Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
30/09/2024, 04:25
Static task
static1
Behavioral task
behavioral1
Sample
CAPE MARS VSL'S PARTICULARS.docx.exe
Resource
win7-20240704-en
General
-
Target
CAPE MARS VSL'S PARTICULARS.docx.exe
-
Size
1.3MB
-
MD5
3fdd44d4178bb6c42cae954e1307ba0f
-
SHA1
db4aaf668c0ead4c1f93cea2e6ab732c87c81877
-
SHA256
db15aa19a87f7db96b971572182b09cb2b79ff78ac5fe747df663ce6288c3f98
-
SHA512
52ee2c01d8d9c954490c4d15662727c964dd145f29a06749cbd78ae414408631a9802200eaf1ae1fbc216be616de5211c8c95d895ec33f40bb05ea4e730a4690
-
SSDEEP
24576:ffmMv6Ckr7Mny5QLxUARo1PNdukW8WvQCFn5rKX75uaKa:f3v+7/5QLxUTNdLW4CA75uA
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\name.vbs name.exe -
Executes dropped EXE 1 IoCs
pid Process 2852 name.exe -
Loads dropped DLL 1 IoCs
pid Process 2732 CAPE MARS VSL'S PARTICULARS.docx.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 api.ipify.org 5 api.ipify.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/files/0x0008000000016d29-4.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2852 set thread context of 2676 2852 name.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CAPE MARS VSL'S PARTICULARS.docx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language name.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2676 RegSvcs.exe 2676 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2852 name.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2676 RegSvcs.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2732 wrote to memory of 2852 2732 CAPE MARS VSL'S PARTICULARS.docx.exe 30 PID 2732 wrote to memory of 2852 2732 CAPE MARS VSL'S PARTICULARS.docx.exe 30 PID 2732 wrote to memory of 2852 2732 CAPE MARS VSL'S PARTICULARS.docx.exe 30 PID 2732 wrote to memory of 2852 2732 CAPE MARS VSL'S PARTICULARS.docx.exe 30 PID 2852 wrote to memory of 2676 2852 name.exe 31 PID 2852 wrote to memory of 2676 2852 name.exe 31 PID 2852 wrote to memory of 2676 2852 name.exe 31 PID 2852 wrote to memory of 2676 2852 name.exe 31 PID 2852 wrote to memory of 2676 2852 name.exe 31 PID 2852 wrote to memory of 2676 2852 name.exe 31 PID 2852 wrote to memory of 2676 2852 name.exe 31 PID 2852 wrote to memory of 2676 2852 name.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\CAPE MARS VSL'S PARTICULARS.docx.exe"C:\Users\Admin\AppData\Local\Temp\CAPE MARS VSL'S PARTICULARS.docx.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732 -
C:\Users\Admin\AppData\Local\directory\name.exe"C:\Users\Admin\AppData\Local\Temp\CAPE MARS VSL'S PARTICULARS.docx.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\CAPE MARS VSL'S PARTICULARS.docx.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD53fdd44d4178bb6c42cae954e1307ba0f
SHA1db4aaf668c0ead4c1f93cea2e6ab732c87c81877
SHA256db15aa19a87f7db96b971572182b09cb2b79ff78ac5fe747df663ce6288c3f98
SHA51252ee2c01d8d9c954490c4d15662727c964dd145f29a06749cbd78ae414408631a9802200eaf1ae1fbc216be616de5211c8c95d895ec33f40bb05ea4e730a4690