Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
103s -
max time network
104s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
24/11/2024, 13:29
General
-
Target
Shipping_Document.exe
-
Size
284KB
-
MD5
10cc03882e85151ad4ca3db541f81cf3
-
SHA1
be6b86b006b887fdc5abee6e64a25b5f237445a0
-
SHA256
f2da88c88866585358047c6e08c8fd9c01178c3c8ec61345180d8335c68f3bb7
-
SHA512
6cdce4f6a27b565d938adfeb59dbc8e9e3e2ed02d86281f62ce7de82febe71c45520bf13ce1834c9662fbf13880ff714227635399c6dce1bc43048852b2abc18
-
SSDEEP
6144:UYRl7vMcPxo+C0Kl9D7k0UjHCHjQ9mHHa1gNC33FLkvKoNGJxmEa2QUkeS/op+:T4cY1DRUeHjomHHGgN7vKopwQReS/v
Malware Config
Extracted
Protocol: ftp- Host:
ftp.concaribe.com - Port:
21 - Username:
[email protected] - Password:
ro}UWgz#!38E
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.concaribe.com - Port:
21 - Username:
[email protected] - Password:
ro}UWgz#!38E
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
-
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 4 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 56 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 12 IoCs
-
Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Shipping_Document.exe"C:\Users\Admin\AppData\Local\Temp\Shipping_Document.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Shipping_Document.exe"C:\Users\Admin\AppData\Local\Temp\Shipping_Document.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Shipping_Document.exe"C:\Users\Admin\AppData\Local\Temp\Shipping_Document.exe"2⤵
- System Network Configuration Discovery: Internet Connection Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\Shipping_Document.exe"C:\Users\Admin\AppData\Local\Temp\Shipping_Document.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\JoinConfirm.xlsx"1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
277B
MD5f2596984ce18089421c98b3e4592bbd9
SHA1ad66637a610541860deaf19aae15eb9825a942b8
SHA25680d5aa16bb624ab185a1bda9c817db68d52b7bebc0f8e4ad09fd762a34d4870d
SHA512a468eba8e768db5998b04df9def4548bdcda5d1cb377ca9113ab8239e5e75fafabac1eb809b3ad7ee227a02a3f07d56f2cd7a931d02996222026ac112c11bfdd
-
Filesize
1KB
MD5114453d86faba6de738169737d69e910
SHA17a548041683180cbe7753241443796c6afca9d5e
SHA256fda98bead55aab6a5c50fe7ebdefa9e9f893549293c7f372a3411d08dc16d16f
SHA5129a955b9e716895eb4a241edcb26719f98c6fa3c6a49ec2a9dab9214f3c3eee317d9a8c5a2ae991b3ebe083439ad4e53e442ded57cec7a47db732215e00a2e92a
-
Filesize
1KB
MD52b88bb7ebecf13686eb3859b587ec02a
SHA1d2b905e84f5b9c2b91894358ab860f7dc29a8df3
SHA2566a42a69f8a6be4ed5b7f8e05a338d1d6a3e89b7c23db42a7115db80217dfafb5
SHA51203366930f18b9d6faf743018337d59c268df4899ee47b0069d7e2b2679f06f9dca3a1ec78d18fe9e108f802b063d950ca24bbac1336c468926c649cf2a7385e2
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
7.7MB
-
Filesize
264KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
4KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
64KB
-
Filesize
2.0MB
-
Filesize
4KB
-
Filesize
312KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
288KB
-
Filesize
7.7MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB