Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    a87292de990133b944754dcf27f76de727ec4a52033ea408d942b0ba16e968f9

  • Size

    5KB

  • Sample

    240419-w5qreacb25

  • MD5

    27f7090d61e7895efaa80dee10c8ca0f

  • SHA1

    b19991ed64de7cae81b50b4c5d9ae24779651904

  • SHA256

    a87292de990133b944754dcf27f76de727ec4a52033ea408d942b0ba16e968f9

  • SHA512

    d6fbee2d6bf2da64dc8d2fbb535983a61c966e430fccc26a0f9ceb807de01153b92f80af8bf022abce8f0891580609fe6ba07ef9e9446728412fbd3939e83313

  • SSDEEP

    96:to4PW/8v0ULVSaBBcMO113fMuhjleXKuBXwLFy/PKxX3hX:Pu4LVSQBK3fM6ofAZAPUX

Malware Config

Extracted

Family

agenttesla

Credentials

Targets

    • Target

      3cea805f1396df15bdbcd4317388a046a41a6079dba04576a58ba7b2c812338a

    • Size

      12KB

    • MD5

      55dba6e7aa4e8cc73415f4e3f9f6bdae

    • SHA1

      87c9f29d58f57a5e025061d389be2655ee879d5d

    • SHA256

      3cea805f1396df15bdbcd4317388a046a41a6079dba04576a58ba7b2c812338a

    • SHA512

      f2eb91e812b2ba58c4309fd44edadc8977367c7d9d6214d7e70a0392ae8427d570746ae57cca68dc260901f664f2e8c6c5387118ff01d243abeb5680abe2a352

    • SSDEEP

      192:vnpYaU28zxHdo4ZMgQl9q+4ua7HhdSbwxz1ULU87glpK/b26J4Uf1XXr5:vWZdoWMR96uaLhM6ULU870gJR

    • AgentTesla

      Agent Tesla is a remote access tool (RAT) written in visual basic.

    • Modifies security service

    • Phorphiex

      Malware family which infects systems to distribute other malicious payloads such as ransomware, stealers and cryptominers.

    • Windows security bypass

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of local email clients

      Email clients store some user data on disk where infostealers will often target it.

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Windows security modification

    • Adds Run key to start application

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks