Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    162s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    12/03/2024, 02:22

General

  • Target

    301ed1bb47c406723e68efa053bb4d4f5ce8fa794676c4411b0d2b506696d228.exe

  • Size

    40KB

  • MD5

    37e8da7ff8487da599c89c8a2b3b7d96

  • SHA1

    144d2581c8bbc52c50b8e7a0d2cb84bb7e0c7c0f

  • SHA256

    301ed1bb47c406723e68efa053bb4d4f5ce8fa794676c4411b0d2b506696d228

  • SHA512

    1b861b54217f66d82784d920abdc8710944f2a223a788c16f7228102a781e54a5e881333caef32f18c63d3377c782afbb48f37f921f1cba2f9b91bab7e8e3af8

  • SSDEEP

    768:lqWEIJXt+ONNXyiRP0zlu5GIGVlW3qWDnrvBF0jrYdZt:lvEmt+ONNXycP0zlu5GIGVl4qWDnrvTN

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Contacts a large (4250) amount of remote hosts 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Detect packed .NET executables. Mostly AgentTeslaV4. 5 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 5 IoCs
  • Detects executables packed with or use KoiVM 1 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 5 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 5 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 5 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 5 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\301ed1bb47c406723e68efa053bb4d4f5ce8fa794676c4411b0d2b506696d228.exe
    "C:\Users\Admin\AppData\Local\Temp\301ed1bb47c406723e68efa053bb4d4f5ce8fa794676c4411b0d2b506696d228.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:16748
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 2072 -s 60368
      2⤵
        PID:6836

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

      Filesize

      67KB

      MD5

      753df6889fd7410a2e9fe333da83a429

      SHA1

      3c425f16e8267186061dd48ac1c77c122962456e

      SHA256

      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

      SHA512

      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      e7f2c386609e2d986d404909adface9b

      SHA1

      9fa39309e344cff958d2dd5a010d4a4ceea220f9

      SHA256

      9d700804ecb1617f1f45d36e11a0979819a832cbf6134ad6a01c05bb8a3c1210

      SHA512

      136f5c917a9cb6d6404bff34360a59b978ef9384ebf14490036c59dbf670f59ebcf4d28fc63ae8cc727cb75888c4ec77db6d54827260501ecc84549d18b0d893

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      425459e72f18982644e1d8a2e80ec009

      SHA1

      3bc39d53f7247d85b53ac1d608129d1b98e24ff1

      SHA256

      0a28d156dc22252685bd7b76eb5e8473de8ae411b5eb65f9597dae0c64e925d2

      SHA512

      82d5b8d364c1eaaa0e911e4b6109e55049ca543835d3cb7dbf91fdd0db8a3bff68a2d51c03c7524aa3a855e3d21cb05e641d30b9d08a5010dccceca3ce237e3b

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      f5604efcaedea3cd0526434c0e7d25ec

      SHA1

      b42712e48f57251814303f5d37fbee466df45592

      SHA256

      ca48df976800e7b6537505b3d555247f2231e033f5f476330096de7afff4ee21

      SHA512

      aa1268f8d9794a79c23d152920d1ac19b71b1dcbcfe4e4d43a9d7ceca0a873c0c79f4a98ca57aeab631abbba80b88b5803b9f90a8ee87de1e526286f79ee7651

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      5bd13590bddcff2b7471a72b411accbc

      SHA1

      b0bd731164a2cb3e31c8b37c93436afd67ecedf3

      SHA256

      757d15955c4b534a1e4bbf4443e40efc39cfaef5ce3d56b54faff84f1b7c488d

      SHA512

      385cb57a8ede794ac3415d18bf078af8b42074eb730a82a2a4507b4641093979c13b8821e1a1cff4c61bd5e88dbf609faf6476d701b1b9f93cab1ca26dfbf8d2

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      6d4c08b4d8993b3f3f7a52f9d5a23711

      SHA1

      1fcfce575cc6383767092ecdfd980ce4bedcdff5

      SHA256

      a4ccfae1e234e651ebb7fd412fbb22cc0dd1681924cf1b85bbcc7d7da385fc12

      SHA512

      b322e43224ad614e373335571a2c97c50938e41a54e8cff393bf7b06592871a29e838143462068998f8a2297d9da34c75c6c832f11c3b1541aa4392498dff1ae

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      a3cd99a3f917f89e553bb5b73462b286

      SHA1

      dc1a3706cd1a734101e544974bd8f2e9bf877af0

      SHA256

      93f534704dd545c0849e6b79fca0ceca170aedf5187cba3f05d77a07958da906

      SHA512

      b4b7f852139b080f536bf63e01c4a0a97076483fe9a0139fc4dd5d6973e5ee231cceadc21af02680a543aba9a0c533e9fbb77810b8b2601abb801c045c13fe73

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      8101a805b7a3133d9d59477deffd523b

      SHA1

      bf4279fcf13fb37a9db76241f64070ec39764bfa

      SHA256

      6bc4b956e1f60862b7042701191bf9c0dc8176f84e009f6d26c86b87a0bd4e09

      SHA512

      1c00cb8a594db883b63662665c8c8d1d43d8c34f73c81064ee492894b9cc2fd0dd3a590cefd60af088bd49a8d4777ba024f3871cf601f5a706298ceceb94ce07

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      2a2ecd27a689457410e9f940e5cff5c0

      SHA1

      a3a7b53bd80d9cefa096ab32ed5ef491c3386023

      SHA256

      9d08fdee4e55aa522e86ab06a1802ba4a40b0f559ab29267fdaec0a93582d294

      SHA512

      669fadbb45afe5799506b7469db9f8a3ebd063c3d5f2212fe5b6be85ee42c677754fedd2a55697f2b55b67cc5f6d06858a1003b11799a9dcc3f1359cab9964d4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      ab1c0bdbea0ba91646dd2575f350ef9d

      SHA1

      0d5f27dc1f01ed783d572f278d87ee02c3be79e5

      SHA256

      9eceb3a9ac3ff52b2af883a155611d658260671ca9e11607a5b892eae8305a4b

      SHA512

      18e61b62b389fb911303e03731b62bc9248a2255fe7305a2d7673f853b469e2028e05043ef27010f9de3cd719efdffe615abde81931765012b6021499b1dce22

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      9c99c03789f4dad0a0f0ab8220ce5af0

      SHA1

      c70cacf50f6b4048d887337ae993349f3ecb8111

      SHA256

      16549dfe004a8744dfe3f39f0f1143020737711f65775aa878f3e7af93c48ef7

      SHA512

      6cac1ba64968e4c56b5ec6fb16929a70b02aa865f63e77ace6f354cfc688a92a74199db6178aa0b5c99a3bccaf7641289d4498743a5b6525ab933c78065a99ba

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      5268ac3e12f4538660d00c8b59848205

      SHA1

      7d8ffd0afe72cb1a24b20f64b23906d63a86058c

      SHA256

      170b2f8b982618df62f7d1d341d2c1dc91e1c6b3b21066b67eed5095514c9693

      SHA512

      ec0926b91859515924a2e5c2dd33d96e06658533cf9441667ed5cd482dc9afe52bc9d2c4dc97d25ac6b035ab68ac12c3c0d6ccc43901a27a6eda9e84479869bc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      7431db31165d29851ef639cf8c816315

      SHA1

      5a9ed2641348aae6d7e72d02379d48a3665721c9

      SHA256

      4992e57782356082d7cbc02cc37d66cdff6b7fdc729d57e8bb11cabc88b57b61

      SHA512

      ada83dfd5365269d66d51d484785a342856fc8a2d84b4f6de7a949a460b12310aa373983d26328c371065e4eed8d8071960854aed559f680369e565d4c3095e5

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      b131d3a32622447de486488fba55a93a

      SHA1

      7132386910fb08cd03cb177e7da38be48617052b

      SHA256

      b86e72b9bc66120c71eba6ef8b1b9a9a2c33e0d56fcb7cb7df630cd0814bdea0

      SHA512

      51bdaf73b7d7fa8af7b78a8e90190240a559716bbc8462b4933917a1b9f98fdf9ecf92fa85130990beb851b50c425c84ce2cc7efd424a9a89378db1a02bc7bc1

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      ef17e495d5870f0e7dd56fe7671e3bbb

      SHA1

      d2a5472688361ba3c5df23d3b7b9b71c457adaf1

      SHA256

      62e0d16f6cb27fe49eaf0aff6572ea6da8a821b00d584613022f35fbc97a1657

      SHA512

      c6a75d764a96fe30aa99069f2217fb5b0b062fad5d28cb7ee541f7ce8c76d7c2be1564902061849461420093731428d9c0c4c13f1b823a0f739f381624596488

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      b48261ea6938220bd36dcd444650cd03

      SHA1

      fae4e5935e936a1d498cf792d40017366a58569e

      SHA256

      07abdd5e759c289fd5daa74c7fda0100fdca1bde4b7c5f8089c52e1a35dead48

      SHA512

      6045bc30037768ff3371baae35a43f87ff135a0f5955d387b641929022861f9df49e56c7237483909a072976d36e79bc7fbfa391959745e621f8a7f203a44d15

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      9029962328dd5b9daee01d9b390785bb

      SHA1

      b0667adc1c0f8341831b9793875d882f12c0f0e1

      SHA256

      9b9f24a041345b4dc1e85e346a5d0fa05465e0e13c754ce9cc1b7ff580682195

      SHA512

      891b38f1b5bd4e58a3e5b25342d12ad566d2340a35bfaafc73bf0f4b05672ec5a3bd1cccd84d9a8731fcb91a6349b88a20fa71921801b653b4f81f7ea31b58bf

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      195529364d8a5cf16af6f1ab5c9d1d32

      SHA1

      40eb2459e2ffe7ccca1deda8912e33a3944a50d5

      SHA256

      d7a3349f60baa43e33d71240f5a66e7d2e3070f46b1d1c23d2efb2532b518542

      SHA512

      d1b4a36f05ce97720ddb43f5756c98e960d80c0cf7d31b527dd29ab83a59c4f933752da8c6d84c8e623e9f35d3f9be90f476e5efb2d3c974dd1e93f5054569e7

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      8425c996744d37304e583b8c2fdd22a7

      SHA1

      af8af97dcad89db2c94e92957344b6a6a5e05dc3

      SHA256

      348b4a677606ee8b8948eab7ff2c1e0f442e4e3061663cc216c02c2577a823fa

      SHA512

      7f78ac1debe98b3b8d21a01b77c34bf737e00b452606d63ef2a50983055cdea9ed62b8dc489735e0f609803cee6d8104f86e6a1f953d44b884d6651f69626705

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      304B

      MD5

      15424d97d77cdf1481591645049db7a7

      SHA1

      4e64633d4d836c1752c45aa483c742f7d31eb6cb

      SHA256

      7fe6cf6defa4c0c832ba6e11ad0f936d086a5edb60594af3dce391bfa35d236e

      SHA512

      7754965c6bf7ae0e0909545659be57ef7761d9d7e8a81924d10dc1492d6469154e4e0b6bc91e84b2ba1843bc84f7b972dae7f942d2ad1097f11ba78189b94fe8

    • C:\Users\Admin\AppData\Local\Temp\Tar9A15.tmp

      Filesize

      175KB

      MD5

      dd73cead4b93366cf3465c8cd32e2796

      SHA1

      74546226dfe9ceb8184651e920d1dbfb432b314e

      SHA256

      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

      SHA512

      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63

    • memory/2072-0-0x0000000000AC0000-0x0000000000ACE000-memory.dmp

      Filesize

      56KB

    • memory/2072-1-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

      Filesize

      9.9MB

    • memory/2072-2-0x000000001B0C0000-0x000000001B140000-memory.dmp

      Filesize

      512KB

    • memory/2072-861-0x000000001C180000-0x000000001C216000-memory.dmp

      Filesize

      600KB

    • memory/2072-130-0x000007FEF58F0000-0x000007FEF62DC000-memory.dmp

      Filesize

      9.9MB

    • memory/16748-917-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/16748-919-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/16748-915-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/16748-921-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/16748-923-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/16748-924-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/16748-928-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/16748-926-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/16748-929-0x00000000742A0000-0x000000007498E000-memory.dmp

      Filesize

      6.9MB

    • memory/16748-930-0x0000000004B50000-0x0000000004B90000-memory.dmp

      Filesize

      256KB

    • memory/16748-931-0x00000000742A0000-0x000000007498E000-memory.dmp

      Filesize

      6.9MB