Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    03/02/2024, 01:35

General

  • Target

    20bc8b3cd7a9b7b843791dd7062598b8564132ecadcc009f27678d2dcc7db93d.exe

  • Size

    705KB

  • MD5

    de0bfea700906dea65ae87dd3c8a93e2

  • SHA1

    4d84ebbff27efa5d244697131a243796a15b7f5c

  • SHA256

    20bc8b3cd7a9b7b843791dd7062598b8564132ecadcc009f27678d2dcc7db93d

  • SHA512

    e7731e6da2e31ecf976d19a5c927aa9ea248f72900eeb9ba7964ef5f1de3b0bf9336dee266e185de28ac4a12fcb63717ac4be1d9467749831e31c539634b3c3b

  • SSDEEP

    12288:BfLKIAYQ4hu+fABslAw8ZbJk87zXMif8NryBZeNwcP3sBcxwmjil8wmb:V2IAjB0ok8hf8V6e78gwmulF

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 23 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20bc8b3cd7a9b7b843791dd7062598b8564132ecadcc009f27678d2dcc7db93d.exe
    "C:\Users\Admin\AppData\Local\Temp\20bc8b3cd7a9b7b843791dd7062598b8564132ecadcc009f27678d2dcc7db93d.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\20bc8b3cd7a9b7b843791dd7062598b8564132ecadcc009f27678d2dcc7db93d.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2512
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TwkLcCcv.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2516
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TwkLcCcv" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE198.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2424
    • C:\Users\Admin\AppData\Local\Temp\20bc8b3cd7a9b7b843791dd7062598b8564132ecadcc009f27678d2dcc7db93d.exe
      "C:\Users\Admin\AppData\Local\Temp\20bc8b3cd7a9b7b843791dd7062598b8564132ecadcc009f27678d2dcc7db93d.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2648

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpE198.tmp

    Filesize

    1KB

    MD5

    72d924ef971d2f1fe8f43b186fa88df0

    SHA1

    dc2c88b76da50b3d89d3487885432ec2c6900336

    SHA256

    5140bcd18851e38e2d305dfaef581d6d3518ad3f599142b75c94119031fc56da

    SHA512

    1ff28e84e5843adbcc45b68bd028427206cee313e488a7d1c4bd2a29b7cb3f42440966645ef4a1da4d42a13c4eff7a2731c2c4b306486afea508521300b68bd6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\CP62WRD4BXBM8TM7KAJU.temp

    Filesize

    7KB

    MD5

    833fc9b9ccbc626c0ac97cbb7e309d28

    SHA1

    d916747940669b9e3b7fccd48791c7f6a0c6f430

    SHA256

    347d9482e51957d80eaa49c37c9df40935cc1ef85ed55b8c147d6b67adc3f50a

    SHA512

    affc11070dd7986b2dc2604e50bfabe699dd9cb75541e12c79113d7da902b925d59e72629497fedcb1c46b8d9041e5490c708fc8946e63c1dd6d3ff9ba24ad20

  • memory/2372-38-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/2372-1-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/2372-2-0x0000000002220000-0x0000000002260000-memory.dmp

    Filesize

    256KB

  • memory/2372-3-0x0000000000690000-0x00000000006AC000-memory.dmp

    Filesize

    112KB

  • memory/2372-4-0x00000000006B0000-0x00000000006C4000-memory.dmp

    Filesize

    80KB

  • memory/2372-5-0x0000000005C20000-0x0000000005CA4000-memory.dmp

    Filesize

    528KB

  • memory/2372-6-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/2372-7-0x0000000002220000-0x0000000002260000-memory.dmp

    Filesize

    256KB

  • memory/2372-0-0x0000000000050000-0x0000000000104000-memory.dmp

    Filesize

    720KB

  • memory/2512-36-0x0000000001D10000-0x0000000001D50000-memory.dmp

    Filesize

    256KB

  • memory/2512-42-0x000000006EFE0000-0x000000006F58B000-memory.dmp

    Filesize

    5.7MB

  • memory/2512-27-0x000000006EFE0000-0x000000006F58B000-memory.dmp

    Filesize

    5.7MB

  • memory/2512-31-0x0000000001D10000-0x0000000001D50000-memory.dmp

    Filesize

    256KB

  • memory/2512-35-0x000000006EFE0000-0x000000006F58B000-memory.dmp

    Filesize

    5.7MB

  • memory/2516-33-0x000000006EFE0000-0x000000006F58B000-memory.dmp

    Filesize

    5.7MB

  • memory/2516-41-0x000000006EFE0000-0x000000006F58B000-memory.dmp

    Filesize

    5.7MB

  • memory/2516-29-0x000000006EFE0000-0x000000006F58B000-memory.dmp

    Filesize

    5.7MB

  • memory/2648-37-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2648-22-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2648-20-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2648-21-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2648-32-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2648-28-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2648-39-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/2648-40-0x0000000004B30000-0x0000000004B70000-memory.dmp

    Filesize

    256KB

  • memory/2648-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2648-23-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2648-43-0x0000000074150000-0x000000007483E000-memory.dmp

    Filesize

    6.9MB

  • memory/2648-44-0x0000000004B30000-0x0000000004B70000-memory.dmp

    Filesize

    256KB