Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    83s
  • max time network
    18s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2024, 06:56 UTC

General

  • Target

    27149809f49f2d4fa70b69692beb4f2d9bf6dd7686cc520b6ef5af786164b7e7.exe

  • Size

    647KB

  • MD5

    ca9fa9221f72390dd8f861c0df962734

  • SHA1

    a8d104d17ab090f73daca649590f781352fecd95

  • SHA256

    27149809f49f2d4fa70b69692beb4f2d9bf6dd7686cc520b6ef5af786164b7e7

  • SHA512

    b59441b92c6f2c95135cacbf58c7eb16f0656a78fabefaf6dc811968609e130f439a80c83fcb30ea8a7e46ffa9ef9b0a23f5e9939c5bb8d97d66479056f76065

  • SSDEEP

    12288:IUi2iNaQgSP8SP+wIe5Te4uCdI+5ccgaOtGrC:IUi1kVU88+wIeJemccgt

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    smtp
  • Host:
    us2.smtp.mailhostbox.com
  • Port:
    587
  • Username:
    sales@tanimas-id.com
  • Password:
    !xgapua3

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • AgentTesla payload 5 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\27149809f49f2d4fa70b69692beb4f2d9bf6dd7686cc520b6ef5af786164b7e7.exe
    "C:\Users\Admin\AppData\Local\Temp\27149809f49f2d4fa70b69692beb4f2d9bf6dd7686cc520b6ef5af786164b7e7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1768
    • C:\Users\Admin\AppData\Local\Temp\27149809f49f2d4fa70b69692beb4f2d9bf6dd7686cc520b6ef5af786164b7e7.exe
      "C:\Users\Admin\AppData\Local\Temp\27149809f49f2d4fa70b69692beb4f2d9bf6dd7686cc520b6ef5af786164b7e7.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1768-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

    Filesize

    4KB

  • memory/1768-1-0x00000000010B0000-0x0000000001156000-memory.dmp

    Filesize

    664KB

  • memory/1768-2-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/1768-3-0x00000000002C0000-0x00000000002CE000-memory.dmp

    Filesize

    56KB

  • memory/1768-4-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

    Filesize

    4KB

  • memory/1768-5-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/1768-6-0x0000000004BF0000-0x0000000004C50000-memory.dmp

    Filesize

    384KB

  • memory/1768-20-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2680-17-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2680-13-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2680-8-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2680-18-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2680-15-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2680-10-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2680-9-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2680-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2680-7-0x0000000000400000-0x000000000043C000-memory.dmp

    Filesize

    240KB

  • memory/2680-19-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2680-21-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2680-22-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.