Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    599s
  • max time network
    457s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/05/2024, 15:47

General

  • Target

    Project_Items_Materials Spec_Details_Rev0.exe

  • Size

    343KB

  • MD5

    3de33761d18c33ebbf8e9d0d8f17aab1

  • SHA1

    f62a08e7b8a49fb51b7a19b56462ed74a6489cde

  • SHA256

    fab9809b4f04191f935e53c298de6a0d0c23e4d2589fc60a2e06c5735f70866a

  • SHA512

    e3b91ec66d2471e4b5ab1c1a64a20c59dac1fba911c06c18b59722d7d808572e0d9951a03eb2f4aad797920bfc433e199fcfff71c81eb64d06aa67473f393dcd

  • SSDEEP

    6144:O/c/43APFfobmbCkegPds+3F6O3MOLS29SIcBj7XQkjjMPEqDSGgS:OR3efobm+Quy4O3PO2cIcd73jMPEqDSc

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Loads dropped DLL 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Project_Items_Materials Spec_Details_Rev0.exe
    "C:\Users\Admin\AppData\Local\Temp\Project_Items_Materials Spec_Details_Rev0.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:2248
    • C:\Users\Admin\AppData\Local\Temp\Project_Items_Materials Spec_Details_Rev0.exe
      "C:\Users\Admin\AppData\Local\Temp\Project_Items_Materials Spec_Details_Rev0.exe"
      2⤵
      • Suspicious use of NtCreateThreadExHideFromDebugger
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4564

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\nsc4B92.tmp\System.dll

    Filesize

    12KB

    MD5

    d6f54d2cefdf58836805796f55bfc846

    SHA1

    b980addc1a755b968dd5799179d3b4f1c2de9d2d

    SHA256

    f917aef484d1fbb4d723b2e2d3045cb6f5f664e61fbb3d5c577bd1c215de55d9

    SHA512

    ce67da936a93d46ef7e81abc8276787c82fd844c03630ba18afc3528c7e420c3228bfe82aeda083bb719f2d1314afae913362abd1e220cb364606519690d45db

  • memory/2248-60-0x0000000004A40000-0x0000000005C75000-memory.dmp

    Filesize

    18.2MB

  • memory/2248-56-0x0000000004A40000-0x0000000005C75000-memory.dmp

    Filesize

    18.2MB

  • memory/2248-57-0x0000000077DC1000-0x0000000077EE1000-memory.dmp

    Filesize

    1.1MB

  • memory/2248-58-0x0000000074A15000-0x0000000074A16000-memory.dmp

    Filesize

    4KB

  • memory/2248-77-0x0000000004A40000-0x0000000005C75000-memory.dmp

    Filesize

    18.2MB

  • memory/4564-75-0x0000000000490000-0x00000000016E4000-memory.dmp

    Filesize

    18.3MB

  • memory/4564-62-0x0000000077E65000-0x0000000077E66000-memory.dmp

    Filesize

    4KB

  • memory/4564-61-0x0000000077E48000-0x0000000077E49000-memory.dmp

    Filesize

    4KB

  • memory/4564-76-0x0000000000490000-0x00000000004D0000-memory.dmp

    Filesize

    256KB

  • memory/4564-59-0x00000000016F0000-0x0000000002925000-memory.dmp

    Filesize

    18.2MB

  • memory/4564-78-0x00000000355C0000-0x0000000035B64000-memory.dmp

    Filesize

    5.6MB

  • memory/4564-79-0x00000000331D0000-0x0000000033236000-memory.dmp

    Filesize

    408KB

  • memory/4564-80-0x0000000035F40000-0x0000000035F90000-memory.dmp

    Filesize

    320KB

  • memory/4564-81-0x0000000035F90000-0x0000000036022000-memory.dmp

    Filesize

    584KB

  • memory/4564-82-0x0000000036080000-0x000000003608A000-memory.dmp

    Filesize

    40KB

  • memory/4564-85-0x00000000016F0000-0x0000000002925000-memory.dmp

    Filesize

    18.2MB

  • memory/4564-86-0x0000000077DC1000-0x0000000077EE1000-memory.dmp

    Filesize

    1.1MB