Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
124s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 10:39
Static task
static1
Behavioral task
behavioral1
Sample
162cbee9afd2ddf1689ca7a01161c8dd.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
162cbee9afd2ddf1689ca7a01161c8dd.exe
Resource
win10v2004-20231215-en
General
-
Target
162cbee9afd2ddf1689ca7a01161c8dd.exe
-
Size
872KB
-
MD5
162cbee9afd2ddf1689ca7a01161c8dd
-
SHA1
11410b599de59f6a683ad631f91f85157d9cf466
-
SHA256
5ad45e7314fedc92068f3df1d94ea6f97c29f05e62f0e591e38f126223e68a71
-
SHA512
4e5d815b44cf0e54b71fd0830bfd13803fd1c2436d5a3c093d4e2ab2506f49ba86e2f548435d3658684c04d9ce6f6ca928caa9134f29a52b4920cda51b3db465
-
SSDEEP
12288:plhF4yh+JCiwcYMEUcygb5wwvk1Hncz+Ga0T/ZTYw6Jsui/bajgcwo:LaJCiwhMg6wcB2+2xT
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.privateemail.com - Port:
587 - Username:
[email protected] - Password:
Young84@1
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
AgentTesla payload 7 IoCs
resource yara_rule behavioral1/memory/3016-16-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/3016-17-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/3016-19-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/3016-21-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/3016-24-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/3016-26-0x0000000004C60000-0x0000000004CA0000-memory.dmp family_agenttesla behavioral1/memory/3016-28-0x0000000004C60000-0x0000000004CA0000-memory.dmp family_agenttesla -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2752 set thread context of 3016 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2616 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3016 MSBuild.exe 3016 MSBuild.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3016 MSBuild.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3016 MSBuild.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2752 wrote to memory of 2616 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 30 PID 2752 wrote to memory of 2616 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 30 PID 2752 wrote to memory of 2616 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 30 PID 2752 wrote to memory of 2616 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 30 PID 2752 wrote to memory of 3016 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 32 PID 2752 wrote to memory of 3016 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 32 PID 2752 wrote to memory of 3016 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 32 PID 2752 wrote to memory of 3016 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 32 PID 2752 wrote to memory of 3016 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 32 PID 2752 wrote to memory of 3016 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 32 PID 2752 wrote to memory of 3016 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 32 PID 2752 wrote to memory of 3016 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 32 PID 2752 wrote to memory of 3016 2752 162cbee9afd2ddf1689ca7a01161c8dd.exe 32 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 MSBuild.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\162cbee9afd2ddf1689ca7a01161c8dd.exe"C:\Users\Admin\AppData\Local\Temp\162cbee9afd2ddf1689ca7a01161c8dd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XOUdKROJF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpEF20.tmp"2⤵
- Creates scheduled task(s)
PID:2616
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- outlook_office_path
- outlook_win_path
PID:3016
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ba634afc31b65b24c50462f5d0c5ff18
SHA1528663b399b6f34a5918a5f21b90ff4e90554011
SHA2565cb57cfc9bcd868f0a9f170c8b6a48370b44e42018571a538efc59d53ef57ac3
SHA51292f6b923984215656465c31d549b8faa53c8265a71a4816bc06462bb57b2d794205dc1f04a7c00f99756039228e65d45974c7972a95ba1ebf84802ccc4376d0d