Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    118s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13/12/2024, 01:11

General

  • Target

    61489fb28f59a778c7ac16f4d88c766cffffe2a153b8202115e6744e32e7641b.exe

  • Size

    783KB

  • MD5

    220919d8e8a31db31e4efc371cae82a4

  • SHA1

    a87310ef3549cd609dc429a63bf45fde14ef4746

  • SHA256

    61489fb28f59a778c7ac16f4d88c766cffffe2a153b8202115e6744e32e7641b

  • SHA512

    3d60ab0f4f3101c0641da5a9a74fedd7bfd3b098d7feea5bbf2dc36eb11db321ea8bcd35c73dcdb602f0c46eea9183007ee5dd6582e77a4e293ffe712101f2df

  • SSDEEP

    24576:PjlIhSPd+p2O4qCfOVY5zL245CeYcaGqE7nReX:Pjl+SPspd45WVaSQzTacwX

Malware Config

Extracted

Family

agenttesla

C2

https://api.telegram.org/bot6050556352:AAE_-mublQ2CllMbT9xkQVBjSBbdvdYR1kM/

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\61489fb28f59a778c7ac16f4d88c766cffffe2a153b8202115e6744e32e7641b.exe
    "C:\Users\Admin\AppData\Local\Temp\61489fb28f59a778c7ac16f4d88c766cffffe2a153b8202115e6744e32e7641b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2492
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\61489fb28f59a778c7ac16f4d88c766cffffe2a153b8202115e6744e32e7641b.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2248
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\iVHrnzbjEv.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2868
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\iVHrnzbjEv" /XML "C:\Users\Admin\AppData\Local\Temp\tmp9EA0.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2632
    • C:\Users\Admin\AppData\Local\Temp\61489fb28f59a778c7ac16f4d88c766cffffe2a153b8202115e6744e32e7641b.exe
      "C:\Users\Admin\AppData\Local\Temp\61489fb28f59a778c7ac16f4d88c766cffffe2a153b8202115e6744e32e7641b.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:2608

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmp9EA0.tmp

    Filesize

    1KB

    MD5

    be4de248b1025a456a4d0d5115b89d70

    SHA1

    5619f8b245024b80d9867a774dec320d097d47a4

    SHA256

    9e1fb67965a6cbf0c0961496874ca382ca09852f55d03f36fdac526df77e9e01

    SHA512

    262ff4e7fead6c9109a423fec1c2cf49d1d59db6e5a0c089febe12e7bba34df2e016f188a1809b944a303bcd147aef127075ef5285e84acf674990fea983a2e6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

    Filesize

    7KB

    MD5

    1731fb82bcda253d9124fa390cc5b325

    SHA1

    e1537d3c127e0e3e8af979786055e1c27f890f3b

    SHA256

    d04151fcd0c654b0a246b7c4308c52873a54ee23d3db1ec5f93700eed4cb9433

    SHA512

    4a4cc1b058b96f269972cd9b236506dc1ba61add036d972382e64786f58ea55bdaa08ac5a32877315d180f5f92f756fbb40e3ec004cc6bc93c5346492c72639d

  • memory/2492-4-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

    Filesize

    4KB

  • memory/2492-31-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2492-0-0x0000000074C6E000-0x0000000074C6F000-memory.dmp

    Filesize

    4KB

  • memory/2492-5-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2492-6-0x00000000054C0000-0x0000000005534000-memory.dmp

    Filesize

    464KB

  • memory/2492-2-0x0000000074C60000-0x000000007534E000-memory.dmp

    Filesize

    6.9MB

  • memory/2492-1-0x00000000009E0000-0x0000000000AAA000-memory.dmp

    Filesize

    808KB

  • memory/2492-3-0x00000000009C0000-0x00000000009E6000-memory.dmp

    Filesize

    152KB

  • memory/2608-23-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2608-19-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2608-30-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2608-29-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2608-28-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2608-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2608-21-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB

  • memory/2608-25-0x0000000000400000-0x0000000000430000-memory.dmp

    Filesize

    192KB