Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
25/12/2024, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
shipment document.exe
Resource
win7-20241010-en
General
-
Target
shipment document.exe
-
Size
1.1MB
-
MD5
a529f43a61267b1f6f42059dba8e179b
-
SHA1
57224be49c5bde441959d2c68489d5c635b164a8
-
SHA256
e47bbcc86c09be704eb8ffde9dcb0c70f0996fa9bf2e0e5df5b42ebb66fe97e0
-
SHA512
5de2164c1387239d42ef74c39acdd5a0f4c2f60e4232d9a916cc18e093a0d6e0b3b59eb334d07526e8b2159bd872c06a5255a63e990c43841a75532bb7a99de2
-
SSDEEP
24576:NAHnh+eWsN3skA4RV1Hom2KXMmHaD5cQVN6Rd5bm25:sh+ZkldoPK8YaD5c+4Xb3
Malware Config
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4536 set thread context of 972 4536 shipment document.exe 87 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shipment document.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shipment document.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language shipment document.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 972 RegSvcs.exe 972 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
pid Process 4572 shipment document.exe 4220 shipment document.exe 4536 shipment document.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 972 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 4572 shipment document.exe 4572 shipment document.exe 4220 shipment document.exe 4220 shipment document.exe 4536 shipment document.exe 4536 shipment document.exe -
Suspicious use of SendNotifyMessage 6 IoCs
pid Process 4572 shipment document.exe 4572 shipment document.exe 4220 shipment document.exe 4220 shipment document.exe 4536 shipment document.exe 4536 shipment document.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4572 wrote to memory of 4708 4572 shipment document.exe 83 PID 4572 wrote to memory of 4708 4572 shipment document.exe 83 PID 4572 wrote to memory of 4708 4572 shipment document.exe 83 PID 4572 wrote to memory of 4220 4572 shipment document.exe 84 PID 4572 wrote to memory of 4220 4572 shipment document.exe 84 PID 4572 wrote to memory of 4220 4572 shipment document.exe 84 PID 4220 wrote to memory of 2500 4220 shipment document.exe 85 PID 4220 wrote to memory of 2500 4220 shipment document.exe 85 PID 4220 wrote to memory of 2500 4220 shipment document.exe 85 PID 4220 wrote to memory of 4536 4220 shipment document.exe 86 PID 4220 wrote to memory of 4536 4220 shipment document.exe 86 PID 4220 wrote to memory of 4536 4220 shipment document.exe 86 PID 4536 wrote to memory of 972 4536 shipment document.exe 87 PID 4536 wrote to memory of 972 4536 shipment document.exe 87 PID 4536 wrote to memory of 972 4536 shipment document.exe 87 PID 4536 wrote to memory of 972 4536 shipment document.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\shipment document.exe"C:\Users\Admin\AppData\Local\Temp\shipment document.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\shipment document.exe"2⤵PID:4708
-
-
C:\Users\Admin\AppData\Local\Temp\shipment document.exe"C:\Users\Admin\AppData\Local\Temp\shipment document.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\shipment document.exe"3⤵PID:2500
-
-
C:\Users\Admin\AppData\Local\Temp\shipment document.exe"C:\Users\Admin\AppData\Local\Temp\shipment document.exe"3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4536 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\shipment document.exe"4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:972
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
261KB
MD572499daab028a3c086f2eb7fb4c8b9a3
SHA14c824830159904661df9b6919dcda2ba09993365
SHA256e03c03199a48ef6d138360d8e839cd2c237d335872b44b57f849a10dcbe86e6f
SHA512fe6e634b7ffd7c7af0062180da9891e37f83b3a8bc6f2022a6c1f0914dd2b0ea5764dcde6ddc327789feb4a48c3910e6aba809c41d2b5a0ec3851edf1d670161