Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/03/2024, 08:21

General

  • Target

    Invptapayment19032024.exe

  • Size

    617KB

  • MD5

    9da1c1003343966cb14acd150070a54f

  • SHA1

    6bdb294279f50e4e6ad270664c9733acd4d586de

  • SHA256

    3a93ebec868141d7e6d804c825c79934f5db6b72825c74635b9f6c0f98217b76

  • SHA512

    09f09459ec7ef3b4fa777b3ce2a30ec385cea44878d9ee02c91fcb06f2f32199534b15d1020605c27e1e3b6e801f38a19a528728882f554f56a4314bb2a2bfef

  • SSDEEP

    12288:JjWm+U8a9nFn6D+hbpZZMxInHoLnJK1dQPLeKS8VtMpOJRYWq:YmFnQ2b3uxInuJKrQzet83mOJb

Malware Config

Extracted

Credentials

  • Protocol:
    ftp
  • Host:
    ftp.jeepcommerce.rs
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    q[0r3BqZHV[u

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://ftp.jeepcommerce.rs
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    q[0r3BqZHV[u

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Invptapayment19032024.exe
    "C:\Users\Admin\AppData\Local\Temp\Invptapayment19032024.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4704

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4704-1-0x0000000074E50000-0x0000000075600000-memory.dmp

    Filesize

    7.7MB

  • memory/4704-0-0x0000000000DC0000-0x0000000000E60000-memory.dmp

    Filesize

    640KB

  • memory/4704-2-0x0000000005D10000-0x00000000062B4000-memory.dmp

    Filesize

    5.6MB

  • memory/4704-3-0x0000000005840000-0x00000000058D2000-memory.dmp

    Filesize

    584KB

  • memory/4704-4-0x0000000005A50000-0x0000000005A60000-memory.dmp

    Filesize

    64KB

  • memory/4704-5-0x0000000005820000-0x000000000582A000-memory.dmp

    Filesize

    40KB

  • memory/4704-6-0x0000000005AC0000-0x0000000005AD4000-memory.dmp

    Filesize

    80KB

  • memory/4704-7-0x0000000005AF0000-0x0000000005AF8000-memory.dmp

    Filesize

    32KB

  • memory/4704-8-0x00000000069C0000-0x00000000069CC000-memory.dmp

    Filesize

    48KB

  • memory/4704-9-0x0000000006A30000-0x0000000006AB4000-memory.dmp

    Filesize

    528KB

  • memory/4704-10-0x0000000006C60000-0x0000000006CFC000-memory.dmp

    Filesize

    624KB

  • memory/4704-11-0x0000000006BD0000-0x0000000006C12000-memory.dmp

    Filesize

    264KB

  • memory/4704-12-0x000000000C430000-0x000000000C496000-memory.dmp

    Filesize

    408KB

  • memory/4704-13-0x000000000A3D0000-0x000000000A420000-memory.dmp

    Filesize

    320KB

  • memory/4704-14-0x0000000074E50000-0x0000000075600000-memory.dmp

    Filesize

    7.7MB

  • memory/4704-15-0x0000000005A50000-0x0000000005A60000-memory.dmp

    Filesize

    64KB