Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
06/10/2023, 12:09
Static task
static1
Behavioral task
behavioral1
Sample
02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe
-
Size
958KB
-
MD5
289e55682a143b7520cf82f16305a54f
-
SHA1
2cda815c055ebdda4d4dd812176f89acad5d6300
-
SHA256
02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab
-
SHA512
8a4cab565a12e4c0bd599de27db5cf0254d5ea4e5cb30d7610baba5967cb7cdab693224710440cdce4b50bc9e1c0778386883d91ba14dd48eddb855b072d3c1a
-
SSDEEP
12288:VM+ZDpsy8NLgmHCViuUxIZb/iPLq/rjI4rGbz9/b:Vsy8WWCEIZb/iD23I4rGV/
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
smtp.yandex.com - Port:
587 - Username:
[email protected] - Password:
uikstcmljdzhturh - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2104 set thread context of 2520 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 36 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2648 ipconfig.exe 2504 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2520 aspnet_compiler.exe 2520 aspnet_compiler.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2520 aspnet_compiler.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2520 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 2104 wrote to memory of 3012 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 28 PID 2104 wrote to memory of 3012 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 28 PID 2104 wrote to memory of 3012 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 28 PID 2104 wrote to memory of 3012 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 28 PID 3012 wrote to memory of 2648 3012 cmd.exe 30 PID 3012 wrote to memory of 2648 3012 cmd.exe 30 PID 3012 wrote to memory of 2648 3012 cmd.exe 30 PID 3012 wrote to memory of 2648 3012 cmd.exe 30 PID 2104 wrote to memory of 1716 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 33 PID 2104 wrote to memory of 1716 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 33 PID 2104 wrote to memory of 1716 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 33 PID 2104 wrote to memory of 1716 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 33 PID 1716 wrote to memory of 2504 1716 cmd.exe 35 PID 1716 wrote to memory of 2504 1716 cmd.exe 35 PID 1716 wrote to memory of 2504 1716 cmd.exe 35 PID 1716 wrote to memory of 2504 1716 cmd.exe 35 PID 2104 wrote to memory of 2520 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 36 PID 2104 wrote to memory of 2520 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 36 PID 2104 wrote to memory of 2520 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 36 PID 2104 wrote to memory of 2520 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 36 PID 2104 wrote to memory of 2520 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 36 PID 2104 wrote to memory of 2520 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 36 PID 2104 wrote to memory of 2520 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 36 PID 2104 wrote to memory of 2520 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 36 PID 2104 wrote to memory of 2520 2104 02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe 36 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-86725733-3001458681-3405935542-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe"C:\Users\Admin\AppData\Local\Temp\02e565314622beca0b16e1c731549262b2b22e4bf3bef691d23991cebf94bfab_JC.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /release2⤵
- Suspicious use of WriteProcessMemory
PID:3012 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /release3⤵
- Gathers network information
PID:2648
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ipconfig /renew2⤵
- Suspicious use of WriteProcessMemory
PID:1716 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /renew3⤵
- Gathers network information
PID:2504
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:2520
-