Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
08/10/2024, 06:59
Static task
static1
Behavioral task
behavioral1
Sample
shipping.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
shipping.exe
Resource
win10v2004-20241007-en
General
-
Target
shipping.exe
-
Size
1.1MB
-
MD5
f3ecc3f5d66720700cd7927178efbd16
-
SHA1
38a8dc60faad60da61b5787d29ece4bcded6f7c7
-
SHA256
4c2de5043cb67a6805824b096a6640ab47b60c0c1ed71a452d3228144c92b0f3
-
SHA512
ceee13504567a4082dddce8237a6ac9cf070cda8bbb6bc83e2fa482560c2b29f9663c606144da9bfa3f6364ad208e18ef45bb35c21fb4c6543a66cf95ea4c1bf
-
SSDEEP
12288:rLkcoxg7v3qnC11ErwIhh0F4qwUgUny5QL0GFUT5Dn5okl79XRmUl9XwiwpGb/Gy:ffmMv6Ckr7Mny5QL0YU1DnlRJ3XQy
Malware Config
Extracted
agenttesla
Protocol: smtp- Host:
mail.starmech.net - Port:
587 - Username:
[email protected] - Password:
nics123 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Monteverdi.vbs Monteverdi.exe -
Executes dropped EXE 1 IoCs
pid Process 4876 Monteverdi.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BjTxJte = "C:\\Users\\Admin\\AppData\\Roaming\\BjTxJte\\BjTxJte.exe" RegSvcs.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 api.ipify.org 16 api.ipify.org -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/files/0x0008000000023cab-5.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4876 set thread context of 3912 4876 Monteverdi.exe 86 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shipping.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Monteverdi.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4744 shipping.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3912 RegSvcs.exe 3912 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4876 Monteverdi.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3912 RegSvcs.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3912 RegSvcs.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4744 wrote to memory of 4876 4744 shipping.exe 85 PID 4744 wrote to memory of 4876 4744 shipping.exe 85 PID 4744 wrote to memory of 4876 4744 shipping.exe 85 PID 4876 wrote to memory of 3912 4876 Monteverdi.exe 86 PID 4876 wrote to memory of 3912 4876 Monteverdi.exe 86 PID 4876 wrote to memory of 3912 4876 Monteverdi.exe 86 PID 4876 wrote to memory of 3912 4876 Monteverdi.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\shipping.exe"C:\Users\Admin\AppData\Local\Temp\shipping.exe"1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Users\Admin\AppData\Local\retrofit\Monteverdi.exe"C:\Users\Admin\AppData\Local\Temp\shipping.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\shipping.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3912
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5f3ecc3f5d66720700cd7927178efbd16
SHA138a8dc60faad60da61b5787d29ece4bcded6f7c7
SHA2564c2de5043cb67a6805824b096a6640ab47b60c0c1ed71a452d3228144c92b0f3
SHA512ceee13504567a4082dddce8237a6ac9cf070cda8bbb6bc83e2fa482560c2b29f9663c606144da9bfa3f6364ad208e18ef45bb35c21fb4c6543a66cf95ea4c1bf