/2296-4-0x0000000074960000-0x000000007504E000-memory.dmp

    Filesize

    6.9MB

  • memory/2296-5-0x0000000004EB0000-0x0000000004EF0000-memory.dmp

    Filesize

    256KB

  • memory/2296-6-0x0000000004E30000-0x0000000004EAC000-memory.dmp

    Filesize

    496KB

  • memory/2296-7-0x00000000042F0000-0x0000000004332000-memory.dmp

    Filesize

    264KB

  • memory/2296-25-0x0000000074960000-0x000000007504E000-memory.dmp

    Filesize

    6.9MB

  • memory/2448-12-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2448-13-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2448-19-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2448-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2448-15-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2448-21-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2448-23-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2448-24-0x0000000074960000-0x000000007504E000-memory.dmp

    Filesize

    6.9MB

  • memory/2448-26-0x0000000004CE0000-0x0000000004D20000-memory.dmp

    Filesize

    256KB

  • memory/2448-11-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2448-27-0x0000000074960000-0x000000007504E000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.