Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
125s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
13/01/2025, 07:16 UTC
General
-
Target
Shipping Docs Waybill No 2009 xxxx 351.exe
-
Size
1.1MB
-
MD5
354725d3df06a1f01c0fe40b5613f21f
-
SHA1
28a300ab00a8e2d8b218adc084a2b946309d4fb7
-
SHA256
635e20a681b1d8e8a4318e345cff50dc04cbd032a7414640137cbf5fa1c09a84
-
SHA512
9c8b7807ce0531a688c26426b90352a6d21f9cfe7df480d484bea46d451ba5e6f6a56570a86a6be6673a6e38013ddb46bfbdfa9115c216c7807c6fec5218b78e
-
SSDEEP
24576:yr/LaBQDJDFlGOhvP7iUOpqYqjpYlA7dfUWTpSuaWV0cMc92:yvvDrGkvP7iUw98p57dflbaWOcMC2
Score
10/10
Malware Config
Extracted
Family
agenttesla
Credentials
Protocol: ftp- Host:
ftp://s4.serv00.com - Port:
21 - Username:
f2241_evica - Password:
Doll650@@
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
-
Suspicious behavior: EnumeratesProcesses 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\Shipping Docs Waybill No 2009 xxxx 351.exe"C:\Users\Admin\AppData\Local\Temp\Shipping Docs Waybill No 2009 xxxx 351.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
Network
-
DNS154.239.44.20.in-addr.arpaRemote address:8.8.8.8:53Request154.239.44.20.in-addr.arpaIN PTRResponse -
DNS23.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request23.159.190.20.in-addr.arpaIN PTRResponse
-
DNS167.173.78.104.in-addr.arpaRemote address:8.8.8.8:53Request167.173.78.104.in-addr.arpaIN PTRResponse167.173.78.104.in-addr.arpaIN PTRa104-78-173-167deploystaticakamaitechnologiescom
-
DNSapi.ipify.orgRemote address:8.8.8.8:53Requestapi.ipify.orgIN AResponseapi.ipify.orgIN A172.67.74.152api.ipify.orgIN A104.26.12.205api.ipify.orgIN A104.26.13.205
-
GEThttps://api.ipify.org/Remote address:172.67.74.152:443RequestGET / HTTP/1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
Host: api.ipify.org
Connection: Keep-Alive
ResponseHTTP/1.1 200 OK
Date: Mon, 13 Jan 2025 07:16:33 GMT
Content-Type: text/plain
Content-Length: 14
Connection: keep-alive
Vary: Origin
CF-Cache-Status: DYNAMIC
Server: cloudflare
CF-RAY: 901399fa88bb777f-LHR
server-timing: cfL4;desc="?proto=TCP&rtt=53025&min_rtt=47872&rtt_var=22947&sent=6&recv=5&lost=0&retrans=0&sent_bytes=2980&recv_bytes=452&delivery_rate=66676&cwnd=243&unsent_bytes=0&cid=dbc7eba60c628f40&ts=217&x=0"
-
DNS152.74.67.172.in-addr.arpaRemote address:8.8.8.8:53Request152.74.67.172.in-addr.arpaIN PTRResponse
-
DNS212.20.149.52.in-addr.arpaRemote address:8.8.8.8:53Request212.20.149.52.in-addr.arpaIN PTRResponse
-
DNS171.39.242.20.in-addr.arpaRemote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
DNS24.66.18.2.in-addr.arpaRemote address:8.8.8.8:53Request24.66.18.2.in-addr.arpaIN PTRResponse24.66.18.2.in-addr.arpaIN PTRa2-18-66-24deploystaticakamaitechnologiescom
-
DNS249.110.86.104.in-addr.arpaRemote address:8.8.8.8:53Request249.110.86.104.in-addr.arpaIN PTRResponse249.110.86.104.in-addr.arpaIN PTRa104-86-110-249deploystaticakamaitechnologiescom
-
DNS14.227.111.52.in-addr.arpaRemote address:8.8.8.8:53Request14.227.111.52.in-addr.arpaIN PTRResponse
-
172.67.74.152:443https://api.ipify.org/tls, http
HTTP Request
GET https://api.ipify.org/HTTP Response
200
-
8.8.8.8:53154.239.44.20.in-addr.arpadns
DNS Request
154.239.44.20.in-addr.arpa
-
8.8.8.8:5323.159.190.20.in-addr.arpadns
DNS Request
23.159.190.20.in-addr.arpa
-
8.8.8.8:53167.173.78.104.in-addr.arpadns
DNS Request
167.173.78.104.in-addr.arpa
-
8.8.8.8:53api.ipify.orgdns
DNS Request
api.ipify.org
DNS Response
172.67.74.152104.26.12.205104.26.13.205
-
8.8.8.8:53152.74.67.172.in-addr.arpadns
DNS Request
152.74.67.172.in-addr.arpa
-
8.8.8.8:53212.20.149.52.in-addr.arpadns
DNS Request
212.20.149.52.in-addr.arpa
-
8.8.8.8:53171.39.242.20.in-addr.arpadns
DNS Request
171.39.242.20.in-addr.arpa
-
8.8.8.8:5324.66.18.2.in-addr.arpadns
DNS Request
24.66.18.2.in-addr.arpa
-
8.8.8.8:53249.110.86.104.in-addr.arpadns
DNS Request
249.110.86.104.in-addr.arpa
-
8.8.8.8:5314.227.111.52.in-addr.arpadns
DNS Request
14.227.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
-
Filesize
408KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
320KB
-
Filesize
7.7MB
-
Filesize
40KB
-
Filesize
584KB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
1.0MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
432KB
-
Filesize
424KB
-
Filesize
304KB
-
Filesize
4KB
-
Filesize
7.7MB
-
Filesize
1.1MB
-
Filesize
1.1MB
-
Filesize
4KB
-
Filesize
5.6MB
-
Filesize
336KB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
7.7MB