Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
65s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
13/12/2024, 21:30
Static task
static1
Behavioral task
behavioral1
Sample
eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe
Resource
win10v2004-20241007-en
General
-
Target
eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe
-
Size
297KB
-
MD5
eccf8ac19437cab9813a7c3d4f433714
-
SHA1
0fa355d8d2be7e78684bac697d71e27114ba96b1
-
SHA256
bd557f84277a8c9f4098474f8449c78ca3c5afa108215ae44fb61668b2c0cfba
-
SHA512
1165649f55f7e094803c95fc4eb518c176a9b8dd33c046166331d619ea30a7e50c85585ef3a5a723291caee487796a2f6b81e34cae0c69dc698cf7b688140d81
-
SSDEEP
6144:nbgMF6Phu8oFvYCUUG1mOvebfIL1h/bDg6EMGT63V9bBh:bgfuD7meTq1hDDZGm3Vbh
Malware Config
Extracted
agenttesla
https://api.telegram.org/bot1898788581:AAEbsCzTih-rxVDH11H9U8nZ_h_9VfJgvh4/sendDocument
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
AgentTesla payload 3 IoCs
resource yara_rule behavioral1/memory/2896-7-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2896-5-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla behavioral1/memory/2896-3-0x0000000000400000-0x000000000043C000-memory.dmp family_agenttesla -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2476 set thread context of 2896 2476 eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSBuild.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2896 MSBuild.exe 2896 MSBuild.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2476 eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2896 MSBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2476 wrote to memory of 2896 2476 eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe 31 PID 2476 wrote to memory of 2896 2476 eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe 31 PID 2476 wrote to memory of 2896 2476 eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe 31 PID 2476 wrote to memory of 2896 2476 eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe 31 PID 2476 wrote to memory of 2896 2476 eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe 31 PID 2896 wrote to memory of 2868 2896 MSBuild.exe 32 PID 2896 wrote to memory of 2868 2896 MSBuild.exe 32 PID 2896 wrote to memory of 2868 2896 MSBuild.exe 32 PID 2896 wrote to memory of 2868 2896 MSBuild.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2476 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\MSBuild.exe"C:\Users\Admin\AppData\Local\Temp\eccf8ac19437cab9813a7c3d4f433714_JaffaCakes118.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 5203⤵
- System Location Discovery: System Language Discovery
PID:2868
-
-