Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17/05/2024, 08:20
Static task
static1
Behavioral task
behavioral1
Sample
Best Price.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
Best Price.exe
Resource
win10v2004-20240508-en
General
-
Target
Best Price.exe
-
Size
811KB
-
MD5
b353071dc5c2a19eddc322df0afd4555
-
SHA1
0982d0f41385ac54acde12e3e94e0826c6ceabb6
-
SHA256
901dc27ad8572ac676262b222f35e1144d1ec16148d8b49117ac118980f3d721
-
SHA512
d9bc455852af01720905ac489ab4fe188ef1d23649fb98a942f65cdc48c0c97d34cdd277f7b9ee6d5c6f5601eb422564c216b235bd2c8d2246b9cb8ceec1f01f
-
SSDEEP
24576:/bYzlzJSNI+2q0dGyelqr2Y3hrkTg3OMKw1Y:sldaInGvlqF3hY03R11Y
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
us2.smtp.mailhostbox.com - Port:
587 - Username:
[email protected] - Password:
OetwSUilP3 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1704 set thread context of 2384 1704 Best Price.exe 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2384 Best Price.exe 2384 Best Price.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2384 Best Price.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2384 1704 Best Price.exe 28 PID 1704 wrote to memory of 2384 1704 Best Price.exe 28 PID 1704 wrote to memory of 2384 1704 Best Price.exe 28 PID 1704 wrote to memory of 2384 1704 Best Price.exe 28 PID 1704 wrote to memory of 2384 1704 Best Price.exe 28 PID 1704 wrote to memory of 2384 1704 Best Price.exe 28 PID 1704 wrote to memory of 2384 1704 Best Price.exe 28 PID 1704 wrote to memory of 2384 1704 Best Price.exe 28 PID 1704 wrote to memory of 2384 1704 Best Price.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\Best Price.exe"C:\Users\Admin\AppData\Local\Temp\Best Price.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\Temp\Best Price.exe"C:\Users\Admin\AppData\Local\Temp\Best Price.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2384
-