Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    120s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    25/06/2024, 17:07

General

  • Target

    25062024_1707_25062024_Boweitech-PO240624.docx

  • Size

    16KB

  • MD5

    96ab9ded82cab1f08da63925fbb04015

  • SHA1

    f01510bfbb0aba940ccae884b5bd0c1a70e36ad1

  • SHA256

    7f5525e9f137916591a4648e61ef5b87399b0fa2821e580c848b3b41dbd37bd2

  • SHA512

    2a038dce0006e5adeb30c5797b145758b8bfcf0d2d624e24feb07b3985a6058613fda91fa86236799fdf3a8f5bcd0c9c673e83ae7318911318983b083f7d16a7

  • SSDEEP

    384:XyXXUm+Wns8PL8wi4OEwH8TIbE91r2fRxJYWvi/5Z4rs2:XcXmg5P3DOqnYJf3vu5Z4Z

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://mail.hearing-vision.com
  • Port:
    21
  • Username:
    [email protected]
  • Password:
    LILKOOLL14!

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Blocklisted process makes network request 1 IoCs
  • Downloads MZ/PE file
  • Abuses OpenXML format to download file from external location
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Office loads VBA resources, possible macro or embedded object present
  • Launches Equation Editor 1 TTPs 1 IoCs

    Equation Editor is an old Office component often targeted by exploits such as CVE-2017-11882.

  • Modifies Internet Explorer settings 1 TTPs 31 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
    "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\25062024_1707_25062024_Boweitech-PO240624.docx"
    1⤵
    • Drops file in Windows directory
    • Modifies Internet Explorer settings
    • Modifies registry class
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Windows\splwow64.exe
      C:\Windows\splwow64.exe 12288
      2⤵
        PID:1720
    • C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE
      "C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
      1⤵
      • Blocklisted process makes network request
      • Loads dropped DLL
      • Launches Equation Editor
      • Suspicious use of WriteProcessMemory
      PID:2756
      • C:\Users\Admin\AppData\Roaming\damiano46720.scr
        "C:\Users\Admin\AppData\Roaming\damiano46720.scr"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1764
        • C:\Users\Admin\AppData\Roaming\damiano46720.scr
          "C:\Users\Admin\AppData\Roaming\damiano46720.scr"
          3⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2428

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

      Filesize

      1KB

      MD5

      2365869258df7a66a2121b802ca4afd9

      SHA1

      73acc30a2edeb9d6830de559bb8a74f35168135d

      SHA256

      d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed

      SHA512

      795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

      Filesize

      436B

      MD5

      1bfe0a81db078ea084ff82fe545176fe

      SHA1

      50b116f578bd272922fa8eae94f7b02fd3b88384

      SHA256

      5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f

      SHA512

      37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

      Filesize

      174B

      MD5

      b42c2afcb5ec53e60065b8b26c09ed15

      SHA1

      628892c19ca978f074c21921cc550ddedcdae83f

      SHA256

      8820ca268b2e5efbf85841ce9561b1dc86ab5463e118d0a6e200646501aee1bb

      SHA512

      fb693db699c467a005e446e40ca19dcfcc1842a9ae73e2fb31657a9c49549a09fb08a59475e183cb2c4fad093e8ad0871912372b59d3c87687e150464a5428bf

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      b42bf3edcc72425a625461ad1807927f

      SHA1

      4d4812b72e1bb5d1d450dbab3e2cdf18c2e1c720

      SHA256

      604944521f39ed402d518f06e1a956105419e44e429b3e50c246c7d4c085a13b

      SHA512

      3922782b6a7ae3f9b21dff9782245330ad5b9ccff13390e2c5f9d96265991c7a0f023400b161dec413071e6fbe4825be86c68a401868cf700220c46f33e5fc22

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

      Filesize

      170B

      MD5

      2f01978cf488234b5656d84d3c6d0412

      SHA1

      a55cc77c717f24e9c887bbbe6ee6995857a5b416

      SHA256

      96c5865c894a58d36f3d5bd18ef6f1c7f95ee2a0233ffad74f3cb250ac1526cd

      SHA512

      1255f1396f864d0b879840b86a73f4ee47dcf335a227de75366ac1a890518dee61cf8c3c42d71d9a6f5f1610bce1ab69f5b6e0a4e86cb647c4f5c31be2a12b94

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{01C21965-AE35-4254-956C-037CC0F13842}.FSD

      Filesize

      128KB

      MD5

      d9062289f0c9b4edb5a7f76b6c9f4915

      SHA1

      d3719a4ef6cade405b6f67c1254f8a5ee9048969

      SHA256

      c1790c487281244c0de8165f1e22f4f821386fae523ad611747ad20f9679ce92

      SHA512

      bc67fa2e9083e9a93c7f9a13019a5028e58d649fd82070f14c99055eb88de5079f882b2d2aaa56e05101fc115eff8d435c33087027cad13ac6bdb96ec62a7ebf

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

      Filesize

      128KB

      MD5

      03e29b528dfb5050f552159b4aaf3e9f

      SHA1

      81d7961ebebbe10ba5354669848482420cf23858

      SHA256

      0dc3877a2be76bf1850844ffa4d21af6ab2a09a69d4d753c69e9a277aba8eae5

      SHA512

      3f371712f6b4bb2ba8afc981ced470bd555004c66ae8099d6111893979ab8b1026ab0552d44d30e9c765ebad068ba89f91d2ec5360e875875b701163745ee8e9

    • C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{859FA5F1-E519-48FF-A207-3625FA974277}.FSD

      Filesize

      128KB

      MD5

      e5f7a26183e738d76142666a1d28421d

      SHA1

      743a31ff1c70d3931a5526eff0f62a3e5a786eb3

      SHA256

      d49aabc92d7770ea56564779e5c8746fd7101bc24525cfe5f49a860d5a9f7a05

      SHA512

      b5bf96c6aedc02218806ade1fa0157b78d4ec68d159867922767dd55fee0111a60968ac8a38fff4ab0d39767e0fdcca33dae163599d66cbeabf888460a95c151

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\DODQ7AEY\damian[1].doc

      Filesize

      487KB

      MD5

      737355ad732da62afc3eca04aaefbc25

      SHA1

      19d6816b326e076e33ba21df51c328685f59bd75

      SHA256

      688ade2a84dc563da3868c853dc6df1150d07ba094f0e6ee0eff9cb6b3faf938

      SHA512

      80e6f89912a00bf4c435e01faec1987dfab9a4f44110f0b23ab45badb006c1a0eb7f0ae0c6764849217b0a45431eff1c33e94ac89b41c9383238200aad8ab449

    • C:\Users\Admin\AppData\Local\Temp\Cab3054.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\{A6DB0EC2-E7D3-4091-9389-8F09B7024E7C}

      Filesize

      128KB

      MD5

      6a089778391088bcdae73908a24f510c

      SHA1

      1b68cf71cd58be034cd120f29ed22ae5472ff409

      SHA256

      5a8600731de4d6caedf53567073936a5193cdfc4a21a3d907acb9f33b53488e5

      SHA512

      9fa25cd25d8b97d968c4fdba9ea8217f940fdc0e3b3de75125122b7516b20f04807a2c67917229f2c903d0aca0353dfe905e6a72e9fb75949524f04eca3debe5

    • C:\Users\Admin\AppData\Roaming\Microsoft\Templates\Normal.dotm

      Filesize

      20KB

      MD5

      67a57ba45fda7f5b1567c22c831389ef

      SHA1

      0015b7eb72f0286cef7a7645c5d65d1f48610aa2

      SHA256

      ab21e34f3bad924a0cd1732cb1bd0dc7e079f20acc32cafb05c151f3e442ea97

      SHA512

      56131c74f91c606d315e24214aa5642cab69bc9575196852f2032320069720d6cfc94ac4e8bf12ef7e409fc7b6a0a2af30174ae8ff08f27b0359d461b57e63f4

    • C:\Users\Admin\AppData\Roaming\Microsoft\UProof\ExcludeDictionaryEN0409.lex

      Filesize

      2B

      MD5

      f3b25701fe362ec84616a93a45ce9998

      SHA1

      d62636d8caec13f04e28442a0a6fa1afeb024bbb

      SHA256

      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

      SHA512

      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

    • \Users\Admin\AppData\Roaming\damiano46720.scr

      Filesize

      665KB

      MD5

      eb9dd9b79372df1d0241ebba80eb2e3b

      SHA1

      acda6c7b1ae7e56095b05e36ae857999678de827

      SHA256

      009547fbcb42c8514a58658498a872f98ed04ac0414e1c45c90547118b3597cd

      SHA512

      8e5239f20d7176547c9521b8d0354cc938a7fff2fe8517819aefed4da9bcf2be8eb6f4ad4ff07aaab913bd1672429378bed6fe3f4fbc4f3c0ce0dda080df6d38

    • memory/1764-129-0x0000000000360000-0x0000000000368000-memory.dmp

      Filesize

      32KB

    • memory/1764-122-0x0000000000E70000-0x0000000000F1C000-memory.dmp

      Filesize

      688KB

    • memory/1764-124-0x0000000004500000-0x0000000004570000-memory.dmp

      Filesize

      448KB

    • memory/2428-137-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2428-131-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2428-142-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2428-140-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2428-139-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

      Filesize

      4KB

    • memory/2428-144-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2428-135-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2428-133-0x0000000000400000-0x0000000000442000-memory.dmp

      Filesize

      264KB

    • memory/2788-0-0x000000002FB91000-0x000000002FB92000-memory.dmp

      Filesize

      4KB

    • memory/2788-2-0x000000007155D000-0x0000000071568000-memory.dmp

      Filesize

      44KB

    • memory/2788-155-0x000000007155D000-0x0000000071568000-memory.dmp

      Filesize

      44KB

    • memory/2788-1-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2788-179-0x000000005FFF0000-0x0000000060000000-memory.dmp

      Filesize

      64KB

    • memory/2788-180-0x000000007155D000-0x0000000071568000-memory.dmp

      Filesize

      44KB