Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 15:00
Static task
static1
Behavioral task
behavioral1
Sample
SOA pdf.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
SOA pdf.exe
Resource
win10v2004-20230915-en
General
-
Target
SOA pdf.exe
-
Size
684KB
-
MD5
ef016c57887c795245f3c993844050b1
-
SHA1
a01a18332c13b3fea59c7ff5b2c0efe89811c5ee
-
SHA256
19e6653f249d7283999ba5be8b4154ccf64693cf228c7f7b4fde670f9fbed711
-
SHA512
ef833dda1825b56120174e8c79edb371ee6e3441b384d623d198e8968250bd7cc08c475c00cd30656d8300735c3da308019a9d1f10b8ff324ab054e409541b15
-
SSDEEP
12288:p4YpAfDuHOXEjxlubLoPpoL6HrOngIVGYm9qv28y6+Jz1g5:GYpgOjxlioxXHrOg89vRy62O
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
host2069.hostmonster.com - Port:
587 - Username:
[email protected] - Password:
me!@#!@#!@#!@# - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Control Panel\International\Geo\Nation SOA pdf.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\qXYojnj = "C:\\Users\\Admin\\AppData\\Roaming\\qXYojnj\\qXYojnj.exe" RegSvcs.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 43 api.ipify.org 44 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 116 set thread context of 4828 116 SOA pdf.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1984 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 116 SOA pdf.exe 116 SOA pdf.exe 116 SOA pdf.exe 116 SOA pdf.exe 116 SOA pdf.exe 116 SOA pdf.exe 116 SOA pdf.exe 4016 powershell.exe 2452 powershell.exe 116 SOA pdf.exe 116 SOA pdf.exe 116 SOA pdf.exe 4828 RegSvcs.exe 4828 RegSvcs.exe 2452 powershell.exe 4016 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 116 SOA pdf.exe Token: SeDebugPrivilege 2452 powershell.exe Token: SeDebugPrivilege 4016 powershell.exe Token: SeDebugPrivilege 4828 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 116 wrote to memory of 2452 116 SOA pdf.exe 94 PID 116 wrote to memory of 2452 116 SOA pdf.exe 94 PID 116 wrote to memory of 2452 116 SOA pdf.exe 94 PID 116 wrote to memory of 4016 116 SOA pdf.exe 96 PID 116 wrote to memory of 4016 116 SOA pdf.exe 96 PID 116 wrote to memory of 4016 116 SOA pdf.exe 96 PID 116 wrote to memory of 1984 116 SOA pdf.exe 98 PID 116 wrote to memory of 1984 116 SOA pdf.exe 98 PID 116 wrote to memory of 1984 116 SOA pdf.exe 98 PID 116 wrote to memory of 4704 116 SOA pdf.exe 100 PID 116 wrote to memory of 4704 116 SOA pdf.exe 100 PID 116 wrote to memory of 4704 116 SOA pdf.exe 100 PID 116 wrote to memory of 4828 116 SOA pdf.exe 101 PID 116 wrote to memory of 4828 116 SOA pdf.exe 101 PID 116 wrote to memory of 4828 116 SOA pdf.exe 101 PID 116 wrote to memory of 4828 116 SOA pdf.exe 101 PID 116 wrote to memory of 4828 116 SOA pdf.exe 101 PID 116 wrote to memory of 4828 116 SOA pdf.exe 101 PID 116 wrote to memory of 4828 116 SOA pdf.exe 101 PID 116 wrote to memory of 4828 116 SOA pdf.exe 101 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-1045988481-1457812719-2617974652-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SOA pdf.exe"C:\Users\Admin\AppData\Local\Temp\SOA pdf.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SOA pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OIeSyIYJ.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4016
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OIeSyIYJ" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3D71.tmp"2⤵
- Creates scheduled task(s)
PID:1984
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:4704
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4828
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
18KB
MD525f564cd2ab34171d8c6579daad596ac
SHA1284e14b4705b8879f04af5e240cc7d26f228dce9
SHA2564858cb7f6aed8c1ad18908132427834244a2651c674aefdbc38957159c2d6812
SHA512669c86236e1d3e1952fd3b0d252f16358e6271b03a6ed11e1b96a8afdc09c10c92187aa144ed5ae567a2e9a87eb3972948f499d2070d0fe08d2e07baefce150a
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5d595d719475eda2b7bd1a350eff4d581
SHA16e501369d77c86db1df964579ec02a1601d0e330
SHA2563d4ad57a294b831416a049987249e252baeeccb630a28acc056c8c0c050dedb2
SHA512d4abdd7439505e685f640ce19463a11a4338edd7aa0286087bf1ba2fef80a2c3ca5928221abc33c15624920999ed117f903174bb8b9288f0563a1088ada97daf