Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
141s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 03:58
Static task
static1
Behavioral task
behavioral1
Sample
579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe
Resource
win10v2004-20231215-en
General
-
Target
579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe
-
Size
636KB
-
MD5
9c1dbd904a8ef4ea3b9e780215d4b5cd
-
SHA1
525e03b33d5b9796c76ae2428448acfea3a66525
-
SHA256
579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969
-
SHA512
228edc0b70c250a62411bea9c7238a4d9359fe8982de56e4db08eacdd26041fb9f43138ffed051ff4b67ef03fe5d8fb0bdd49d1e7052382fe4412bfc38d58c07
-
SSDEEP
12288:MOL+xEd66WXUAoFHDPdzxFdyrxbHsa0X0K85My2FHybNIZFlICgBcPA:fCxcvWXvoFjPdzx+bx/eyiANIj7NPA
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.wasstech.com - Port:
587 - Username:
[email protected] - Password:
Sunray2700@@ - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 1 IoCs
resource yara_rule behavioral2/memory/976-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 1 IoCs
resource yara_rule behavioral2/memory/976-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 1 IoCs
resource yara_rule behavioral2/memory/976-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/memory/976-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/memory/976-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 1 IoCs
resource yara_rule behavioral2/memory/976-28-0x0000000000400000-0x0000000000442000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 31 api.ipify.org 32 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3020 set thread context of 976 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 98 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1456 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 4756 powershell.exe 4376 powershell.exe 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 976 RegSvcs.exe 976 RegSvcs.exe 4756 powershell.exe 4376 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe Token: SeDebugPrivilege 4756 powershell.exe Token: SeDebugPrivilege 4376 powershell.exe Token: SeDebugPrivilege 976 RegSvcs.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 3020 wrote to memory of 4756 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 91 PID 3020 wrote to memory of 4756 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 91 PID 3020 wrote to memory of 4756 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 91 PID 3020 wrote to memory of 4376 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 93 PID 3020 wrote to memory of 4376 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 93 PID 3020 wrote to memory of 4376 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 93 PID 3020 wrote to memory of 1456 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 95 PID 3020 wrote to memory of 1456 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 95 PID 3020 wrote to memory of 1456 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 95 PID 3020 wrote to memory of 964 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 97 PID 3020 wrote to memory of 964 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 97 PID 3020 wrote to memory of 964 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 97 PID 3020 wrote to memory of 976 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 98 PID 3020 wrote to memory of 976 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 98 PID 3020 wrote to memory of 976 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 98 PID 3020 wrote to memory of 976 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 98 PID 3020 wrote to memory of 976 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 98 PID 3020 wrote to memory of 976 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 98 PID 3020 wrote to memory of 976 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 98 PID 3020 wrote to memory of 976 3020 579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe"C:\Users\Admin\AppData\Local\Temp\579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\579e14e67dedb45ea3b315a678450891a931387f884bb196407defc567604969.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4756
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\aYqAzNBNdABKH.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4376
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aYqAzNBNdABKH" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA75C.tmp"2⤵
- Creates scheduled task(s)
PID:1456
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:964
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:976
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD53d086a433708053f9bf9523e1d87a4e8
SHA1b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28
SHA2566f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69
SHA512931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd
-
Filesize
18KB
MD5904e560b77625e0732e3f653532fe483
SHA1d8275dcd7ea47a0b26682c33640dc0286bb46259
SHA256d5290fd696bddee300fe20b7705c221f9f994fad8c2902a7d2375e769ae8ef6f
SHA512ca926dc4d5797e9fc69537f177ff15a971778624497dcff8ca44cf0af6185d9557f006f68d8ff0c402678e1e10ea9d509deb8ee99d1d7b8261f880e1bde81763
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD51e8b5e652b52a89cd22d25efbccb3484
SHA1d2d00fe1bb5e14406f9f59769d316321250984ec
SHA2561ce5261a900c7bf6a7d94d04ea879d27a4efb79fcf6b2a6acdb10a1bf612ae50
SHA5127feb49b72eb1abdeaed26942a5cfc1932095ff208f2dd0c31212ca99b8be9ba99a3bf187e17850e6ce0c18724d9df5d499bd1eaef1b9497186409215b37d5dc5