Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    04/09/2024, 12:56 UTC

General

  • Target

    9f217c76382154ea54d5cbe9a62acedf4e8cccfb90bb16227e5044abe24617e8.exe

  • Size

    601KB

  • MD5

    8aecd8772a6d26793f728d7e6ec1f0dd

  • SHA1

    ad20de78f02ffaa5988d2ad0b30dc6d742fc685b

  • SHA256

    9f217c76382154ea54d5cbe9a62acedf4e8cccfb90bb16227e5044abe24617e8

  • SHA512

    291acbfdf9be2d86692a337edf3bc30eb2b0e67443f389daf905ec3aef62675a3d2ff7c96047d2f08fa1c3caf8aa3d7a5f002a3e26fb770cf6358bf31b2b265d

  • SSDEEP

    12288:F8G1KBsJpv1Ikv+f3ksuggndBgacaY0769W6rcth5UVnKY:NYBa1IksZuZ4aY0m5+h5UVKY

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    cp5ua.hyperhost.ua
  • Port:
    587
  • Username:
    projectlog@aflacltd.top
  • Password:
    7213575aceACE@#
  • Email To:
    project@aflacltd.top

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9f217c76382154ea54d5cbe9a62acedf4e8cccfb90bb16227e5044abe24617e8.exe
    "C:\Users\Admin\AppData\Local\Temp\9f217c76382154ea54d5cbe9a62acedf4e8cccfb90bb16227e5044abe24617e8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Users\Admin\AppData\Local\Temp\9f217c76382154ea54d5cbe9a62acedf4e8cccfb90bb16227e5044abe24617e8.exe
      "C:\Users\Admin\AppData\Local\Temp\9f217c76382154ea54d5cbe9a62acedf4e8cccfb90bb16227e5044abe24617e8.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2656

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2656-21-0x0000000000190000-0x00000000001D0000-memory.dmp

    Filesize

    256KB

  • memory/2656-7-0x0000000000190000-0x00000000001D0000-memory.dmp

    Filesize

    256KB

  • memory/2656-25-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2656-23-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2656-22-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2656-9-0x0000000000190000-0x00000000001D0000-memory.dmp

    Filesize

    256KB

  • memory/2656-14-0x0000000000190000-0x00000000001D0000-memory.dmp

    Filesize

    256KB

  • memory/2656-13-0x0000000000190000-0x00000000001D0000-memory.dmp

    Filesize

    256KB

  • memory/2656-18-0x0000000000190000-0x00000000001D0000-memory.dmp

    Filesize

    256KB

  • memory/2656-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2656-10-0x0000000000190000-0x00000000001D0000-memory.dmp

    Filesize

    256KB

  • memory/2656-6-0x0000000000190000-0x00000000001D0000-memory.dmp

    Filesize

    256KB

  • memory/2764-0-0x0000000074ACE000-0x0000000074ACF000-memory.dmp

    Filesize

    4KB

  • memory/2764-1-0x0000000000040000-0x00000000000DC000-memory.dmp

    Filesize

    624KB

  • memory/2764-4-0x0000000000880000-0x0000000000888000-memory.dmp

    Filesize

    32KB

  • memory/2764-3-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2764-24-0x0000000074AC0000-0x00000000751AE000-memory.dmp

    Filesize

    6.9MB

  • memory/2764-2-0x0000000000810000-0x000000000087E000-memory.dmp

    Filesize

    440KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.