Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    30/09/2024, 04:25 UTC

General

  • Target

    CAPE MARS VSL'S PARTICULARS.docx.exe

  • Size

    1.3MB

  • MD5

    3fdd44d4178bb6c42cae954e1307ba0f

  • SHA1

    db4aaf668c0ead4c1f93cea2e6ab732c87c81877

  • SHA256

    db15aa19a87f7db96b971572182b09cb2b79ff78ac5fe747df663ce6288c3f98

  • SHA512

    52ee2c01d8d9c954490c4d15662727c964dd145f29a06749cbd78ae414408631a9802200eaf1ae1fbc216be616de5211c8c95d895ec33f40bb05ea4e730a4690

  • SSDEEP

    24576:ffmMv6Ckr7Mny5QLxUARo1PNdukW8WvQCFn5rKX75uaKa:f3v+7/5QLxUTNdLW4CA75uA

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • AutoIT Executable 1 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\CAPE MARS VSL'S PARTICULARS.docx.exe
    "C:\Users\Admin\AppData\Local\Temp\CAPE MARS VSL'S PARTICULARS.docx.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2732
    • C:\Users\Admin\AppData\Local\directory\name.exe
      "C:\Users\Admin\AppData\Local\Temp\CAPE MARS VSL'S PARTICULARS.docx.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2852
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Users\Admin\AppData\Local\Temp\CAPE MARS VSL'S PARTICULARS.docx.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2676

Network

  • flag-us
    DNS
    api.ipify.org
    RegSvcs.exe
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.12.205
    api.ipify.org
    IN A
    172.67.74.152
    api.ipify.org
    IN A
    104.26.13.205
  • flag-us
    GET
    https://api.ipify.org/
    RegSvcs.exe
    Remote address:
    104.26.12.205:443
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
    Host: api.ipify.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Mon, 30 Sep 2024 04:25:20 GMT
    Content-Type: text/plain
    Content-Length: 13
    Connection: keep-alive
    Vary: Origin
    CF-Cache-Status: DYNAMIC
    Server: cloudflare
    CF-RAY: 8cb172cc1fff63b2-LHR
  • 104.26.12.205:443
    https://api.ipify.org/
    tls, http
    RegSvcs.exe
    867 B
    3.5kB
    9
    9

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 8.8.8.8:53
    api.ipify.org
    dns
    RegSvcs.exe
    59 B
    107 B
    1
    1

    DNS Request

    api.ipify.org

    DNS Response

    104.26.12.205
    172.67.74.152
    104.26.13.205

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\directory\name.exe

    Filesize

    1.3MB

    MD5

    3fdd44d4178bb6c42cae954e1307ba0f

    SHA1

    db4aaf668c0ead4c1f93cea2e6ab732c87c81877

    SHA256

    db15aa19a87f7db96b971572182b09cb2b79ff78ac5fe747df663ce6288c3f98

    SHA512

    52ee2c01d8d9c954490c4d15662727c964dd145f29a06749cbd78ae414408631a9802200eaf1ae1fbc216be616de5211c8c95d895ec33f40bb05ea4e730a4690

  • memory/2676-42-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-32-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-14-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2676-16-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2676-17-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2676-18-0x0000000074BBE000-0x0000000074BBF000-memory.dmp

    Filesize

    4KB

  • memory/2676-19-0x0000000000690000-0x00000000006E4000-memory.dmp

    Filesize

    336KB

  • memory/2676-20-0x0000000074BB0000-0x000000007529E000-memory.dmp

    Filesize

    6.9MB

  • memory/2676-21-0x0000000074BB0000-0x000000007529E000-memory.dmp

    Filesize

    6.9MB

  • memory/2676-22-0x00000000009A0000-0x00000000009F2000-memory.dmp

    Filesize

    328KB

  • memory/2676-23-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-24-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-26-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-50-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-30-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-48-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-34-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-36-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-38-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-40-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-1058-0x0000000074BB0000-0x000000007529E000-memory.dmp

    Filesize

    6.9MB

  • memory/2676-44-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-1057-0x0000000074BBE000-0x0000000074BBF000-memory.dmp

    Filesize

    4KB

  • memory/2676-46-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-28-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-52-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-54-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-56-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-58-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-60-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-62-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-64-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-66-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-68-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-70-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-72-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-74-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-76-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-78-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-80-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-82-0x00000000009A0000-0x00000000009EC000-memory.dmp

    Filesize

    304KB

  • memory/2676-1055-0x0000000074BB0000-0x000000007529E000-memory.dmp

    Filesize

    6.9MB

  • memory/2676-1056-0x0000000000400000-0x0000000000446000-memory.dmp

    Filesize

    280KB

  • memory/2732-2-0x0000000003E10000-0x0000000004210000-memory.dmp

    Filesize

    4.0MB

  • memory/2852-12-0x0000000003130000-0x0000000003530000-memory.dmp

    Filesize

    4.0MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.