Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20231020-en
  • resource tags

    arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
  • submitted
    18/11/2023, 02:48

General

  • Target

    INV and PAK.exe

  • Size

    884KB

  • MD5

    7407a2849f0a33f95b2b27b48415e9be

  • SHA1

    8544e9fdc67a0635c155756eb346080b61c6f4a0

  • SHA256

    3c5e1993db8f454b72132cc7dd4b9180dccaa415b2fa9d0c8d55f768ebeffab4

  • SHA512

    df28bafd79322959c6644246211d7dfb120f6b820fecc94e883f6f3efbb5fcc564574dfdcb068c1accd906fcf99ce73495ab374c530941d0290d375bafcffef7

  • SSDEEP

    12288:hO71EuPUpEZA/jGrOrt5KC4uvBHWwWvtmLMdhovYOtk3Gr:ha1XUpE2GrcXKCFWwWv0vG

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\INV and PAK.exe
    "C:\Users\Admin\AppData\Local\Temp\INV and PAK.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:796
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\INV and PAK.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2024
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\uqumkjYYrsC.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2808
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\uqumkjYYrsC" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA5A2.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2820
    • C:\Users\Admin\AppData\Local\Temp\INV and PAK.exe
      "C:\Users\Admin\AppData\Local\Temp\INV and PAK.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2660

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpA5A2.tmp

    Filesize

    1KB

    MD5

    287c1cba56264269b4ee04805506d46a

    SHA1

    fe0a758c51268eaab592f3e966c0c85a2f2b0757

    SHA256

    8ebaf9beedc77e57ab76ec93db217ad1bba6f178820f04fa1a45a76620804d1f

    SHA512

    1d7fe55df7fd28f98fb97c8a3c16af6129e7a6d499c119843a8f76ef24c6e02e46134bbb7502acccdc3f1df92d0ba96e0cf9b5135e1781d400860ab542031e50

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\JFJ2HYSWNAHOZPP83NDG.temp

    Filesize

    7KB

    MD5

    2c6383ddc4488e514be5c72fb3ac2fea

    SHA1

    338f63446c7f7296a434ebba13bc246bfb20f1f6

    SHA256

    c8beab0d795ecd7ddbc5039e1ae7991fba1633ad3835c01cce298b2829efe3a7

    SHA512

    f0e9de0b85b8d7a960bd36cc243dedab1b18cc6a69bcb55b0cf737987be21053d8309322f78ff045d5f09877b0f33001a078b4181aa6821056d595f748a79e4e

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    2c6383ddc4488e514be5c72fb3ac2fea

    SHA1

    338f63446c7f7296a434ebba13bc246bfb20f1f6

    SHA256

    c8beab0d795ecd7ddbc5039e1ae7991fba1633ad3835c01cce298b2829efe3a7

    SHA512

    f0e9de0b85b8d7a960bd36cc243dedab1b18cc6a69bcb55b0cf737987be21053d8309322f78ff045d5f09877b0f33001a078b4181aa6821056d595f748a79e4e

  • memory/796-4-0x0000000000500000-0x000000000050A000-memory.dmp

    Filesize

    40KB

  • memory/796-19-0x0000000004EF0000-0x0000000004F30000-memory.dmp

    Filesize

    256KB

  • memory/796-5-0x0000000005C40000-0x0000000005CBA000-memory.dmp

    Filesize

    488KB

  • memory/796-10-0x0000000073E00000-0x00000000744EE000-memory.dmp

    Filesize

    6.9MB

  • memory/796-3-0x0000000000440000-0x0000000000456000-memory.dmp

    Filesize

    88KB

  • memory/796-2-0x0000000004EF0000-0x0000000004F30000-memory.dmp

    Filesize

    256KB

  • memory/796-1-0x0000000073E00000-0x00000000744EE000-memory.dmp

    Filesize

    6.9MB

  • memory/796-29-0x0000000073E00000-0x00000000744EE000-memory.dmp

    Filesize

    6.9MB

  • memory/796-0-0x0000000001140000-0x0000000001224000-memory.dmp

    Filesize

    912KB

  • memory/2024-41-0x0000000002750000-0x0000000002790000-memory.dmp

    Filesize

    256KB

  • memory/2024-39-0x0000000002750000-0x0000000002790000-memory.dmp

    Filesize

    256KB

  • memory/2024-35-0x000000006EC20000-0x000000006F1CB000-memory.dmp

    Filesize

    5.7MB

  • memory/2024-33-0x000000006EC20000-0x000000006F1CB000-memory.dmp

    Filesize

    5.7MB

  • memory/2024-42-0x000000006EC20000-0x000000006F1CB000-memory.dmp

    Filesize

    5.7MB

  • memory/2660-27-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2660-20-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2660-32-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2660-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2660-30-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2660-23-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2660-36-0x0000000073E00000-0x00000000744EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2660-37-0x0000000004700000-0x0000000004740000-memory.dmp

    Filesize

    256KB

  • memory/2660-22-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2660-46-0x0000000004700000-0x0000000004740000-memory.dmp

    Filesize

    256KB

  • memory/2660-45-0x0000000073E00000-0x00000000744EE000-memory.dmp

    Filesize

    6.9MB

  • memory/2660-21-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2808-34-0x000000006EC20000-0x000000006F1CB000-memory.dmp

    Filesize

    5.7MB

  • memory/2808-43-0x000000006EC20000-0x000000006F1CB000-memory.dmp

    Filesize

    5.7MB

  • memory/2808-40-0x0000000000630000-0x0000000000670000-memory.dmp

    Filesize

    256KB

  • memory/2808-38-0x0000000000630000-0x0000000000670000-memory.dmp

    Filesize

    256KB