Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    144s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231222-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/02/2024, 01:42

General

  • Target

    f7f51847940ce0a6372c8b36289046a37221131c8a63c2699688f0da85c5ef1e.exe

  • Size

    904KB

  • MD5

    82bd8fa9a17ad70d52f6759580e1d4cd

  • SHA1

    508d546783f9e18e5baf562006f684d20e029aca

  • SHA256

    f7f51847940ce0a6372c8b36289046a37221131c8a63c2699688f0da85c5ef1e

  • SHA512

    bb3b582214400afe22a3b8d5fb362ebb9e1862746a88a9da1948901fd49f691fe14f9ed3b05d0b1dcb8a18f8e20ff5fb181bf484a7432f0b9293f30305c4b63b

  • SSDEEP

    24576:pRmJkcoQricOIQxiZY1iad/S75kSaAc2xnkej:mJZoQrbTFZY1iadq76Ac2xkg

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f7f51847940ce0a6372c8b36289046a37221131c8a63c2699688f0da85c5ef1e.exe
    "C:\Users\Admin\AppData\Local\Temp\f7f51847940ce0a6372c8b36289046a37221131c8a63c2699688f0da85c5ef1e.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2680
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Users\Admin\AppData\Local\Temp\f7f51847940ce0a6372c8b36289046a37221131c8a63c2699688f0da85c5ef1e.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:812
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2680 -s 752
      2⤵
      • Program crash
      PID:3016
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2680 -ip 2680
    1⤵
      PID:872

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/812-11-0x0000000000590000-0x00000000005C0000-memory.dmp

      Filesize

      192KB

    • memory/812-12-0x0000000073BD0000-0x0000000074380000-memory.dmp

      Filesize

      7.7MB

    • memory/812-13-0x0000000005240000-0x00000000057E4000-memory.dmp

      Filesize

      5.6MB

    • memory/812-14-0x0000000004E40000-0x0000000004E50000-memory.dmp

      Filesize

      64KB

    • memory/812-15-0x0000000004BF0000-0x0000000004C56000-memory.dmp

      Filesize

      408KB

    • memory/812-16-0x0000000005AF0000-0x0000000005B40000-memory.dmp

      Filesize

      320KB

    • memory/812-17-0x0000000005BE0000-0x0000000005C72000-memory.dmp

      Filesize

      584KB

    • memory/812-18-0x0000000005B50000-0x0000000005B5A000-memory.dmp

      Filesize

      40KB

    • memory/812-19-0x0000000073BD0000-0x0000000074380000-memory.dmp

      Filesize

      7.7MB

    • memory/812-20-0x0000000004E40000-0x0000000004E50000-memory.dmp

      Filesize

      64KB

    • memory/2680-10-0x0000000004660000-0x0000000004664000-memory.dmp

      Filesize

      16KB