Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
12/07/2024, 23:30
Static task
static1
Behavioral task
behavioral1
Sample
KANG SHUN 88 V.2315 PARTICULARS.docx.scr
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
KANG SHUN 88 V.2315 PARTICULARS.docx.scr
Resource
win10v2004-20240709-en
General
-
Target
KANG SHUN 88 V.2315 PARTICULARS.docx.scr
-
Size
671KB
-
MD5
e45d4600131cf00689bb13af70c70c13
-
SHA1
be3911f3272494411f2cb119eccfe5c444c09c61
-
SHA256
fcb4c6602aeea8229338eab9ed2deb97c27e07601791ef19c7e43a830079e416
-
SHA512
783584018ee7904e06ede5944c21036928554b7894e32c005994b2adc37520fe8378c3f6b5711124966ab9a515fccb69c46e73702437d7ea1de17a904bbb986a
-
SSDEEP
12288:qAL5YVK+orvwYo9tHiIRi+ksmjELgWhuNFxcCkadXbbHzt08SnS2OHalFep9AH2:qg51+ZXHKYLgJxFk0XHT1+S2JlFepS2
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://beirutrest.com - Port:
21 - Username:
[email protected] - Password:
9yXQ39wz(uL+
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 api.ipify.org 8 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2028 set thread context of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2412 RegSvcs.exe 2412 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr Token: SeDebugPrivilege 2412 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2028 wrote to memory of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28 PID 2028 wrote to memory of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28 PID 2028 wrote to memory of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28 PID 2028 wrote to memory of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28 PID 2028 wrote to memory of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28 PID 2028 wrote to memory of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28 PID 2028 wrote to memory of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28 PID 2028 wrote to memory of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28 PID 2028 wrote to memory of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28 PID 2028 wrote to memory of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28 PID 2028 wrote to memory of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28 PID 2028 wrote to memory of 2412 2028 KANG SHUN 88 V.2315 PARTICULARS.docx.scr 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\KANG SHUN 88 V.2315 PARTICULARS.docx.scr"C:\Users\Admin\AppData\Local\Temp\KANG SHUN 88 V.2315 PARTICULARS.docx.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2412
-