Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

Invoice Re...cr.exe

windows7-x64

10

Invoice Re...cr.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    116s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/09/2024, 13:56 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Invoice Request.scr.exe

  • Size

    701KB

  • MD5

    6f605fd10c79ec475befda0cd232f38b

  • SHA1

    8b015776a4e0e1ba8495f89296b4eb5293faba33

  • SHA256

    c41893463c861e8d6274f2d5f5335ba4d23dfe4c6d6d65d8bc08eec140b4890d

  • SHA512

    24de79629da70f73f56576438965b653578888576be7013cc814af92c7cba1ae29517e245b0469ee842133c16a00611b3b96b87432c23c13093e0062f301d823

  • SSDEEP

    12288:ksK8s/+/yHUvONddAckNe5xAkO5IGGswKPS3JFn0C53tqksN7t0lTO3tz0:RiMywONddAdN2ek975n3a97mO9

Score
10/10
agentteslacredential_accessdiscoveryexecutionkeyloggerpersistencespywarestealertrojan

Malware Config

Extracted

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    wethem@aklaneah-sa.com
  • Password:
    Password: )NYyffR0

Extracted

Family

agenttesla

Credentials

  • Protocol:     smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    wethem@aklaneah-sa.com
  • Password:
    Password: )NYyffR0
  • Email To:
    wethem@aklaneah-sa.com

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

    keyloggertrojanstealerspywareagenttesla
  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

    credential_accessstealer
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Invoice Request.scr.exe
    "C:\Users\Admin\AppData\Local\Temp\Invoice Request.scr.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1508
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Invoice Request.scr.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4860
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\PPTPXSGOk.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1284
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\PPTPXSGOk" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA42F.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2228
    • C:\Users\Admin\AppData\Local\Temp\Invoice Request.scr.exe
      "C:\Users\Admin\AppData\Local\Temp\Invoice Request.scr.exe"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4240

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    154.239.44.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    154.239.44.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    73.144.22.2.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.144.22.2.in-addr.arpa
    IN PTR
    Response
    73.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-73deploystaticakamaitechnologiescom
  • flag-us
    DNS
    73.31.126.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    73.31.126.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    104.219.191.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    104.219.191.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    api.ipify.org
    Invoice Request.scr.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.12.205
    api.ipify.org
    IN A
    104.26.13.205
    api.ipify.org
    IN A
    172.67.74.152
  • flag-us
    GET
    https://api.ipify.org/
    Invoice Request.scr.exe
    Remote address:
    104.26.12.205:443
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
    Host: api.ipify.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Tue, 10 Sep 2024 13:56:24 GMT
    Content-Type: text/plain
    Content-Length: 13
    Connection: keep-alive
    Vary: Origin
    CF-Cache-Status: DYNAMIC
    Server: cloudflare
    CF-RAY: 8c0febd43cfd76c6-LHR
  • flag-us
    DNS
    205.12.26.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.12.26.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    us2.smtp.mailhostbox.com
    Invoice Request.scr.exe
    Remote address:
    8.8.8.8:53
    Request
    us2.smtp.mailhostbox.com
    IN A
    Response
    us2.smtp.mailhostbox.com
    IN A
    208.91.199.223
    us2.smtp.mailhostbox.com
    IN A
    208.91.198.143
    us2.smtp.mailhostbox.com
    IN A
    208.91.199.225
    us2.smtp.mailhostbox.com
    IN A
    208.91.199.224
  • flag-us
    DNS
    223.199.91.208.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    223.199.91.208.in-addr.arpa
    IN PTR
    Response
    223.199.91.208.in-addr.arpa
    IN PTR
    208-91-199-223 unifiedlayercom
  • flag-us
    DNS
    86.23.85.13.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    86.23.85.13.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    15.164.165.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    15.164.165.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    65.139.73.23.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    65.139.73.23.in-addr.arpa
    IN PTR
    Response
    65.139.73.23.in-addr.arpa
    IN PTR
    a23-73-139-65deploystaticakamaitechnologiescom
  • flag-us
    DNS
    0.205.248.87.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.205.248.87.in-addr.arpa
    IN PTR
    Response
    0.205.248.87.in-addr.arpa
    IN PTR
    https-87-248-205-0lgwllnwnet
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.210.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.210.232.199.in-addr.arpa
    IN PTR
  • flag-us
    DNS
    19.229.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    19.229.111.52.in-addr.arpa
    IN PTR
    Response
  • 104.26.12.205:443
    https://api.ipify.org/
    tls, http
    Invoice Request.scr.exe
    854 B
     3.6kB
     9
    9

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 208.91.199.223:587
    us2.smtp.mailhostbox.com
    smtp
    Invoice Request.scr.exe
    2.9kB
     7.1kB
     24
    23
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
     90 B
     1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    154.239.44.20.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    154.239.44.20.in-addr.arpa

  • 8.8.8.8:53
    73.144.22.2.in-addr.arpa
    dns
    70 B
     133 B
     1
    1

    DNS Request

    73.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    73.31.126.40.in-addr.arpa
    dns
    71 B
     157 B
     1
    1

    DNS Request

    73.31.126.40.in-addr.arpa

  • 8.8.8.8:53
    104.219.191.52.in-addr.arpa
    dns
    73 B
     147 B
     1
    1

    DNS Request

    104.219.191.52.in-addr.arpa

  • 8.8.8.8:53
    api.ipify.org
    dns
    Invoice Request.scr.exe
    59 B
     107 B
     1
    1

    DNS Request

    api.ipify.org

    DNS Response

    104.26.12.205
    104.26.13.205
    172.67.74.152

  • 8.8.8.8:53
    205.12.26.104.in-addr.arpa
    dns
    72 B
     134 B
     1
    1

    DNS Request

    205.12.26.104.in-addr.arpa

  • 8.8.8.8:53
    us2.smtp.mailhostbox.com
    dns
    Invoice Request.scr.exe
    70 B
     134 B
     1
    1

    DNS Request

    us2.smtp.mailhostbox.com

    DNS Response

    208.91.199.223
    208.91.198.143
    208.91.199.225
    208.91.199.224

  • 8.8.8.8:53
    223.199.91.208.in-addr.arpa
    dns
    73 B
     118 B
     1
    1

    DNS Request

    223.199.91.208.in-addr.arpa

  • 8.8.8.8:53
    86.23.85.13.in-addr.arpa
    dns
    70 B
     144 B
     1
    1

    DNS Request

    86.23.85.13.in-addr.arpa

  • 8.8.8.8:53
    15.164.165.52.in-addr.arpa
    dns
    72 B
     146 B
     1
    1

    DNS Request

    15.164.165.52.in-addr.arpa

  • 8.8.8.8:53
    65.139.73.23.in-addr.arpa
    dns
    71 B
     135 B
     1
    1

    DNS Request

    65.139.73.23.in-addr.arpa

  • 8.8.8.8:53
    0.205.248.87.in-addr.arpa
    dns
    71 B
     116 B
     1
    1

    DNS Request

    0.205.248.87.in-addr.arpa

  • 8.8.8.8:53
    172.210.232.199.in-addr.arpa
    dns
    148 B
     128 B
     2
    1

    DNS Request

    172.210.232.199.in-addr.arpa

    DNS Request

    172.210.232.199.in-addr.arpa

  • 8.8.8.8:53
    19.229.111.52.in-addr.arpa
    dns
    72 B
     158 B
     1
    1

    DNS Request

    19.229.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1
T1059

PowerShell

1
T1059.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Scheduled Task/Job

1
T1053

Scheduled Task

1
T1053.005

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials from Password Stores

1
T1555

Credentials from Web Browsers

1
T1555.003

Unsecured Credentials

4
T1552

Credentials In Files

3
T1552.001

Credentials in Registry

1
T1552.002

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

System Location Discovery

1
T1614

System Language Discovery

1
T1614.001

Lateral Movement

Collection

Data from Local System

4
T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
    Filesize

    2KB

    MD5

    3d086a433708053f9bf9523e1d87a4e8

    SHA1

    b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

    SHA256

    6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

    SHA512

    931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

    Download Submit

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
    Filesize

    18KB

    MD5

    554a68428239878d2a4740b1ebd5e89c

    SHA1

    0ff24cb9925c62a00f2569adc5c48bed99a89a6d

    SHA256

    65a23ab89f7a918c6d3ee2a18f87c956462f9d9b06ab453d94c764eac3d3f100

    SHA512

    89eaa5a6c383e4c6726cba4943cdb91296ae40155de236f0bf06ef5f81a0ccdcd9147d70d953215cd9abcd83d591037510e794695b6372506256225b21e13f12

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ffkmaske.22p.ps1
    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\tmpA42F.tmp
    Filesize

    1KB

    MD5

    f794788e059ab6bc75ee509c786d5c19

    SHA1

    a40e6f614dc7b40a8ae3696ad2d7f1bb68074c69

    SHA256

    4fc59f86528aac24408d24273f67b093536b5c1cd7442758b8a851ea1e7737d7

    SHA512

    cef7d40e8ce4cc09b24ce5ed4d0dc70ae88b364139f4803bbffe080e5c0c2b650b9332b89deb3c391ce6068c4cb1d8ecdeb6be05b4fd51c574eac646acc264ef

    Download Submit

  • memory/1284-46-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/1284-67-0x0000000075670000-0x00000000756BC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1284-81-0x0000000007C40000-0x0000000007C54000-memory.dmp

    Filesize

    80KB

    Download

  • memory/1284-82-0x0000000007D40000-0x0000000007D5A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/1284-83-0x0000000007D20000-0x0000000007D28000-memory.dmp

    Filesize

    32KB

    Download

  • memory/1284-21-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/1284-20-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/1284-87-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/1508-6-0x0000000007F40000-0x0000000007FDA000-memory.dmp

    Filesize

    616KB

    Download

  • memory/1508-49-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/1508-11-0x000000000A6B0000-0x000000000A74C000-memory.dmp

    Filesize

    624KB

    Download

  • memory/1508-10-0x0000000006A20000-0x0000000006AA2000-memory.dmp

    Filesize

    520KB

    Download

  • memory/1508-9-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/1508-8-0x0000000074E0E000-0x0000000074E0F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1508-7-0x0000000005830000-0x0000000005840000-memory.dmp

    Filesize

    64KB

    Download

  • memory/1508-1-0x0000000000AC0000-0x0000000000B74000-memory.dmp

    Filesize

    720KB

    Download

  • memory/1508-4-0x0000000005540000-0x000000000554A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/1508-5-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/1508-3-0x00000000055B0000-0x0000000005642000-memory.dmp

    Filesize

    584KB

    Download

  • memory/1508-2-0x0000000005AC0000-0x0000000006064000-memory.dmp

    Filesize

    5.6MB

    Download

  • memory/1508-0-0x0000000074E0E000-0x0000000074E0F000-memory.dmp

    Filesize

    4KB

    Download

  • memory/4240-92-0x0000000006980000-0x00000000069D0000-memory.dmp

    Filesize

    320KB

    Download

  • memory/4240-47-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

    Download

  • memory/4860-33-0x0000000005AA0000-0x0000000005DF4000-memory.dmp

    Filesize

    3.3MB

    Download

  • memory/4860-50-0x0000000006070000-0x000000000608E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/4860-51-0x00000000064C0000-0x000000000650C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4860-63-0x0000000006690000-0x00000000066AE000-memory.dmp

    Filesize

    120KB

    Download

  • memory/4860-64-0x0000000007260000-0x0000000007303000-memory.dmp

    Filesize

    652KB

    Download

  • memory/4860-53-0x0000000075670000-0x00000000756BC000-memory.dmp

    Filesize

    304KB

    Download

  • memory/4860-52-0x0000000006630000-0x0000000006662000-memory.dmp

    Filesize

    200KB

    Download

  • memory/4860-28-0x0000000005230000-0x0000000005296000-memory.dmp

    Filesize

    408KB

    Download

  • memory/4860-66-0x0000000007380000-0x000000000739A000-memory.dmp

    Filesize

    104KB

    Download

  • memory/4860-65-0x0000000007A30000-0x00000000080AA000-memory.dmp

    Filesize

    6.5MB

    Download

  • memory/4860-77-0x0000000007400000-0x000000000740A000-memory.dmp

    Filesize

    40KB

    Download

  • memory/4860-78-0x0000000007610000-0x00000000076A6000-memory.dmp

    Filesize

    600KB

    Download

  • memory/4860-79-0x0000000007590000-0x00000000075A1000-memory.dmp

    Filesize

    68KB

    Download

  • memory/4860-31-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4860-29-0x0000000005A30000-0x0000000005A96000-memory.dmp

    Filesize

    408KB

    Download

  • memory/4860-22-0x0000000005190000-0x00000000051B2000-memory.dmp

    Filesize

    136KB

    Download

  • memory/4860-80-0x00000000075C0000-0x00000000075CE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/4860-19-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4860-91-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4860-17-0x0000000074E00000-0x00000000755B0000-memory.dmp

    Filesize

    7.7MB

    Download

  • memory/4860-18-0x0000000005400000-0x0000000005A28000-memory.dmp

    Filesize

    6.2MB

    Download

  • memory/4860-16-0x0000000002750000-0x0000000002786000-memory.dmp

    Filesize

    216KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.