Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2024, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
AN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
AN.exe
Resource
win10v2004-20240802-en
General
-
Target
AN.exe
-
Size
730KB
-
MD5
d72520639cb73d3364d7258c15518f55
-
SHA1
6e1ebb649b0e00d4c8ebae01d481b4bd75b64eaf
-
SHA256
ca9f996e829c1e7ad89c66f78bde33741d46a0b7ed03c8892f263937b0e6b400
-
SHA512
207ab7047077f8c29ce24c46c2dc11ea5cbbbc2e00aa5955a3217518ffaf325c4cd2eb101be5d5885d9e78e6599402df7356bf4c02bd2bf8b32a3f62f9049be2
-
SSDEEP
12288:Zb9eGY0igo17oLwnqDUMeEDAYERZu9Kt0ZoV54IqOVEOYCa0qCkR:Zb8G/q1csnIuEobu97a54INCOsB
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.shaktiinstrumentations.in - Port:
587 - Username:
[email protected] - Password:
Shakti54231!@#$%#@! - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2776 powershell.exe 4816 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\Control Panel\International\Geo\Nation AN.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-656926755-4116854191-210765258-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2564 set thread context of 4416 2564 AN.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5028 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 2564 AN.exe 2564 AN.exe 2564 AN.exe 2564 AN.exe 2564 AN.exe 2564 AN.exe 2776 powershell.exe 2564 AN.exe 2564 AN.exe 2564 AN.exe 2564 AN.exe 4816 powershell.exe 2564 AN.exe 2776 powershell.exe 4416 RegSvcs.exe 4416 RegSvcs.exe 4816 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2564 AN.exe Token: SeDebugPrivilege 2776 powershell.exe Token: SeDebugPrivilege 4816 powershell.exe Token: SeDebugPrivilege 4416 RegSvcs.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2564 wrote to memory of 2776 2564 AN.exe 93 PID 2564 wrote to memory of 2776 2564 AN.exe 93 PID 2564 wrote to memory of 2776 2564 AN.exe 93 PID 2564 wrote to memory of 4816 2564 AN.exe 95 PID 2564 wrote to memory of 4816 2564 AN.exe 95 PID 2564 wrote to memory of 4816 2564 AN.exe 95 PID 2564 wrote to memory of 5028 2564 AN.exe 97 PID 2564 wrote to memory of 5028 2564 AN.exe 97 PID 2564 wrote to memory of 5028 2564 AN.exe 97 PID 2564 wrote to memory of 4900 2564 AN.exe 99 PID 2564 wrote to memory of 4900 2564 AN.exe 99 PID 2564 wrote to memory of 4900 2564 AN.exe 99 PID 2564 wrote to memory of 2152 2564 AN.exe 100 PID 2564 wrote to memory of 2152 2564 AN.exe 100 PID 2564 wrote to memory of 2152 2564 AN.exe 100 PID 2564 wrote to memory of 4416 2564 AN.exe 101 PID 2564 wrote to memory of 4416 2564 AN.exe 101 PID 2564 wrote to memory of 4416 2564 AN.exe 101 PID 2564 wrote to memory of 4416 2564 AN.exe 101 PID 2564 wrote to memory of 4416 2564 AN.exe 101 PID 2564 wrote to memory of 4416 2564 AN.exe 101 PID 2564 wrote to memory of 4416 2564 AN.exe 101 PID 2564 wrote to memory of 4416 2564 AN.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\AN.exe"C:\Users\Admin\AppData\Local\Temp\AN.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\AN.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dHTSFxSZNXvPYW.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4816
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dHTSFxSZNXvPYW" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE06D.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5028
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:4900
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵PID:2152
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4416
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5ee2024338976f196afc203dcb8dcbd7e
SHA1801cb4d3767aeae89ed0d305842f806fc832b1a2
SHA2565881f0746617ae728c44dfa3333ada55fa632a0b691b6aa3fbba49569cf710c7
SHA5122d0dc41cfb43a00bc4db612be8ec4492926ca4e6bd3264de0ff5f05e374e3e3770daacab4bc8e9b8afc66d155bb52cb7b292f0a977bc9bccc5cb6e93ea80f109
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD50be2c1db25dfe2a1448bcb81a64d8196
SHA1f64c0591eae8fb788feb391d24bdb4e1cca36110
SHA256fa9e767b2c0d5ad7f8d8d57150d68c84746058dfb891a79d8c5a40561e4c37f9
SHA512c1cb0840b38b45b37054f8994df066aad2730b5199eb8970531d990ea7613c14d865791e7407ee67981ccc21e256771ded3bba5a01343b6d86e33c695e232d10