Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    43s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 01:40

General

  • Target

    7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe

  • Size

    90KB

  • MD5

    3789a874d635d0d1fd9b0e2db0bb3b64

  • SHA1

    11f577b3dd0c4808e16b7178fa146b9e9e329e2e

  • SHA256

    7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89

  • SHA512

    8d5485baa4c96f4e382466b2d2458a67d3d692d96ac8af2ac4478744d60f096400f34df4ed56981e43374169e7daafaaf9295c6f41e4592f8de22fa680c452ef

  • SSDEEP

    1536:LOhNcZESviFQzXblXAorYfwJcxSTlWoJl0ovJvWR4jmft2Ib7ADUzq5K:LObcZ36ykDxSTlWoJl0ovJvWR46fJb7P

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe
    "C:\Users\Admin\AppData\Local\Temp\7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:432
    • C:\Users\Admin\AppData\Local\Temp\7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe
      "C:\Users\Admin\AppData\Local\Temp\7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:6104
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4252,i,16710585221322798697,8586257254049248207,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
    1⤵
      PID:440

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\7755547b43fb87602e86330cd5b97e6c18438402582b798ff5c9d44b895a8c89.exe.log

      Filesize

      1KB

      MD5

      f3eb81974dc5933681e933f07209ff5f

      SHA1

      7af8cae0f1d03e82daaf784df9886705685baac7

      SHA256

      e82069884dd428bd6a1c67fe00c5fa56f9c4d62b538b694694a699588f1f4ab2

      SHA512

      d9aa3871dffb76c8a73a7940fa03bbc9b65cf575cbd07f7c1fbf490cb0f3d670415eaef0bf79e34689f61ab3cdfbb104efdef004becc12e54b501f02f948aaff

    • memory/432-0-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

      Filesize

      4KB

    • memory/432-1-0x00000000008B0000-0x00000000008CA000-memory.dmp

      Filesize

      104KB

    • memory/432-2-0x0000000074B70000-0x0000000075320000-memory.dmp

      Filesize

      7.7MB

    • memory/432-3-0x00000000075E0000-0x0000000007810000-memory.dmp

      Filesize

      2.2MB

    • memory/432-4-0x0000000007DC0000-0x0000000008364000-memory.dmp

      Filesize

      5.6MB

    • memory/432-5-0x00000000078B0000-0x0000000007942000-memory.dmp

      Filesize

      584KB

    • memory/432-7-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-19-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-37-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-43-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-59-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-69-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-67-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-63-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-61-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-65-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-57-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-55-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-53-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-51-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-49-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-45-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-47-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-41-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-39-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-35-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-33-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-31-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-29-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-25-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-23-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-21-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-27-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-17-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-13-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-11-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-9-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-15-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-6-0x00000000075E0000-0x000000000780A000-memory.dmp

      Filesize

      2.2MB

    • memory/432-4441-0x0000000074B7E000-0x0000000074B7F000-memory.dmp

      Filesize

      4KB

    • memory/432-4893-0x0000000074B70000-0x0000000075320000-memory.dmp

      Filesize

      7.7MB

    • memory/432-4894-0x0000000074B70000-0x0000000075320000-memory.dmp

      Filesize

      7.7MB

    • memory/432-4896-0x0000000005BD0000-0x0000000005C1C000-memory.dmp

      Filesize

      304KB

    • memory/432-4895-0x0000000005B60000-0x0000000005BCC000-memory.dmp

      Filesize

      432KB

    • memory/432-4897-0x0000000006030000-0x0000000006084000-memory.dmp

      Filesize

      336KB

    • memory/432-4902-0x0000000074B70000-0x0000000075320000-memory.dmp

      Filesize

      7.7MB

    • memory/6104-4904-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

    • memory/6104-4903-0x0000000074B70000-0x0000000075320000-memory.dmp

      Filesize

      7.7MB

    • memory/6104-4906-0x0000000074B70000-0x0000000075320000-memory.dmp

      Filesize

      7.7MB

    • memory/6104-4905-0x00000000055A0000-0x0000000005606000-memory.dmp

      Filesize

      408KB

    • memory/6104-4907-0x0000000006C60000-0x0000000006CB0000-memory.dmp

      Filesize

      320KB

    • memory/6104-4908-0x0000000006D50000-0x0000000006DEC000-memory.dmp

      Filesize

      624KB

    • memory/6104-4909-0x0000000006E00000-0x0000000006E0A000-memory.dmp

      Filesize

      40KB

    • memory/6104-4910-0x0000000074B70000-0x0000000075320000-memory.dmp

      Filesize

      7.7MB