Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
13-09-2024 07:05
Static task
static1
Behavioral task
behavioral1
Sample
Shipping documents.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
Shipping documents.exe
Resource
win10v2004-20240802-en
General
-
Target
Shipping documents.exe
-
Size
714KB
-
MD5
21951471cfc7c9beee8e3768e5a7665d
-
SHA1
9de3b9262f971589fa4c50959aee765919886184
-
SHA256
b9fecad5e2608354188022661b5e468b713da87adaaeda9d574fd3526c39cde3
-
SHA512
e003272c18574d0664bb31d0ddb4bc98677ec7b1971f0ddff350cabd355a2411b95ac1f26e2f21d2e1fd1241ff7a070fe446325d83a9267ccf1cd97de7020e58
-
SSDEEP
12288:oeO6upxZF7RRfNBXyc8NTh0O0O0gui03jcntzLYBViwt5XH/kR:DupTXhClT0Ni03YnJY7iw5q
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.shaktiinstrumentations.in - Port:
587 - Username:
[email protected] - Password:
Shakti54231!@#$%#@! - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2592 powershell.exe 2648 powershell.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\boqXv = "C:\\Users\\Admin\\AppData\\Roaming\\boqXv\\boqXv.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2132 set thread context of 2996 2132 Shipping documents.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Shipping documents.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2132 Shipping documents.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2484 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2132 Shipping documents.exe 2132 Shipping documents.exe 2132 Shipping documents.exe 2132 Shipping documents.exe 2132 Shipping documents.exe 2132 Shipping documents.exe 2648 powershell.exe 2592 powershell.exe 2132 Shipping documents.exe 2996 RegSvcs.exe 2996 RegSvcs.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 2132 Shipping documents.exe Token: SeDebugPrivilege 2648 powershell.exe Token: SeDebugPrivilege 2592 powershell.exe Token: SeDebugPrivilege 2996 RegSvcs.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2132 wrote to memory of 2592 2132 Shipping documents.exe 28 PID 2132 wrote to memory of 2592 2132 Shipping documents.exe 28 PID 2132 wrote to memory of 2592 2132 Shipping documents.exe 28 PID 2132 wrote to memory of 2592 2132 Shipping documents.exe 28 PID 2132 wrote to memory of 2648 2132 Shipping documents.exe 30 PID 2132 wrote to memory of 2648 2132 Shipping documents.exe 30 PID 2132 wrote to memory of 2648 2132 Shipping documents.exe 30 PID 2132 wrote to memory of 2648 2132 Shipping documents.exe 30 PID 2132 wrote to memory of 2484 2132 Shipping documents.exe 32 PID 2132 wrote to memory of 2484 2132 Shipping documents.exe 32 PID 2132 wrote to memory of 2484 2132 Shipping documents.exe 32 PID 2132 wrote to memory of 2484 2132 Shipping documents.exe 32 PID 2132 wrote to memory of 2996 2132 Shipping documents.exe 34 PID 2132 wrote to memory of 2996 2132 Shipping documents.exe 34 PID 2132 wrote to memory of 2996 2132 Shipping documents.exe 34 PID 2132 wrote to memory of 2996 2132 Shipping documents.exe 34 PID 2132 wrote to memory of 2996 2132 Shipping documents.exe 34 PID 2132 wrote to memory of 2996 2132 Shipping documents.exe 34 PID 2132 wrote to memory of 2996 2132 Shipping documents.exe 34 PID 2132 wrote to memory of 2996 2132 Shipping documents.exe 34 PID 2132 wrote to memory of 2996 2132 Shipping documents.exe 34 PID 2132 wrote to memory of 2996 2132 Shipping documents.exe 34 PID 2132 wrote to memory of 2996 2132 Shipping documents.exe 34 PID 2132 wrote to memory of 2996 2132 Shipping documents.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Shipping documents.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2592
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TsEIVxgr.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2648
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TsEIVxgr" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA100.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2484
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54f13c7e235a302e9222dff26878069e6
SHA1dd5b84a109e87ff60e7b74ccd2b3d47b86164e29
SHA256d7e5d2f86b4ba13c9ca0bf10f9c7d2e9b642022791457eda106779a53697b99f
SHA51282312a3aa12d03b5c2eb9df769c146183b6621a69df675f8e277907644771ffc7804b0869f29f5c77de2b9b01805a0479189a09fd28414ddf7c7e0c1e1ae7536
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Filesize7KB
MD578f30dedb3f9b5cc0405592955d98337
SHA1fde7c06bab563a56d98396be4632ede3311798d4
SHA2562e9d63bd6b63fcadd40b3fdd409f6a3613147ee231c9f4a0f5151268cb4117c6
SHA5122afc46f6ca2e0e8eef09ebdb7bb1652c8b533b86e53c8979662e58d6d37cb0f79b720ba22ec880a778e35f728a733e10e66e2b03c48eca21bb6cea641b2a76d2