Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    07/12/2023, 10:10 UTC

General

  • Target

    PI # ARDFZC 0003722023.exe

  • Size

    1.1MB

  • MD5

    3e2a479e553002fa5a7632ff48328c9c

  • SHA1

    4bfbf7edb54b0f7c64037a48674a6865a7ce844a

  • SHA256

    f80099a7582ca527be303b551c9efd3080fd8d729f29cada9113693399737229

  • SHA512

    def737da2e9f4650d41a711020c40acccfa5deaba4126a8f51dcebb646116f0df60a5ccf9fe14168faea1bc643522c2e2a6150db26a3806cd81a911f182c1bb5

  • SSDEEP

    12288:vFkCRtvzGNWF+T1wn+dMhkZ5lilHBU2XHsS97nzJAgxXrYjdscZ+h/rOsIp5Rn4K:vFRtvzGNWBpK/liNnHscb7YjdsNDbIV

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.amtechcards.com
  • Port:
    587
  • Username:
    pure@amtechcards.com
  • Password:
    ]i[a(tUWlmp%
  • Email To:
    pure1@amtechcards.com

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\PI # ARDFZC 0003722023.exe
    "C:\Users\Admin\AppData\Local\Temp\PI # ARDFZC 0003722023.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\eYabbCiXCEoiEZ.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2656
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eYabbCiXCEoiEZ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDA58.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2692
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2976

Network

  • flag-us
    DNS
    api.ipify.org
    RegSvcs.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN CNAME
    api4.ipify.org
    api4.ipify.org
    IN A
    64.185.227.156
    api4.ipify.org
    IN A
    104.237.62.212
    api4.ipify.org
    IN A
    173.231.16.77
  • 64.185.227.156:443
    api.ipify.org
    tls
    RegSvcs.exe
    385 B
    211 B
    5
    5
  • 8.8.8.8:53
    api.ipify.org
    dns
    RegSvcs.exe
    59 B
    126 B
    1
    1

    DNS Request

    api.ipify.org

    DNS Response

    64.185.227.156
    104.237.62.212
    173.231.16.77

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpDA58.tmp

    Filesize

    1KB

    MD5

    05ac46d7a6c41d536dc616b27a59ef6c

    SHA1

    769c25235bdbae6a430ffeedbbc3a33749c92a77

    SHA256

    7a37889cc6099fca9b3c33f7a969c0df2bf4fb62391575de4f6c108aba52a55a

    SHA512

    ccdf9ae948c862e078acffa513bfba143103e83f74d9da3ca201349f7995164424aaeedec8ee539313083ec6b789a9731c8af0d22a01ef2d229c6ba299b4fb40

  • memory/2412-34-0x0000000000340000-0x0000000000380000-memory.dmp

    Filesize

    256KB

  • memory/2412-25-0x0000000074630000-0x0000000074D1E000-memory.dmp

    Filesize

    6.9MB

  • memory/2412-3-0x00000000003C0000-0x00000000003DA000-memory.dmp

    Filesize

    104KB

  • memory/2412-4-0x0000000000430000-0x0000000000438000-memory.dmp

    Filesize

    32KB

  • memory/2412-5-0x0000000000450000-0x000000000045A000-memory.dmp

    Filesize

    40KB

  • memory/2412-6-0x0000000008240000-0x00000000082BA000-memory.dmp

    Filesize

    488KB

  • memory/2412-1-0x0000000074630000-0x0000000074D1E000-memory.dmp

    Filesize

    6.9MB

  • memory/2412-0-0x00000000009F0000-0x0000000000B04000-memory.dmp

    Filesize

    1.1MB

  • memory/2412-37-0x0000000074630000-0x0000000074D1E000-memory.dmp

    Filesize

    6.9MB

  • memory/2412-2-0x0000000000340000-0x0000000000380000-memory.dmp

    Filesize

    256KB

  • memory/2656-15-0x000000006EC80000-0x000000006F22B000-memory.dmp

    Filesize

    5.7MB

  • memory/2656-30-0x0000000002800000-0x0000000002840000-memory.dmp

    Filesize

    256KB

  • memory/2656-18-0x000000006EC80000-0x000000006F22B000-memory.dmp

    Filesize

    5.7MB

  • memory/2656-38-0x000000006EC80000-0x000000006F22B000-memory.dmp

    Filesize

    5.7MB

  • memory/2656-21-0x000000006EC80000-0x000000006F22B000-memory.dmp

    Filesize

    5.7MB

  • memory/2656-36-0x0000000002800000-0x0000000002840000-memory.dmp

    Filesize

    256KB

  • memory/2656-28-0x0000000002800000-0x0000000002840000-memory.dmp

    Filesize

    256KB

  • memory/2976-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2976-31-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2976-33-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2976-22-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2976-27-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2976-35-0x0000000074630000-0x0000000074D1E000-memory.dmp

    Filesize

    6.9MB

  • memory/2976-17-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2976-20-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2976-14-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2976-40-0x0000000074630000-0x0000000074D1E000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.