Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
25/06/2024, 01:57
Behavioral task
behavioral1
Sample
9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe
Resource
win10v2004-20240226-en
General
-
Target
9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe
-
Size
737KB
-
MD5
0d46d709a626c186dca1450cfffdf3cb
-
SHA1
69b7ee5476195292de09a124982c93c0cd147f54
-
SHA256
9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a
-
SHA512
3c151656cdd1442c247fd965e16f684eba05dc8a867962216aa9eaa6c2f609a01c667bf8c8edce9b731171b071bd70b9acdbc7357fc282de0bee41daa11590a1
-
SSDEEP
12288:gYV6MorX7qzuC3QHO9FQVHPF51jgcCEpn2I0u4R78csiUdCdN4REFpYdc+DOqb:/BXu9HGaVHLn2zu4Rcr4d+RgpYa+DOqb
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot7062858527:AAEM0BoHdG7fMsfm9R9w93alfsoiCiWrMxM/
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe -
Executes dropped EXE 1 IoCs
pid Process 2560 name.exe -
Loads dropped DLL 1 IoCs
pid Process 1632 9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe -
resource yara_rule behavioral1/memory/1632-0-0x0000000000BA0000-0x0000000000D3D000-memory.dmp upx behavioral1/files/0x0007000000014531-14.dat upx behavioral1/memory/1632-17-0x0000000002CF0000-0x0000000002E8D000-memory.dmp upx behavioral1/memory/1632-20-0x0000000000BA0000-0x0000000000D3D000-memory.dmp upx behavioral1/memory/2560-40-0x0000000001220000-0x00000000013BD000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2737914667-933161113-3798636211-1000\Software\Microsoft\Windows\CurrentVersion\Run\. = "C:\\Users\\Admin\\AppData\\Roaming\\.\\..exe" RegSvcs.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 6 ip-api.com -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1632-20-0x0000000000BA0000-0x0000000000D3D000-memory.dmp autoit_exe behavioral1/memory/2560-40-0x0000000001220000-0x00000000013BD000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2560 set thread context of 2456 2560 name.exe 29 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2456 RegSvcs.exe 2456 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2560 name.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2456 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1632 9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe 1632 9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe 2560 name.exe 2560 name.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1632 9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe 1632 9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe 2560 name.exe 2560 name.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1632 wrote to memory of 2560 1632 9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe 28 PID 1632 wrote to memory of 2560 1632 9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe 28 PID 1632 wrote to memory of 2560 1632 9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe 28 PID 1632 wrote to memory of 2560 1632 9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe 28 PID 2560 wrote to memory of 2456 2560 name.exe 29 PID 2560 wrote to memory of 2456 2560 name.exe 29 PID 2560 wrote to memory of 2456 2560 name.exe 29 PID 2560 wrote to memory of 2456 2560 name.exe 29 PID 2560 wrote to memory of 2456 2560 name.exe 29 PID 2560 wrote to memory of 2456 2560 name.exe 29 PID 2560 wrote to memory of 2456 2560 name.exe 29 PID 2560 wrote to memory of 2456 2560 name.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe"C:\Users\Admin\AppData\Local\Temp\9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe"1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\9079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2456
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD585ff5da24dab28765e1250003a90032b
SHA112caea247277ede2404831a54314e76b4ecbff81
SHA256dcfeb010a8008b44f70d90ca27d09e3c548277b6be7eddd3da0fd71a80a26d25
SHA5122cba6e3f61b5eaf535f4f437b3588ed55858b580160150dc912347f82a6cbf544188e8187aba849fac0dff45dc84a0b66c7811ebd3f88d02c56929db14112580
-
Filesize
267KB
MD522133e37f82d2e4c0b436f730a896442
SHA14d262fb20f0c10deba29394daade7176d7534126
SHA256987d1979a2a9ae08f1c83d3c8c8302f967148c16ccb8750962b4bfd0ca58c629
SHA5125876f05e14db92c355c9007b5cdc9846338c402f27e6fcd38e9227395793a9ed00877f0da63417c119b24c94d4a4184a7b2ee832baec63c784c45a16356f42bd
-
Filesize
737KB
MD50d46d709a626c186dca1450cfffdf3cb
SHA169b7ee5476195292de09a124982c93c0cd147f54
SHA2569079ad27c74ba06204d72c6a182d7e389eb772c5bc80944d48a7afa2f1e1d00a
SHA5123c151656cdd1442c247fd965e16f684eba05dc8a867962216aa9eaa6c2f609a01c667bf8c8edce9b731171b071bd70b9acdbc7357fc282de0bee41daa11590a1