Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    18-06-2024 06:45

General

  • Target

    shipping documents.exe

  • Size

    731KB

  • MD5

    487581e26f44dc342b13f83a424a7d0b

  • SHA1

    f63e3fdfa598322bd2ededb12a2c272182824990

  • SHA256

    553e372ef331a9891f8cada32625bd6491cbd427f1a2a6ad62cd1472ec3f23a0

  • SHA512

    9e903d9be418a8d024b566bf06d28a300bf15f3fa042a4a8ebe7b8e186a8cb50ad19e5a892e5137dccc05fac4b7eabf6236592b6efcea045d68ad1988c03a99a

  • SSDEEP

    12288:UPU2iNPyCK2xrOo2BakSVelkYawUlrc/6t2SLck6en6Oj0KlhKAgLEwkR:L15yC5ESVkRallVGzgfkAX

Malware Config

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\shipping documents.exe
    "C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\shipping documents.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2604
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\qvgpVBR.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3004
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\qvgpVBR" /XML "C:\Users\Admin\AppData\Local\Temp\tmp6133.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:2612
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2528

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp6133.tmp

    Filesize

    1KB

    MD5

    68e8afeaa83981e10209aa4354e7ef6e

    SHA1

    365ba709858f291d197d26930d43137c3c03f6a5

    SHA256

    2cd513beb4110925043224fb02d4b5abda764dbdd938e36293782ce49fe2b196

    SHA512

    3d58d6a600362adc996722f4e990bb341ac3e76eb7c4b4958baab5f9d92946d5127b518f6d30ba9ad5b1016c0c35d70f5102f742a6eeeb89f51b66decbf65375

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\MWVG2LIP4H00YU3T454A.temp

    Filesize

    7KB

    MD5

    c9dd4a2342566128abe6b35bb2ce034d

    SHA1

    892e53cfdb866ac38f3768a8609092d0f8d9b89f

    SHA256

    b4b60a78306d143f02fb88e4768733a00ffe485e855951296ff79c5f99a406e3

    SHA512

    a821a684119f7d970c43c47dc388477eb8ef15666c2b6e983e7b1694837e140381571838bbd2917f0fbdbbed36903a427f5ccfe60e1454e59ee90e8191dd5d1f

  • memory/1632-30-0x0000000074950000-0x000000007503E000-memory.dmp

    Filesize

    6.9MB

  • memory/1632-1-0x0000000000180000-0x000000000023A000-memory.dmp

    Filesize

    744KB

  • memory/1632-2-0x0000000074950000-0x000000007503E000-memory.dmp

    Filesize

    6.9MB

  • memory/1632-3-0x0000000000710000-0x000000000072A000-memory.dmp

    Filesize

    104KB

  • memory/1632-4-0x0000000000350000-0x0000000000360000-memory.dmp

    Filesize

    64KB

  • memory/1632-5-0x0000000004DC0000-0x0000000004E44000-memory.dmp

    Filesize

    528KB

  • memory/1632-0-0x000000007495E000-0x000000007495F000-memory.dmp

    Filesize

    4KB

  • memory/2528-18-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2528-28-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2528-27-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2528-26-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2528-24-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2528-22-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2528-20-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2528-29-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB