Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 01:38 UTC

General

  • Target

    8e29aa00863b1746ba25132f7ecb7bcb869d3a7e647dc8d6d3255491c5ac5212.exe

  • Size

    934KB

  • MD5

    f7f32729079353000cd97b90aa314cc1

  • SHA1

    21dbddeea2b634263c8fbf0d6178a9751d2467b8

  • SHA256

    8e29aa00863b1746ba25132f7ecb7bcb869d3a7e647dc8d6d3255491c5ac5212

  • SHA512

    2c40c12b81e7c377ddf0a6691ebeedc895dcf02c9211a1563b840de735fab77968565b1d3d0c40cc0b2b583fd4bfa1c69f995fca758ea85f548bf5797b5bf847

  • SSDEEP

    24576:U5dMbYk7zL1hJ5o/C+uOWiw5h6nnjqKoe:U5dkYk/phQ6+hIkjqKoe

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.iaa-airferight.com
  • Port:
    587
  • Username:
    web@iaa-airferight.com
  • Password:
    webmaster
  • Email To:
    mail@iaa-airferight.com

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8e29aa00863b1746ba25132f7ecb7bcb869d3a7e647dc8d6d3255491c5ac5212.exe
    "C:\Users\Admin\AppData\Local\Temp\8e29aa00863b1746ba25132f7ecb7bcb869d3a7e647dc8d6d3255491c5ac5212.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2912
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\8e29aa00863b1746ba25132f7ecb7bcb869d3a7e647dc8d6d3255491c5ac5212.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4824
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TESAYt.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1116
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TESAYt" /XML "C:\Users\Admin\AppData\Local\Temp\tmpCF66.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3336
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:764

Network

  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    217.106.137.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    217.106.137.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    25.140.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    25.140.123.92.in-addr.arpa
    IN PTR
    Response
    25.140.123.92.in-addr.arpa
    IN PTR
    a92-123-140-25deploystaticakamaitechnologiescom
  • flag-us
    DNS
    4.159.190.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    4.159.190.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    95.221.229.192.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    95.221.229.192.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    28.118.140.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    28.118.140.52.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    api.ipify.org
    RegSvcs.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.12.205
    api.ipify.org
    IN A
    172.67.74.152
    api.ipify.org
    IN A
    104.26.13.205
  • flag-us
    GET
    https://api.ipify.org/
    RegSvcs.exe
    Remote address:
    104.26.12.205:443
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
    Host: api.ipify.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Sat, 14 Sep 2024 01:39:16 GMT
    Content-Type: text/plain
    Content-Length: 13
    Connection: keep-alive
    Vary: Origin
    CF-Cache-Status: DYNAMIC
    Server: cloudflare
    CF-RAY: 8c2ca98b0f954077-LHR
  • flag-us
    DNS
    205.12.26.104.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    205.12.26.104.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    103.169.127.40.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    103.169.127.40.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    171.39.242.20.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    171.39.242.20.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    240.143.123.92.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    240.143.123.92.in-addr.arpa
    IN PTR
    Response
    240.143.123.92.in-addr.arpa
    IN PTR
    a92-123-143-240deploystaticakamaitechnologiescom
  • flag-us
    DNS
    14.227.111.52.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    14.227.111.52.in-addr.arpa
    IN PTR
    Response
  • 104.26.12.205:443
    https://api.ipify.org/
    tls, http
    RegSvcs.exe
    854 B
    3.6kB
    9
    9

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 8.8.8.8:53
    8.8.8.8.in-addr.arpa
    dns
    66 B
    90 B
    1
    1

    DNS Request

    8.8.8.8.in-addr.arpa

  • 8.8.8.8:53
    217.106.137.52.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    217.106.137.52.in-addr.arpa

  • 8.8.8.8:53
    25.140.123.92.in-addr.arpa
    dns
    72 B
    137 B
    1
    1

    DNS Request

    25.140.123.92.in-addr.arpa

  • 8.8.8.8:53
    4.159.190.20.in-addr.arpa
    dns
    71 B
    157 B
    1
    1

    DNS Request

    4.159.190.20.in-addr.arpa

  • 8.8.8.8:53
    95.221.229.192.in-addr.arpa
    dns
    73 B
    144 B
    1
    1

    DNS Request

    95.221.229.192.in-addr.arpa

  • 8.8.8.8:53
    28.118.140.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    28.118.140.52.in-addr.arpa

  • 8.8.8.8:53
    api.ipify.org
    dns
    RegSvcs.exe
    59 B
    107 B
    1
    1

    DNS Request

    api.ipify.org

    DNS Response

    104.26.12.205
    172.67.74.152
    104.26.13.205

  • 8.8.8.8:53
    205.12.26.104.in-addr.arpa
    dns
    72 B
    134 B
    1
    1

    DNS Request

    205.12.26.104.in-addr.arpa

  • 8.8.8.8:53
    103.169.127.40.in-addr.arpa
    dns
    73 B
    147 B
    1
    1

    DNS Request

    103.169.127.40.in-addr.arpa

  • 8.8.8.8:53
    171.39.242.20.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    171.39.242.20.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    74 B
    128 B
    1
    1

    DNS Request

    172.214.232.199.in-addr.arpa

  • 8.8.8.8:53
    240.143.123.92.in-addr.arpa
    dns
    73 B
    139 B
    1
    1

    DNS Request

    240.143.123.92.in-addr.arpa

  • 8.8.8.8:53
    14.227.111.52.in-addr.arpa
    dns
    72 B
    158 B
    1
    1

    DNS Request

    14.227.111.52.in-addr.arpa

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    e363fd452e7724497ebff310b8807b84

    SHA1

    fa40b8b86bdcdd9fca30041a58bab547935b888a

    SHA256

    7ee3f467b296cdbcbd641969e6d108e9c3f6ae626638d2cbf59357379c4132be

    SHA512

    6dee0a90a2a07a3bf9e9009e0fd7b53b8ddd95ff40224851ed5f0bbce45f06bc52c35d05c948539f502173a3359fe86ac747660d7068567849cb973082cb117d

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1ijcil5w.12d.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmpCF66.tmp

    Filesize

    1KB

    MD5

    c20cea61cf52f47d051a3f0c2a79bcf0

    SHA1

    359ca974275eaa532682307b0c75d817c7dbebde

    SHA256

    f27ff36f82c623f9be195065ba843d6f69a89fd6b178acd15e3c994cb048b1fe

    SHA512

    4a09623b02efb1aa4c5306f486ae9e25277e286762cb86a124e83eadd77bdff74951e4a72313cf8ce4cfed06aebb30ae935144ff11319e06e5ce26422654a86b

  • memory/764-89-0x00000000065E0000-0x0000000006630000-memory.dmp

    Filesize

    320KB

  • memory/764-45-0x0000000000400000-0x0000000000440000-memory.dmp

    Filesize

    256KB

  • memory/1116-74-0x0000000007440000-0x000000000745A000-memory.dmp

    Filesize

    104KB

  • memory/1116-41-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

  • memory/1116-88-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

  • memory/1116-80-0x0000000007780000-0x000000000779A000-memory.dmp

    Filesize

    104KB

  • memory/1116-75-0x00000000074B0000-0x00000000074BA000-memory.dmp

    Filesize

    40KB

  • memory/1116-73-0x0000000007A90000-0x000000000810A000-memory.dmp

    Filesize

    6.5MB

  • memory/1116-61-0x00000000066B0000-0x00000000066CE000-memory.dmp

    Filesize

    120KB

  • memory/1116-63-0x0000000007360000-0x0000000007403000-memory.dmp

    Filesize

    652KB

  • memory/1116-50-0x0000000007320000-0x0000000007352000-memory.dmp

    Filesize

    200KB

  • memory/1116-19-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

  • memory/1116-51-0x000000006F450000-0x000000006F49C000-memory.dmp

    Filesize

    304KB

  • memory/1116-49-0x00000000066E0000-0x000000000672C000-memory.dmp

    Filesize

    304KB

  • memory/1116-48-0x0000000005B80000-0x0000000005B9E000-memory.dmp

    Filesize

    120KB

  • memory/2912-6-0x0000000006B90000-0x0000000006BA0000-memory.dmp

    Filesize

    64KB

  • memory/2912-0-0x000000007471E000-0x000000007471F000-memory.dmp

    Filesize

    4KB

  • memory/2912-1-0x0000000000750000-0x000000000083A000-memory.dmp

    Filesize

    936KB

  • memory/2912-8-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

  • memory/2912-2-0x0000000005720000-0x0000000005CC4000-memory.dmp

    Filesize

    5.6MB

  • memory/2912-4-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

  • memory/2912-47-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

  • memory/2912-5-0x00000000052E0000-0x00000000052EA000-memory.dmp

    Filesize

    40KB

  • memory/2912-7-0x000000007471E000-0x000000007471F000-memory.dmp

    Filesize

    4KB

  • memory/2912-3-0x0000000005210000-0x00000000052A2000-memory.dmp

    Filesize

    584KB

  • memory/2912-9-0x0000000006BC0000-0x0000000006C42000-memory.dmp

    Filesize

    520KB

  • memory/2912-10-0x0000000009190000-0x000000000922C000-memory.dmp

    Filesize

    624KB

  • memory/4824-16-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

  • memory/4824-78-0x00000000073D0000-0x00000000073DE000-memory.dmp

    Filesize

    56KB

  • memory/4824-17-0x0000000004FA0000-0x00000000055C8000-memory.dmp

    Filesize

    6.2MB

  • memory/4824-15-0x00000000048D0000-0x0000000004906000-memory.dmp

    Filesize

    216KB

  • memory/4824-62-0x000000006F450000-0x000000006F49C000-memory.dmp

    Filesize

    304KB

  • memory/4824-76-0x0000000007420000-0x00000000074B6000-memory.dmp

    Filesize

    600KB

  • memory/4824-77-0x00000000073A0000-0x00000000073B1000-memory.dmp

    Filesize

    68KB

  • memory/4824-21-0x0000000005720000-0x0000000005786000-memory.dmp

    Filesize

    408KB

  • memory/4824-79-0x00000000073E0000-0x00000000073F4000-memory.dmp

    Filesize

    80KB

  • memory/4824-18-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

  • memory/4824-81-0x00000000074C0000-0x00000000074C8000-memory.dmp

    Filesize

    32KB

  • memory/4824-84-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

  • memory/4824-20-0x0000000005600000-0x0000000005622000-memory.dmp

    Filesize

    136KB

  • memory/4824-40-0x00000000059B0000-0x0000000005D04000-memory.dmp

    Filesize

    3.3MB

  • memory/4824-22-0x0000000005840000-0x00000000058A6000-memory.dmp

    Filesize

    408KB

  • memory/4824-39-0x0000000074710000-0x0000000074EC0000-memory.dmp

    Filesize

    7.7MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.