Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    23/09/2023, 18:31

General

  • Target

    2ce23f32cc6773a978869f6ace53a7ea4a441cab0ebb6ee0063faa57c6fe1625_JC.exe

  • Size

    1.1MB

  • MD5

    e4dfaeb7ee5b3d01dd0ff54126c325eb

  • SHA1

    e6435975d7435e5f34fbdb0ea131fc79dfd2f303

  • SHA256

    2ce23f32cc6773a978869f6ace53a7ea4a441cab0ebb6ee0063faa57c6fe1625

  • SHA512

    dedba1c417dbd18cbf6362a334e8e54c58b3a962530f1794cc98d237f73d9383b1cc358554a7c85fc435cb8c1466fc347dd0e74cd1876973db657cdb166aaf75

  • SSDEEP

    24576:g/1L51LBQ+R9ibYTFqwXpZJsLTnaPkohHm02I3bdP:g/ZDn9IGAMZ6Xem0r3bd

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2ce23f32cc6773a978869f6ace53a7ea4a441cab0ebb6ee0063faa57c6fe1625_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2ce23f32cc6773a978869f6ace53a7ea4a441cab0ebb6ee0063faa57c6fe1625_JC.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2196
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\2ce23f32cc6773a978869f6ace53a7ea4a441cab0ebb6ee0063faa57c6fe1625_JC.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2984
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aOrmFO.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2836
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aOrmFO" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF00A.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2756
    • C:\Users\Admin\AppData\Local\Temp\2ce23f32cc6773a978869f6ace53a7ea4a441cab0ebb6ee0063faa57c6fe1625_JC.exe
      "C:\Users\Admin\AppData\Local\Temp\2ce23f32cc6773a978869f6ace53a7ea4a441cab0ebb6ee0063faa57c6fe1625_JC.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2732

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpF00A.tmp

    Filesize

    1KB

    MD5

    a10b6fe2f042429574ffcc5577fc47a6

    SHA1

    e4fa9a788076404a0809e5f4b130971e0b3b30e1

    SHA256

    a2d5d0915c04f595a1a24e6dfea71760ef3fbdac807fbffc6e8e7dd7c6e0ff8f

    SHA512

    c4a6312ccd3ee4209a44daa8315374c3795b755a715c44da0ada4e4d57a2d44fffd55a849d9f724af0b3a9a989c8d7b632ab6d0ad55b801a74f299ab85c15084

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YLVY8DE8MMQOU94XGHAC.temp

    Filesize

    7KB

    MD5

    144146cd4f666139d83e509d5318dc63

    SHA1

    870fd6abe1b1d20ed0b67486eabcf00705aa5e89

    SHA256

    184580f54687446f00964620f30e26d23b934ea64edef0db243e8c3bc4a35d15

    SHA512

    c6798eff7bceb705801f3e2043542e9178e0070dd531413be76dfe0e634def416a25b62bc282b736309ade6c02de244360098a9cfc29010e28a9bcfea82790c7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    144146cd4f666139d83e509d5318dc63

    SHA1

    870fd6abe1b1d20ed0b67486eabcf00705aa5e89

    SHA256

    184580f54687446f00964620f30e26d23b934ea64edef0db243e8c3bc4a35d15

    SHA512

    c6798eff7bceb705801f3e2043542e9178e0070dd531413be76dfe0e634def416a25b62bc282b736309ade6c02de244360098a9cfc29010e28a9bcfea82790c7

  • memory/2196-3-0x0000000000440000-0x0000000000452000-memory.dmp

    Filesize

    72KB

  • memory/2196-4-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2196-5-0x00000000073B0000-0x00000000073F0000-memory.dmp

    Filesize

    256KB

  • memory/2196-6-0x0000000000590000-0x0000000000598000-memory.dmp

    Filesize

    32KB

  • memory/2196-7-0x00000000005A0000-0x00000000005AC000-memory.dmp

    Filesize

    48KB

  • memory/2196-8-0x0000000007320000-0x000000000739C000-memory.dmp

    Filesize

    496KB

  • memory/2196-0-0x0000000000950000-0x0000000000A78000-memory.dmp

    Filesize

    1.2MB

  • memory/2196-35-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2196-2-0x00000000073B0000-0x00000000073F0000-memory.dmp

    Filesize

    256KB

  • memory/2196-1-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2732-28-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2732-26-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2732-25-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2732-23-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2732-30-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2732-32-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2732-34-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2732-21-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2732-46-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2732-42-0x0000000074640000-0x0000000074D2E000-memory.dmp

    Filesize

    6.9MB

  • memory/2836-41-0x00000000024A0000-0x00000000024E0000-memory.dmp

    Filesize

    256KB

  • memory/2836-40-0x000000006F350000-0x000000006F8FB000-memory.dmp

    Filesize

    5.7MB

  • memory/2836-39-0x00000000024A0000-0x00000000024E0000-memory.dmp

    Filesize

    256KB

  • memory/2836-45-0x000000006F350000-0x000000006F8FB000-memory.dmp

    Filesize

    5.7MB

  • memory/2836-36-0x000000006F350000-0x000000006F8FB000-memory.dmp

    Filesize

    5.7MB

  • memory/2984-38-0x0000000002680000-0x00000000026C0000-memory.dmp

    Filesize

    256KB

  • memory/2984-37-0x000000006F350000-0x000000006F8FB000-memory.dmp

    Filesize

    5.7MB

  • memory/2984-43-0x000000006F350000-0x000000006F8FB000-memory.dmp

    Filesize

    5.7MB

  • memory/2984-44-0x000000006F350000-0x000000006F8FB000-memory.dmp

    Filesize

    5.7MB