Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

03/02/2024, 10:02

240203-l26cksega8 10

02/02/2024, 07:31

240202-jccb4agfc5 10

Analysis

  • max time kernel
    141s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/02/2024, 10:02

General

  • Target

    Saskia_Serial_checker.exe

  • Size

    2.0MB

  • MD5

    5a1c7eedaeaa3ae27b051f8ad98fe46a

  • SHA1

    29ef02d4581193438f1ae1775ce657d99d67cda2

  • SHA256

    e8e7d2825218b86bebcd2cc98f35736de16ce97c5aeb239ced17b80ba63912c4

  • SHA512

    dd01c32b3680028eb121ce66e07d34a66bfaa7c4f8a9b05d094457be67439c7d00fa1efcc77d88b760b78013ab25494abebaa3d801a3c1c74120a2b60e4a670c

  • SSDEEP

    49152:2oRgITYbNbNWo4kSH3OqtwI/kqXfd+/9A9TuhanieKdboR:2PIT4bNJFY3OqtLkqXf0FoKWU

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • AgentTesla payload 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Saskia_Serial_checker.exe
    "C:\Users\Admin\AppData\Local\Temp\Saskia_Serial_checker.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      "wmic" cpu get serialnumber
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3468

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2788-0-0x00000000748F0000-0x00000000750A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2788-1-0x0000000000C70000-0x0000000000E70000-memory.dmp

    Filesize

    2.0MB

  • memory/2788-2-0x0000000006070000-0x0000000006614000-memory.dmp

    Filesize

    5.6MB

  • memory/2788-3-0x0000000005820000-0x00000000058B2000-memory.dmp

    Filesize

    584KB

  • memory/2788-4-0x0000000005AB0000-0x0000000005AC0000-memory.dmp

    Filesize

    64KB

  • memory/2788-5-0x00000000058D0000-0x00000000058DA000-memory.dmp

    Filesize

    40KB

  • memory/2788-6-0x0000000005BC0000-0x0000000005DD4000-memory.dmp

    Filesize

    2.1MB

  • memory/2788-7-0x000000000B360000-0x000000000B3C6000-memory.dmp

    Filesize

    408KB

  • memory/2788-8-0x0000000005AB0000-0x0000000005AC0000-memory.dmp

    Filesize

    64KB

  • memory/2788-9-0x00000000748F0000-0x00000000750A0000-memory.dmp

    Filesize

    7.7MB

  • memory/2788-10-0x0000000005AB0000-0x0000000005AC0000-memory.dmp

    Filesize

    64KB

  • memory/2788-11-0x0000000005AB0000-0x0000000005AC0000-memory.dmp

    Filesize

    64KB

  • memory/2788-13-0x00000000748F0000-0x00000000750A0000-memory.dmp

    Filesize

    7.7MB