Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
15/01/2024, 03:23 UTC
Static task
static1
Behavioral task
behavioral1
Sample
f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8.exe
Resource
win10v2004-20231215-en
General
-
Target
f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8.exe
-
Size
1.3MB
-
MD5
9fcfd49cab037d685a5237f4a8987132
-
SHA1
556b109fdfa4e2d61504b34f6ffc9f45ad92f3a1
-
SHA256
f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8
-
SHA512
140cf8c051a89edffa5a7adb24aae8a11c8f993a69b4f33c6a6274461674179a44adaa0cdfeebac0e16b201d5cf6764bdcbf4f772b09d41472c8de3cb8e0a977
-
SSDEEP
24576:FqDEvCTbMWu7rQYlBQcBiT6rprG8aZaxzcFe+vuapMrF8n:FTvC/MTQYxsWR7a4xuewuaq
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
bezelety.top - Port:
587 - Username:
procode@bezelety.top - Password:
IxF(..bSed6k - Email To:
procode@bezelety.top
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1160 set thread context of 3660 1160 f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8.exe 90 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3660 RegSvcs.exe 3660 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1160 f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3660 RegSvcs.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1160 wrote to memory of 3660 1160 f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8.exe 90 PID 1160 wrote to memory of 3660 1160 f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8.exe 90 PID 1160 wrote to memory of 3660 1160 f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8.exe 90 PID 1160 wrote to memory of 3660 1160 f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8.exe"C:\Users\Admin\AppData\Local\Temp\f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\f94d06ef8ca2b0ba82d7b87527ff277b534c80e96fe8d7bff5fb0b8ebe4e65b8.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3660
-
Network
-
Remote address:8.8.8.8:53Request146.78.124.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request194.178.17.96.in-addr.arpaIN PTRResponse194.178.17.96.in-addr.arpaIN PTRa96-17-178-194deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request1.181.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.35.223.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request2.136.104.51.in-addr.arpaIN PTRResponse
-
GEThttps://www.bing.com/th?id=OADD2.10239339860315_1WVX6SNAJCPCC9OTR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90Remote address:92.123.128.181:443RequestGET /th?id=OADD2.10239339860315_1WVX6SNAJCPCC9OTR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90 HTTP/2.0
host: www.bing.com
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-type: image/png
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
content-length: 1180
date: Mon, 15 Jan 2024 03:24:21 GMT
alt-svc: h3=":443"; ma=93600
x-cdn-traceid: 0.b5777b5c.1705289061.25a0181e
-
Remote address:8.8.8.8:53Request181.128.123.92.in-addr.arpaIN PTRResponse181.128.123.92.in-addr.arpaIN PTRa92-123-128-181deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request206.23.85.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEdual-a-0001.a-msedge.netdual-a-0001.a-msedge.netIN A204.79.197.200dual-a-0001.a-msedge.netIN A13.107.21.200
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301694_17Y0IRSKKQEXFDPLC&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301694_17Y0IRSKKQEXFDPLC&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 275490
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9435B202BD0948C9A85A02C475EB5765 Ref B: LON04EDGE1112 Ref C: 2024-01-15T03:24:54Z
date: Mon, 15 Jan 2024 03:24:53 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301288_1GU97O2L0EVD7325U&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301288_1GU97O2L0EVD7325U&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 297187
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: F04AB52C25964FBEB37C52DDB5590EFD Ref B: LON04EDGE1112 Ref C: 2024-01-15T03:24:54Z
date: Mon, 15 Jan 2024 03:24:53 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301641_15XCVCUU89WZACE51&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301641_15XCVCUU89WZACE51&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 339880
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 852B8876DFB846828EBBF52DF4BD701D Ref B: LON04EDGE1112 Ref C: 2024-01-15T03:24:54Z
date: Mon, 15 Jan 2024 03:24:53 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301232_1SUK3KC676MXT5G7N&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301232_1SUK3KC676MXT5G7N&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 334566
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: AC79FBB3492145BA8AA3ADF747E5DF14 Ref B: LON04EDGE1112 Ref C: 2024-01-15T03:24:54Z
date: Mon, 15 Jan 2024 03:24:53 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301285_1YX3CCWTOZVY6EU1J&pid=21.2&w=1920&h=1080&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301285_1YX3CCWTOZVY6EU1J&pid=21.2&w=1920&h=1080&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 387682
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 900ABFD2CF9D4F66B6085ADB059FDD65 Ref B: LON04EDGE1112 Ref C: 2024-01-15T03:24:54Z
date: Mon, 15 Jan 2024 03:24:53 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301697_1IS6I39WFTNHNV537&pid=21.2&w=1080&h=1920&c=4Remote address:204.79.197.200:443RequestGET /th?id=OADD2.10239317301697_1IS6I39WFTNHNV537&pid=21.2&w=1080&h=1920&c=4 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 246852
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 6C5D2C1423354444A75EB754D069AEB3 Ref B: LON04EDGE1112 Ref C: 2024-01-15T03:24:55Z
date: Mon, 15 Jan 2024 03:24:54 GMT
-
Remote address:8.8.8.8:53Request180.178.17.96.in-addr.arpaIN PTRResponse180.178.17.96.in-addr.arpaIN PTRa96-17-178-180deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request180.178.17.96.in-addr.arpaIN PTR
-
Remote address:8.8.8.8:53Request21.236.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request26.178.89.13.in-addr.arpaIN PTRResponse
-
276 B 6
-
92.123.128.181:443https://www.bing.com/th?id=OADD2.10239339860315_1WVX6SNAJCPCC9OTR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90tls, http21.4kB 6.5kB 16 14
HTTP Request
GET https://www.bing.com/th?id=OADD2.10239339860315_1WVX6SNAJCPCC9OTR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=24&h=24&dynsize=1&qlt=90HTTP Response
200 -
1.3kB 8.3kB 17 14
-
1.3kB 8.3kB 17 14
-
1.2kB 8.3kB 16 14
-
204.79.197.200:443https://tse1.mm.bing.net/th?id=OADD2.10239317301697_1IS6I39WFTNHNV537&pid=21.2&w=1080&h=1920&c=4tls, http268.0kB 2.0MB 1430 1426
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301694_17Y0IRSKKQEXFDPLC&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301288_1GU97O2L0EVD7325U&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301641_15XCVCUU89WZACE51&pid=21.2&w=1080&h=1920&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301232_1SUK3KC676MXT5G7N&pid=21.2&w=1920&h=1080&c=4HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301285_1YX3CCWTOZVY6EU1J&pid=21.2&w=1920&h=1080&c=4HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301697_1IS6I39WFTNHNV537&pid=21.2&w=1080&h=1920&c=4HTTP Response
200 -
1.3kB 8.3kB 17 14
-
72 B 158 B 1 1
DNS Request
146.78.124.51.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
194.178.17.96.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
1.181.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
26.35.223.20.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
2.136.104.51.in-addr.arpa
-
73 B 139 B 1 1
DNS Request
181.128.123.92.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
183.59.114.20.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
206.23.85.13.in-addr.arpa
-
72 B 137 B 1 1
DNS Request
18.134.221.88.in-addr.arpa
-
62 B 173 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
204.79.197.20013.107.21.200
-
144 B 137 B 2 1
DNS Request
180.178.17.96.in-addr.arpa
DNS Request
180.178.17.96.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
21.236.111.52.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
26.178.89.13.in-addr.arpa