Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
142s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 17:12
Static task
static1
Behavioral task
behavioral1
Sample
Draft Sales contract.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
Draft Sales contract.exe
Resource
win10v2004-20240226-en
General
-
Target
Draft Sales contract.exe
-
Size
664KB
-
MD5
e7d5b3af9cebadf634461574940da0a7
-
SHA1
1b70ed9407cbe02fbb2ea7790caba4bae4c98a29
-
SHA256
519fcde66b1b9c807cf89568d162c89103ee8065ba1009086881bbbefd69e4c9
-
SHA512
f7bb4a4a13832a6c665229aaf9fafd4cb563f794b04ede6be44713d30d13a5fe4ff77ddc33f0e68770fe8ff59c7b2372c3f1afe18de63c78159ac29aebf3749a
-
SSDEEP
12288:I33nFyHgRMph6guOtDqB/PkKhcRdK6auXh35TPy4l52IQko3MN+Evy:IlyHsIh6fOtDqdfYh39lS6or
Malware Config
Extracted
Protocol: smtp- Host:
mail.techwiser.in - Port:
587 - Username:
[email protected] - Password:
tech@#$121
Extracted
agenttesla
Protocol: smtp- Host:
mail.techwiser.in - Port:
587 - Username:
[email protected] - Password:
tech@#$121 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 36 api.ipify.org 37 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2696 set thread context of 1808 2696 Draft Sales contract.exe 98 -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2696 Draft Sales contract.exe 2696 Draft Sales contract.exe 2696 Draft Sales contract.exe 2696 Draft Sales contract.exe 2696 Draft Sales contract.exe 2696 Draft Sales contract.exe 1808 Draft Sales contract.exe 1808 Draft Sales contract.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2696 Draft Sales contract.exe Token: SeDebugPrivilege 1808 Draft Sales contract.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2696 wrote to memory of 3404 2696 Draft Sales contract.exe 97 PID 2696 wrote to memory of 3404 2696 Draft Sales contract.exe 97 PID 2696 wrote to memory of 3404 2696 Draft Sales contract.exe 97 PID 2696 wrote to memory of 1808 2696 Draft Sales contract.exe 98 PID 2696 wrote to memory of 1808 2696 Draft Sales contract.exe 98 PID 2696 wrote to memory of 1808 2696 Draft Sales contract.exe 98 PID 2696 wrote to memory of 1808 2696 Draft Sales contract.exe 98 PID 2696 wrote to memory of 1808 2696 Draft Sales contract.exe 98 PID 2696 wrote to memory of 1808 2696 Draft Sales contract.exe 98 PID 2696 wrote to memory of 1808 2696 Draft Sales contract.exe 98 PID 2696 wrote to memory of 1808 2696 Draft Sales contract.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\Draft Sales contract.exe"C:\Users\Admin\AppData\Local\Temp\Draft Sales contract.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Local\Temp\Draft Sales contract.exe"C:\Users\Admin\AppData\Local\Temp\Draft Sales contract.exe"2⤵PID:3404
-
-
C:\Users\Admin\AppData\Local\Temp\Draft Sales contract.exe"C:\Users\Admin\AppData\Local\Temp\Draft Sales contract.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1808
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4088 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:81⤵PID:4660