Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231201-en
  • resource tags

    arch:x64arch:x86image:win7-20231201-enlocale:en-usos:windows7-x64system
  • submitted
    08/12/2023, 08:06

General

  • Target

    TRNX9876567DLH899897.PDF.exe

  • Size

    348KB

  • MD5

    90b961fc91f7e87eb700739696ff4f59

  • SHA1

    6fc31b4ddd8e0e821f1d318d85dbba1362f03b8d

  • SHA256

    ba3c127de1b583cf249240a34f154ed90368289c4b3ad1944e760ab02a94b068

  • SHA512

    5298959ff111f323935e934bf127aee75d9428326d95c24a9619a0bd347f989cd263bc391e9a209b441142456ec265d69ea9d663356f115e4e0b763569a6a340

  • SSDEEP

    6144:SsNyAueerw7hiET4bLOW2sTdlzLK1Wrtwztw3WLmBWskAZcr5pRyvzsZVDKy:SsNyNeUTEToLOW2sTdlz+10whqB5Hqrk

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TRNX9876567DLH899897.PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\TRNX9876567DLH899897.PDF.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1988
    • C:\Users\Admin\AppData\Local\Temp\TRNX9876567DLH899897.PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\TRNX9876567DLH899897.PDF.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2744

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1988-6-0x0000000000380000-0x0000000000381000-memory.dmp

    Filesize

    4KB

  • memory/1988-1-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/1988-2-0x0000000000630000-0x0000000000670000-memory.dmp

    Filesize

    256KB

  • memory/1988-16-0x00000000740D0000-0x00000000747BE000-memory.dmp

    Filesize

    6.9MB

  • memory/1988-0-0x00000000013A0000-0x00000000013FC000-memory.dmp

    Filesize

    368KB

  • memory/2744-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2744-5-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2744-10-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2744-8-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2744-14-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2744-3-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2744-17-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2744-19-0x0000000000400000-0x0000000000444000-memory.dmp

    Filesize

    272KB

  • memory/2744-20-0x0000000074050000-0x000000007473E000-memory.dmp

    Filesize

    6.9MB

  • memory/2744-21-0x0000000000CF0000-0x0000000000D30000-memory.dmp

    Filesize

    256KB

  • memory/2744-24-0x0000000074050000-0x000000007473E000-memory.dmp

    Filesize

    6.9MB

  • memory/2744-25-0x0000000000CF0000-0x0000000000D30000-memory.dmp

    Filesize

    256KB