Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    119s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    17/04/2024, 14:31

General

  • Target

    ecc34f95e278887ec719983726b713401430220c40f13925ccd78d9917f0ac76.exe

  • Size

    632KB

  • MD5

    a5d86dac801967b4c191885b018abaab

  • SHA1

    e489472efccc4207a7711818ee83102a55ecb08f

  • SHA256

    ecc34f95e278887ec719983726b713401430220c40f13925ccd78d9917f0ac76

  • SHA512

    9019d7e166655f13ccc0dac86d3ac13c332261ce557ea06ed150bef3a728c9fac10a1c720a2759966c751c1abf4091acb937339537e86df381c0b13e5cb71f8c

  • SSDEEP

    12288:/axLvnA7H4IzJ77veFzKI8d7RwmoSO5qS1iJ8M8kYTmsViPNecN7uqNJtCVrVm6I:/ax7nA7YO3veq3zQqYi6bTmsVyN1h69O

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecc34f95e278887ec719983726b713401430220c40f13925ccd78d9917f0ac76.exe
    "C:\Users\Admin\AppData\Local\Temp\ecc34f95e278887ec719983726b713401430220c40f13925ccd78d9917f0ac76.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\heErthOsF.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2944
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\heErthOsF" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2CCB.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2388
    • C:\Users\Admin\AppData\Local\Temp\ecc34f95e278887ec719983726b713401430220c40f13925ccd78d9917f0ac76.exe
      "C:\Users\Admin\AppData\Local\Temp\ecc34f95e278887ec719983726b713401430220c40f13925ccd78d9917f0ac76.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:1292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp2CCB.tmp

    Filesize

    1KB

    MD5

    0e214d923077bfa13e7b26adad00071f

    SHA1

    6400c74b14508aa6c3ab2a9671eadb36f9845749

    SHA256

    56ea1f25db39bd1e4a4e2fe8084f62c24cb964a5ff97de61d4839e4d56984235

    SHA512

    2e7c54984f0e9ee33c207f4731940abe503b375e22cd6ca33676ac12bee10f0338af2f0e741092c7630d10e67d398275317c16c8f98fb74e29882636cf4ce4b6

  • memory/1292-20-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1292-18-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1292-28-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1292-26-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1292-24-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/1292-34-0x0000000004B10000-0x0000000004B50000-memory.dmp

    Filesize

    256KB

  • memory/1292-38-0x0000000074940000-0x000000007502E000-memory.dmp

    Filesize

    6.9MB

  • memory/1292-16-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1292-39-0x0000000004B10000-0x0000000004B50000-memory.dmp

    Filesize

    256KB

  • memory/1292-32-0x0000000074940000-0x000000007502E000-memory.dmp

    Filesize

    6.9MB

  • memory/1292-22-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/1292-30-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2944-33-0x000000006EA80000-0x000000006F02B000-memory.dmp

    Filesize

    5.7MB

  • memory/2944-35-0x000000006EA80000-0x000000006F02B000-memory.dmp

    Filesize

    5.7MB

  • memory/2944-36-0x0000000002530000-0x0000000002570000-memory.dmp

    Filesize

    256KB

  • memory/2944-37-0x000000006EA80000-0x000000006F02B000-memory.dmp

    Filesize

    5.7MB

  • memory/3052-6-0x0000000005A10000-0x0000000005A94000-memory.dmp

    Filesize

    528KB

  • memory/3052-31-0x0000000074940000-0x000000007502E000-memory.dmp

    Filesize

    6.9MB

  • memory/3052-8-0x0000000004AE0000-0x0000000004B20000-memory.dmp

    Filesize

    256KB

  • memory/3052-7-0x0000000074940000-0x000000007502E000-memory.dmp

    Filesize

    6.9MB

  • memory/3052-0-0x00000000000B0000-0x0000000000154000-memory.dmp

    Filesize

    656KB

  • memory/3052-5-0x0000000000570000-0x000000000057E000-memory.dmp

    Filesize

    56KB

  • memory/3052-4-0x0000000000560000-0x000000000056A000-memory.dmp

    Filesize

    40KB

  • memory/3052-3-0x00000000003C0000-0x00000000003D4000-memory.dmp

    Filesize

    80KB

  • memory/3052-2-0x0000000004AE0000-0x0000000004B20000-memory.dmp

    Filesize

    256KB

  • memory/3052-1-0x0000000074940000-0x000000007502E000-memory.dmp

    Filesize

    6.9MB