Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

11/12/2024, 00:18

241211-alx6gswnbx 10

11/12/2024, 00:16

241211-akl2ts1ldr 3

11/12/2024, 00:14

241211-ajr7fswmd1 3

11/12/2024, 00:12

241211-ag75wswlhz 10

04/09/2024, 14:53

240904-r9kzhasdqr 10

Analysis

  • max time kernel
    110s
  • max time network
    112s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/12/2024, 00:12

General

  • Target

    39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe

  • Size

    496KB

  • MD5

    6285ae9a1953232716b7817c6bce1ba6

  • SHA1

    8ea818cd4c61b6c53a5eea7f5ff19cdd9e60a8fb

  • SHA256

    39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287

  • SHA512

    2dbdebc96f92dfda7a146f3ade91af8b4ac66ab9dd9d51b5efb72a0b5cd789086b49cdb435e837a013d7a29e9a4a9c148ad5ece84e2129fad84c5944b9485581

  • SSDEEP

    12288:fPVEdXo7/apwbQB6R751Hlie+XhTalWP6lTcNeH1ug2nMnMqDXWxbnN:3VKu/jbp3lihmUiKwHs

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot1944842353:AAF4AUZAlM1Eseaom3hr9cg9ol6hzIat_qw/sendDocument

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • AgentTesla payload 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe
    "C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4732
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\aIsPxrpSE" /XML "C:\Users\Admin\AppData\Local\Temp\tmp50BB.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:756
    • C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe
      "C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe"
      2⤵
        PID:1728
      • C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe
        "C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe"
        2⤵
          PID:2512
        • C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe
          "C:\Users\Admin\AppData\Local\Temp\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe"
          2⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:3676

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\39b52356da1f35c5bad343eea8880f4d8bdd6c0228a7a9b85e5f0117c6296287.exe.log

        Filesize

        1KB

        MD5

        8ec831f3e3a3f77e4a7b9cd32b48384c

        SHA1

        d83f09fd87c5bd86e045873c231c14836e76a05c

        SHA256

        7667e538030e3f8ce2886e47a01af24cb0ea70528b1e821c5d8832c5076cb982

        SHA512

        26bffa2406b66368bd412bf25869a792631455645992cdcade2dbc13a2e56fb546414a6a9223b94c96c38d89187add6678d4779a88b38b0c9e36be8527b213c3

      • memory/3676-27-0x0000000074CA0000-0x0000000075450000-memory.dmp

        Filesize

        7.7MB

      • memory/3676-26-0x0000000074CA0000-0x0000000075450000-memory.dmp

        Filesize

        7.7MB

      • memory/3676-25-0x0000000006240000-0x00000000062A6000-memory.dmp

        Filesize

        408KB

      • memory/3676-24-0x00000000055B0000-0x00000000055C8000-memory.dmp

        Filesize

        96KB

      • memory/3676-22-0x0000000074CA0000-0x0000000075450000-memory.dmp

        Filesize

        7.7MB

      • memory/3676-21-0x0000000074CA0000-0x0000000075450000-memory.dmp

        Filesize

        7.7MB

      • memory/3676-18-0x0000000000400000-0x000000000043C000-memory.dmp

        Filesize

        240KB

      • memory/4732-5-0x0000000004810000-0x000000000481A000-memory.dmp

        Filesize

        40KB

      • memory/4732-6-0x0000000074CA0000-0x0000000075450000-memory.dmp

        Filesize

        7.7MB

      • memory/4732-10-0x0000000074CA0000-0x0000000075450000-memory.dmp

        Filesize

        7.7MB

      • memory/4732-11-0x000000000AC50000-0x000000000ACEC000-memory.dmp

        Filesize

        624KB

      • memory/4732-12-0x000000000AD50000-0x000000000ADB0000-memory.dmp

        Filesize

        384KB

      • memory/4732-8-0x000000000A710000-0x000000000A71E000-memory.dmp

        Filesize

        56KB

      • memory/4732-7-0x0000000074CA0000-0x0000000075450000-memory.dmp

        Filesize

        7.7MB

      • memory/4732-9-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

        Filesize

        4KB

      • memory/4732-0-0x0000000074CAE000-0x0000000074CAF000-memory.dmp

        Filesize

        4KB

      • memory/4732-23-0x0000000074CA0000-0x0000000075450000-memory.dmp

        Filesize

        7.7MB

      • memory/4732-4-0x0000000074CA0000-0x0000000075450000-memory.dmp

        Filesize

        7.7MB

      • memory/4732-3-0x00000000072D0000-0x0000000007362000-memory.dmp

        Filesize

        584KB

      • memory/4732-2-0x00000000077E0000-0x0000000007D84000-memory.dmp

        Filesize

        5.6MB

      • memory/4732-1-0x00000000002F0000-0x0000000000372000-memory.dmp

        Filesize

        520KB