Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    133s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    28/01/2024, 01:57

General

  • Target

    7bda5add0d4ba2c5b1810e9f44a6c6fb.exe

  • Size

    1017KB

  • MD5

    7bda5add0d4ba2c5b1810e9f44a6c6fb

  • SHA1

    857ec2f81068823ea37da355fa8fef8396230eac

  • SHA256

    ddfa7fe7c01cfa34c2413acc83e9f11eace8bc09e80128da2b5e2e61284df9ff

  • SHA512

    f39060cc82a5d3ad738ca362406494fd1c7fdb7bc352c67a3f9f77cdc13a4f74a5464f1f226f9f08ecf75f9358955e28c2199bd676d8b99ad1b9b760b63435ce

  • SSDEEP

    12288:5SUkOyTh0sQQ3XFkdhhgxw56hHb4ApqblAOnGh:5lrRLQnOJgsKMAAxG

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.northsrockusa.com/
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    (P%T2swlhOf}

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 7 IoCs
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7bda5add0d4ba2c5b1810e9f44a6c6fb.exe
    "C:\Users\Admin\AppData\Local\Temp\7bda5add0d4ba2c5b1810e9f44a6c6fb.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:880
    • C:\Users\Admin\AppData\Local\Temp\7bda5add0d4ba2c5b1810e9f44a6c6fb.exe
      "C:\Users\Admin\AppData\Local\Temp\7bda5add0d4ba2c5b1810e9f44a6c6fb.exe"
      2⤵
        PID:2056
      • C:\Users\Admin\AppData\Local\Temp\7bda5add0d4ba2c5b1810e9f44a6c6fb.exe
        "C:\Users\Admin\AppData\Local\Temp\7bda5add0d4ba2c5b1810e9f44a6c6fb.exe"
        2⤵
          PID:2736
        • C:\Users\Admin\AppData\Local\Temp\7bda5add0d4ba2c5b1810e9f44a6c6fb.exe
          "C:\Users\Admin\AppData\Local\Temp\7bda5add0d4ba2c5b1810e9f44a6c6fb.exe"
          2⤵
          • Accesses Microsoft Outlook profiles
          • Adds Run key to start application
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          • outlook_office_path
          • outlook_win_path
          PID:2648

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/880-0-0x0000000000BC0000-0x0000000000CC4000-memory.dmp

        Filesize

        1.0MB

      • memory/880-1-0x0000000074B60000-0x000000007524E000-memory.dmp

        Filesize

        6.9MB

      • memory/880-2-0x0000000005050000-0x0000000005090000-memory.dmp

        Filesize

        256KB

      • memory/880-3-0x0000000000320000-0x000000000033E000-memory.dmp

        Filesize

        120KB

      • memory/880-4-0x0000000074B60000-0x000000007524E000-memory.dmp

        Filesize

        6.9MB

      • memory/880-5-0x0000000005050000-0x0000000005090000-memory.dmp

        Filesize

        256KB

      • memory/880-6-0x0000000000980000-0x0000000000A1E000-memory.dmp

        Filesize

        632KB

      • memory/880-7-0x0000000000A20000-0x0000000000A5C000-memory.dmp

        Filesize

        240KB

      • memory/880-22-0x0000000074B60000-0x000000007524E000-memory.dmp

        Filesize

        6.9MB

      • memory/2648-12-0x0000000000400000-0x000000000043C000-memory.dmp

        Filesize

        240KB

      • memory/2648-10-0x0000000000400000-0x000000000043C000-memory.dmp

        Filesize

        240KB

      • memory/2648-13-0x0000000000400000-0x000000000043C000-memory.dmp

        Filesize

        240KB

      • memory/2648-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

        Filesize

        4KB

      • memory/2648-16-0x0000000000400000-0x000000000043C000-memory.dmp

        Filesize

        240KB

      • memory/2648-18-0x0000000000400000-0x000000000043C000-memory.dmp

        Filesize

        240KB

      • memory/2648-20-0x0000000000400000-0x000000000043C000-memory.dmp

        Filesize

        240KB

      • memory/2648-21-0x0000000074B60000-0x000000007524E000-memory.dmp

        Filesize

        6.9MB

      • memory/2648-8-0x0000000000400000-0x000000000043C000-memory.dmp

        Filesize

        240KB

      • memory/2648-23-0x0000000002140000-0x0000000002180000-memory.dmp

        Filesize

        256KB

      • memory/2648-26-0x0000000074B60000-0x000000007524E000-memory.dmp

        Filesize

        6.9MB

      • memory/2648-27-0x0000000002140000-0x0000000002180000-memory.dmp

        Filesize

        256KB

      • memory/2648-28-0x0000000002140000-0x0000000002180000-memory.dmp

        Filesize

        256KB