Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    117s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/09/2024, 05:32 UTC

General

  • Target

    Telco 32pcs New Purchase Order.exe

  • Size

    968KB

  • MD5

    8d310f2e831174aac8eaa5eba20e87ad

  • SHA1

    600ef55976b69523c7973c5d0aeeb91f3fdcf97e

  • SHA256

    457b6241f125cd8c4f030e7b7f05829b89a5e831f624225cb70ea272ecd88876

  • SHA512

    a8a58d69131ae7b6736af515ad800eebe123df03c8c5b909e24ae64e382f310835f984d045f97aabe11a0f489e614b1d8d516add24d9cfde6f261ca88af75839

  • SSDEEP

    24576:izFcFCG6ra2QIi2zGc9rwZTkfrw6bMfR1q:izFcsG3ZDc9riI0q

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    mail.iaa-airferight.com
  • Port:
    587
  • Username:
    mail@iaa-airferight.com
  • Password:
    Asaprocky11
  • Email To:
    web@iaa-airferight.com

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Telco 32pcs New Purchase Order.exe
    "C:\Users\Admin\AppData\Local\Temp\Telco 32pcs New Purchase Order.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1320
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Telco 32pcs New Purchase Order.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4472
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\zBzzGAdzqF.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5000
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\zBzzGAdzqF" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD10B.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:4272
    • C:\Users\Admin\AppData\Local\Temp\Telco 32pcs New Purchase Order.exe
      "C:\Users\Admin\AppData\Local\Temp\Telco 32pcs New Purchase Order.exe"
      2⤵
        PID:1524
      • C:\Users\Admin\AppData\Local\Temp\Telco 32pcs New Purchase Order.exe
        "C:\Users\Admin\AppData\Local\Temp\Telco 32pcs New Purchase Order.exe"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:5064

    Network

    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      88.210.23.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      88.210.23.2.in-addr.arpa
      IN PTR
      Response
      88.210.23.2.in-addr.arpa
      IN PTR
      a2-23-210-88deploystaticakamaitechnologiescom
    • flag-us
      DNS
      136.32.126.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      136.32.126.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      api.ipify.org
      Telco 32pcs New Purchase Order.exe
      Remote address:
      8.8.8.8:53
      Request
      api.ipify.org
      IN A
      Response
      api.ipify.org
      IN A
      172.67.74.152
      api.ipify.org
      IN A
      104.26.12.205
      api.ipify.org
      IN A
      104.26.13.205
    • flag-us
      GET
      https://api.ipify.org/
      Telco 32pcs New Purchase Order.exe
      Remote address:
      172.67.74.152:443
      Request
      GET / HTTP/1.1
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
      Host: api.ipify.org
      Connection: Keep-Alive
      Response
      HTTP/1.1 200 OK
      Date: Thu, 26 Sep 2024 05:32:26 GMT
      Content-Type: text/plain
      Content-Length: 13
      Connection: keep-alive
      Vary: Origin
      CF-Cache-Status: DYNAMIC
      Server: cloudflare
      CF-RAY: 8c90df99287b63aa-LHR
    • flag-us
      DNS
      152.74.67.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      152.74.67.172.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      mail.iaa-airferight.com
      Telco 32pcs New Purchase Order.exe
      Remote address:
      8.8.8.8:53
      Request
      mail.iaa-airferight.com
      IN A
      Response
      mail.iaa-airferight.com
      IN A
      46.175.148.58
    • flag-us
      DNS
      133.211.185.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      133.211.185.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      56.163.245.4.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      56.163.245.4.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      18.31.95.13.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      18.31.95.13.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      75.117.19.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      75.117.19.2.in-addr.arpa
      IN PTR
      Response
      75.117.19.2.in-addr.arpa
      IN PTR
      a2-19-117-75deploystaticakamaitechnologiescom
    • flag-us
      DNS
      172.214.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.214.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      172.210.232.199.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      172.210.232.199.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      11.227.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      11.227.111.52.in-addr.arpa
      IN PTR
      Response
    • 172.67.74.152:443
      https://api.ipify.org/
      tls, http
      Telco 32pcs New Purchase Order.exe
      854 B
      3.6kB
      9
      9

      HTTP Request

      GET https://api.ipify.org/

      HTTP Response

      200
    • 46.175.148.58:25
      mail.iaa-airferight.com
      Telco 32pcs New Purchase Order.exe
      260 B
      5
    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      88.210.23.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      88.210.23.2.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
      144 B
      1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      136.32.126.40.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      136.32.126.40.in-addr.arpa

    • 8.8.8.8:53
      api.ipify.org
      dns
      Telco 32pcs New Purchase Order.exe
      59 B
      107 B
      1
      1

      DNS Request

      api.ipify.org

      DNS Response

      172.67.74.152
      104.26.12.205
      104.26.13.205

    • 8.8.8.8:53
      152.74.67.172.in-addr.arpa
      dns
      72 B
      134 B
      1
      1

      DNS Request

      152.74.67.172.in-addr.arpa

    • 8.8.8.8:53
      mail.iaa-airferight.com
      dns
      Telco 32pcs New Purchase Order.exe
      69 B
      85 B
      1
      1

      DNS Request

      mail.iaa-airferight.com

      DNS Response

      46.175.148.58

    • 8.8.8.8:53
      133.211.185.52.in-addr.arpa
      dns
      73 B
      147 B
      1
      1

      DNS Request

      133.211.185.52.in-addr.arpa

    • 8.8.8.8:53
      56.163.245.4.in-addr.arpa
      dns
      71 B
      157 B
      1
      1

      DNS Request

      56.163.245.4.in-addr.arpa

    • 8.8.8.8:53
      18.31.95.13.in-addr.arpa
      dns
      70 B
      144 B
      1
      1

      DNS Request

      18.31.95.13.in-addr.arpa

    • 8.8.8.8:53
      75.117.19.2.in-addr.arpa
      dns
      70 B
      133 B
      1
      1

      DNS Request

      75.117.19.2.in-addr.arpa

    • 8.8.8.8:53
      172.214.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.214.232.199.in-addr.arpa

    • 8.8.8.8:53
      172.210.232.199.in-addr.arpa
      dns
      74 B
      128 B
      1
      1

      DNS Request

      172.210.232.199.in-addr.arpa

    • 8.8.8.8:53
      11.227.111.52.in-addr.arpa
      dns
      72 B
      158 B
      1
      1

      DNS Request

      11.227.111.52.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Telco 32pcs New Purchase Order.exe.log

      Filesize

      1KB

      MD5

      8ec831f3e3a3f77e4a7b9cd32b48384c

      SHA1

      d83f09fd87c5bd86e045873c231c14836e76a05c

      SHA256

      7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

      SHA512

      26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

      Filesize

      2KB

      MD5

      968cb9309758126772781b83adb8a28f

      SHA1

      8da30e71accf186b2ba11da1797cf67f8f78b47c

      SHA256

      92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

      SHA512

      4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

      Filesize

      18KB

      MD5

      b5688854bc1c8e4aeb735aae66f8c544

      SHA1

      60e129baba4056a8a731204bb2497d295c126b43

      SHA256

      d4edd2ad908125aa1c0a502073334d6bd8ebdf8dbebee28083ea5d544aae0963

      SHA512

      17ea212d54ffae76199cab6c58adde5ebf0154e16d5dd0e30042ceca43dfbad82b056f096b87e8fc8ce4d85d377ddd8cdc61664720dd066189f00cd8a699ea26

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_skonnvy4.rjp.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\tmpD10B.tmp

      Filesize

      1KB

      MD5

      03f33e2397941515872689b5f25da731

      SHA1

      3cdfd0d208897d10241594d43687abd3f5c9005d

      SHA256

      eaf3542164e89a005c6b7092de8cba45461993fa954ac1f190fe8324f2bd97d9

      SHA512

      a6308d52ac5aed61fec9ca5133d5c00af6b05d5df6ad021aca9e9d178c4c6ff6fe216355d3c95e1e5600abc999cdc327756556b18135b15382be8bdf371a075a

    • memory/1320-9-0x00000000084E0000-0x0000000008564000-memory.dmp

      Filesize

      528KB

    • memory/1320-5-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/1320-7-0x000000007518E000-0x000000007518F000-memory.dmp

      Filesize

      4KB

    • memory/1320-8-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/1320-0-0x000000007518E000-0x000000007518F000-memory.dmp

      Filesize

      4KB

    • memory/1320-10-0x000000000ACB0000-0x000000000AD4C000-memory.dmp

      Filesize

      624KB

    • memory/1320-49-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/1320-1-0x0000000000B10000-0x0000000000C04000-memory.dmp

      Filesize

      976KB

    • memory/1320-2-0x0000000005B50000-0x00000000060F4000-memory.dmp

      Filesize

      5.6MB

    • memory/1320-3-0x00000000054D0000-0x0000000005562000-memory.dmp

      Filesize

      584KB

    • memory/1320-6-0x0000000005B40000-0x0000000005B52000-memory.dmp

      Filesize

      72KB

    • memory/1320-4-0x00000000054C0000-0x00000000054CA000-memory.dmp

      Filesize

      40KB

    • memory/4472-31-0x0000000005AF0000-0x0000000005E44000-memory.dmp

      Filesize

      3.3MB

    • memory/4472-50-0x00000000060D0000-0x00000000060EE000-memory.dmp

      Filesize

      120KB

    • memory/4472-22-0x0000000005A80000-0x0000000005AE6000-memory.dmp

      Filesize

      408KB

    • memory/4472-21-0x00000000059A0000-0x0000000005A06000-memory.dmp

      Filesize

      408KB

    • memory/4472-89-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/4472-19-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/4472-18-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/4472-16-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/4472-17-0x0000000005370000-0x0000000005998000-memory.dmp

      Filesize

      6.2MB

    • memory/4472-15-0x0000000004B70000-0x0000000004BA6000-memory.dmp

      Filesize

      216KB

    • memory/4472-83-0x0000000007730000-0x0000000007738000-memory.dmp

      Filesize

      32KB

    • memory/4472-20-0x0000000005220000-0x0000000005242000-memory.dmp

      Filesize

      136KB

    • memory/4472-51-0x0000000006190000-0x00000000061DC000-memory.dmp

      Filesize

      304KB

    • memory/4472-52-0x00000000070C0000-0x00000000070F2000-memory.dmp

      Filesize

      200KB

    • memory/4472-63-0x0000000006690000-0x00000000066AE000-memory.dmp

      Filesize

      120KB

    • memory/4472-53-0x00000000759F0000-0x0000000075A3C000-memory.dmp

      Filesize

      304KB

    • memory/4472-74-0x0000000007300000-0x00000000073A3000-memory.dmp

      Filesize

      652KB

    • memory/4472-82-0x0000000007750000-0x000000000776A000-memory.dmp

      Filesize

      104KB

    • memory/4472-81-0x0000000007650000-0x0000000007664000-memory.dmp

      Filesize

      80KB

    • memory/4472-79-0x0000000007610000-0x0000000007621000-memory.dmp

      Filesize

      68KB

    • memory/4472-77-0x0000000007480000-0x000000000748A000-memory.dmp

      Filesize

      40KB

    • memory/4472-80-0x0000000007640000-0x000000000764E000-memory.dmp

      Filesize

      56KB

    • memory/5000-76-0x0000000006EA0000-0x0000000006EBA000-memory.dmp

      Filesize

      104KB

    • memory/5000-78-0x0000000007120000-0x00000000071B6000-memory.dmp

      Filesize

      600KB

    • memory/5000-75-0x00000000074E0000-0x0000000007B5A000-memory.dmp

      Filesize

      6.5MB

    • memory/5000-64-0x00000000759F0000-0x0000000075A3C000-memory.dmp

      Filesize

      304KB

    • memory/5000-25-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/5000-33-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/5000-23-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/5000-90-0x0000000075180000-0x0000000075930000-memory.dmp

      Filesize

      7.7MB

    • memory/5064-46-0x0000000000400000-0x0000000000440000-memory.dmp

      Filesize

      256KB

    • memory/5064-91-0x0000000006F10000-0x0000000006F60000-memory.dmp

      Filesize

      320KB

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.