Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
100s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
11/09/2024, 15:04 UTC
General
-
Target
4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe
-
Size
1.2MB
-
MD5
ddbaaa52ea1192377573a76e4ac8fb7b
-
SHA1
0c86f1126bde5a0ab4d5dc8eb2e7aeb8b824d474
-
SHA256
4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897
-
SHA512
9c01f8e5aed73ee59c710d19c711cc360eed010b3176973369c7f329ab6964946078df8c38159adef428680f42836edc773bfb8455cad25be404082ad51c4c0b
-
SSDEEP
24576:6AHnh+eWsN3skA4RV1Hom2KXMmHa1LodOtZQo4CPAuK85:Nh+ZkldoPK8Ya1sdOtZzPL
Score
10/10
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of FindShellTrayWindow 4 IoCs
-
Suspicious use of SendNotifyMessage 4 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe"C:\Users\Admin\AppData\Local\Temp\4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe"C:\Users\Admin\AppData\Local\Temp\4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\4122f1d85ffb12401925c52470a6a3f4cc75e02546069894ed33ce7a6dd81897.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
-
DNS232.168.11.51.in-addr.arpaRemote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse -
DNS73.144.22.2.in-addr.arpaRemote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
DNS95.221.229.192.in-addr.arpaRemote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
DNS21.53.126.40.in-addr.arpaRemote address:8.8.8.8:53Request21.53.126.40.in-addr.arpaIN PTRResponse
-
DNSapi.ipify.orgRemote address:8.8.8.8:53Requestapi.ipify.orgIN AResponseapi.ipify.orgIN A104.26.13.205api.ipify.orgIN A172.67.74.152api.ipify.orgIN A104.26.12.205
-
GEThttps://api.ipify.org/Remote address:104.26.13.205:443RequestGET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Host: api.ipify.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Wed, 11 Sep 2024 15:04:50 GMT
Content-Type: text/plain
Content-Length: 13
Connection: keep-alive
Vary: Origin
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 8c188d72eeff9407-LHR
-
DNS205.13.26.104.in-addr.arpaRemote address:8.8.8.8:53Request205.13.26.104.in-addr.arpaIN PTRResponse
-
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
DNS183.59.114.20.in-addr.arpaRemote address:8.8.8.8:53Request183.59.114.20.in-addr.arpaIN PTRResponse
-
DNS18.31.95.13.in-addr.arpaRemote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
DNS18.31.95.13.in-addr.arpaRemote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTR
-
DNS18.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request18.134.221.88.in-addr.arpaIN PTRResponse18.134.221.88.in-addr.arpaIN PTRa88-221-134-18deploystaticakamaitechnologiescom
-
DNS81.144.22.2.in-addr.arpaRemote address:8.8.8.8:53Request81.144.22.2.in-addr.arpaIN PTRResponse81.144.22.2.in-addr.arpaIN PTRa2-22-144-81deploystaticakamaitechnologiescom
-
DNS11.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request11.227.111.52.in-addr.arpaIN PTRResponse
-
104.26.13.205:443https://api.ipify.org/tls, http
HTTP Request
GET https://api.ipify.org/HTTP Response
200
-
8.8.8.8:53232.168.11.51.in-addr.arpadns
DNS Request
232.168.11.51.in-addr.arpa
-
8.8.8.8:5373.144.22.2.in-addr.arpadns
DNS Request
73.144.22.2.in-addr.arpa
-
8.8.8.8:5395.221.229.192.in-addr.arpadns
DNS Request
95.221.229.192.in-addr.arpa
-
8.8.8.8:5321.53.126.40.in-addr.arpadns
DNS Request
21.53.126.40.in-addr.arpa
-
8.8.8.8:53api.ipify.orgdns
DNS Request
api.ipify.org
DNS Response
104.26.13.205172.67.74.152104.26.12.205
-
8.8.8.8:53205.13.26.104.in-addr.arpadns
DNS Request
205.13.26.104.in-addr.arpa
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
-
8.8.8.8:53183.59.114.20.in-addr.arpadns
DNS Request
183.59.114.20.in-addr.arpa
-
8.8.8.8:5318.31.95.13.in-addr.arpadns
DNS Request
18.31.95.13.in-addr.arpa
DNS Request
18.31.95.13.in-addr.arpa
-
8.8.8.8:5318.134.221.88.in-addr.arpadns
DNS Request
18.134.221.88.in-addr.arpa
-
8.8.8.8:5381.144.22.2.in-addr.arpadns
DNS Request
81.144.22.2.in-addr.arpa
-
8.8.8.8:5311.227.111.52.in-addr.arpadns
DNS Request
11.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
262KB
MD539bfd01ef86bab66becbfbd05a892e07
SHA1f90aa1a123767bdabab7e5a4a40fe39c1189043c
SHA2566f5072e621095e8f3b731bb3af454ff9d7dd2117415d1fdd6a4916d7e377f388
SHA51230ef46ac8b1ed2f7afd13131ba34a289101e1b7e7c751b1f50dc49f9ba93ccfddff6888bd692fe237f554dec089de0d6c4d3a25d99eadb3aeb7e07429c913c91
-
Filesize
308KB
-
Filesize
7.7MB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
280KB
-
Filesize
4KB
-
Filesize
336KB
-
Filesize
5.6MB
-
Filesize
7.7MB
-
Filesize
308KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
280KB
-
Filesize
308KB
-
Filesize
336KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
308KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
584KB
-
Filesize
280KB
-
Filesize
16KB