Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    141s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2025, 16:14

General

  • Target

    2025-01-13_149b334f85bbd7a24ab55c53ab03ba8e_bkransomware.exe

  • Size

    573KB

  • MD5

    149b334f85bbd7a24ab55c53ab03ba8e

  • SHA1

    de025845597e99ceaefbe481dcac1629134138ec

  • SHA256

    54640459e29ae0685e2a9981cb3bf57690623a1b4d3ce61aeee3c1fe6ac3a196

  • SHA512

    32904758695e6368d2fafb54ebf6d17e0d990cabe885a94aeaf59e46b8f1159e9d78d34234e2dcb181db75855e476c625aba2e989f02456820790c7d1fe96835

  • SSDEEP

    12288:crtmE2OVIDRhIbCLm/A4xQ9ZYCuzNB0JfiwSdYSui8:c72NhIm6oxYxNsfiTdYSuV

Malware Config

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • AgentTesla payload 5 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Unsecured Credentials: Credentials In Files 1 TTPs

    Steal credentials from unsecured files.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-01-13_149b334f85bbd7a24ab55c53ab03ba8e_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-01-13_149b334f85bbd7a24ab55c53ab03ba8e_bkransomware.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:5004
    • C:\Users\Admin\AppData\Local\Temp\2025-01-13_149b334f85bbd7a24ab55c53ab03ba8e_bkransomware.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-01-13_149b334f85bbd7a24ab55c53ab03ba8e_bkransomware.exe"
      2⤵
      • Accesses Microsoft Outlook profiles
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: RenamesItself
      • Suspicious use of AdjustPrivilegeToken
      • outlook_office_path
      • outlook_win_path
      PID:1724

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1724-9-0x0000000074AA0000-0x0000000075051000-memory.dmp

    Filesize

    5.7MB

  • memory/1724-10-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1724-3-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1724-4-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1724-5-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1724-6-0x0000000074AA2000-0x0000000074AA3000-memory.dmp

    Filesize

    4KB

  • memory/1724-2-0x0000000000400000-0x000000000044B000-memory.dmp

    Filesize

    300KB

  • memory/1724-7-0x0000000074AA0000-0x0000000075051000-memory.dmp

    Filesize

    5.7MB

  • memory/1724-23-0x0000000074AA0000-0x0000000075051000-memory.dmp

    Filesize

    5.7MB

  • memory/1724-8-0x0000000074AA0000-0x0000000075051000-memory.dmp

    Filesize

    5.7MB

  • memory/1724-11-0x0000000074AA2000-0x0000000074AA3000-memory.dmp

    Filesize

    4KB

  • memory/1724-12-0x0000000074AA0000-0x0000000075051000-memory.dmp

    Filesize

    5.7MB

  • memory/1724-13-0x0000000074AA0000-0x0000000075051000-memory.dmp

    Filesize

    5.7MB

  • memory/1724-14-0x0000000000EF0000-0x0000000000F85000-memory.dmp

    Filesize

    596KB

  • memory/1724-21-0x0000000074AA0000-0x0000000075051000-memory.dmp

    Filesize

    5.7MB

  • memory/5004-1-0x00000000000A0000-0x00000000001A0000-memory.dmp

    Filesize

    1024KB