Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07/01/2025, 01:06
Static task
static1
Behavioral task
behavioral1
Sample
cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe
Resource
win7-20240903-en
General
-
Target
cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe
-
Size
1.3MB
-
MD5
680fd2015b9a8df73e541faf60e3cff2
-
SHA1
da9b83c61b06ce50083d5a765607ebf7164e8db9
-
SHA256
cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c
-
SHA512
93bc0131b55deb14f66689f7f1010542de5e3550a0e3d1bf854528c7d6c7c09266bfb657d8f88152d46ede8ac942297f0e2bf3627ef462983c7e392621b7c74a
-
SSDEEP
24576:wqDEvCTbMWu7rQYlBQcBiT6rpFd+zmG0n356C0IpZnJGo:wTvC/MTQYxsWPkzmF3tJ
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.antoniomayol.com:21 - Port:
21 - Username:
[email protected] - Password:
cMhKDQUk1{;%
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cunila.vbs cunila.exe -
Executes dropped EXE 1 IoCs
pid Process 2324 cunila.exe -
Loads dropped DLL 1 IoCs
pid Process 2520 cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
AutoIT Executable 5 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/2520-0-0x0000000000E80000-0x0000000000FDB000-memory.dmp autoit_exe behavioral1/memory/2520-3-0x0000000000580000-0x0000000000980000-memory.dmp autoit_exe behavioral1/files/0x0008000000016d29-5.dat autoit_exe behavioral1/memory/2324-9-0x0000000000930000-0x0000000000A8B000-memory.dmp autoit_exe behavioral1/memory/2324-14-0x0000000000B00000-0x0000000000F00000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2324 set thread context of 1924 2324 cunila.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cunila.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1924 RegSvcs.exe 1924 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2324 cunila.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1924 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 2520 cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe 2520 cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe 2324 cunila.exe 2324 cunila.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 2520 cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe 2520 cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe 2324 cunila.exe 2324 cunila.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2324 2520 cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe 30 PID 2520 wrote to memory of 2324 2520 cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe 30 PID 2520 wrote to memory of 2324 2520 cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe 30 PID 2520 wrote to memory of 2324 2520 cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe 30 PID 2324 wrote to memory of 1924 2324 cunila.exe 31 PID 2324 wrote to memory of 1924 2324 cunila.exe 31 PID 2324 wrote to memory of 1924 2324 cunila.exe 31 PID 2324 wrote to memory of 1924 2324 cunila.exe 31 PID 2324 wrote to memory of 1924 2324 cunila.exe 31 PID 2324 wrote to memory of 1924 2324 cunila.exe 31 PID 2324 wrote to memory of 1924 2324 cunila.exe 31 PID 2324 wrote to memory of 1924 2324 cunila.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe"C:\Users\Admin\AppData\Local\Temp\cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\enterogenous\cunila.exe"C:\Users\Admin\AppData\Local\Temp\cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.3MB
MD5680fd2015b9a8df73e541faf60e3cff2
SHA1da9b83c61b06ce50083d5a765607ebf7164e8db9
SHA256cca19643de6d16a67f7ecb13cd2bb8f9ed34dc352eb967250c3bd5c8bd09329c
SHA51293bc0131b55deb14f66689f7f1010542de5e3550a0e3d1bf854528c7d6c7c09266bfb657d8f88152d46ede8ac942297f0e2bf3627ef462983c7e392621b7c74a