Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/01/2025, 07:39
Static task
static1
Behavioral task
behavioral1
Sample
NEW SHIPPING DOCUMENTS.exe
Resource
win7-20240903-en
General
-
Target
NEW SHIPPING DOCUMENTS.exe
-
Size
779KB
-
MD5
10a2684aae3f75a984dc63506e8ed8dc
-
SHA1
99a1ef344d13f5b44f3b0526f44072154e30641b
-
SHA256
6f094aa75a8322555241fae3063c17075a6ed5166bfb41c9055c390278178d6b
-
SHA512
4d001589415898b61f52f01a652a268e3919bc6ced17b12abfbdcc71c64e49f3bf92b00e0f89ed64f120600b95a79fec23406afa3f7b8587552bd270424b1526
-
SSDEEP
12288:/bdhloJNhQ/cWS7stavkg+t7di+u6VNPD0xvUPoCsTDW4nlpVOWN6fc/WwBZfvo:fiJN+UVsCkgOkQNPQ2oCsWys0xpBZfA
Malware Config
Extracted
Protocol: smtp- Host:
mail.stilbo.eu - Port:
587 - Username:
[email protected] - Password:
StilBO_#1
Extracted
agenttesla
Protocol: smtp- Host:
mail.stilbo.eu - Port:
587 - Username:
[email protected] - Password:
StilBO_#1 - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2308 powershell.exe 4584 powershell.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation NEW SHIPPING DOCUMENTS.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 api.ipify.org 23 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4676 set thread context of 4752 4676 NEW SHIPPING DOCUMENTS.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEW SHIPPING DOCUMENTS.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NEW SHIPPING DOCUMENTS.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 4676 NEW SHIPPING DOCUMENTS.exe 4752 NEW SHIPPING DOCUMENTS.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1260 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2308 powershell.exe 4584 powershell.exe 4752 NEW SHIPPING DOCUMENTS.exe 4752 NEW SHIPPING DOCUMENTS.exe 4584 powershell.exe 2308 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2308 powershell.exe Token: SeDebugPrivilege 4584 powershell.exe Token: SeDebugPrivilege 4752 NEW SHIPPING DOCUMENTS.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4752 NEW SHIPPING DOCUMENTS.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 4676 wrote to memory of 2308 4676 NEW SHIPPING DOCUMENTS.exe 96 PID 4676 wrote to memory of 2308 4676 NEW SHIPPING DOCUMENTS.exe 96 PID 4676 wrote to memory of 2308 4676 NEW SHIPPING DOCUMENTS.exe 96 PID 4676 wrote to memory of 4584 4676 NEW SHIPPING DOCUMENTS.exe 98 PID 4676 wrote to memory of 4584 4676 NEW SHIPPING DOCUMENTS.exe 98 PID 4676 wrote to memory of 4584 4676 NEW SHIPPING DOCUMENTS.exe 98 PID 4676 wrote to memory of 1260 4676 NEW SHIPPING DOCUMENTS.exe 100 PID 4676 wrote to memory of 1260 4676 NEW SHIPPING DOCUMENTS.exe 100 PID 4676 wrote to memory of 1260 4676 NEW SHIPPING DOCUMENTS.exe 100 PID 4676 wrote to memory of 4752 4676 NEW SHIPPING DOCUMENTS.exe 102 PID 4676 wrote to memory of 4752 4676 NEW SHIPPING DOCUMENTS.exe 102 PID 4676 wrote to memory of 4752 4676 NEW SHIPPING DOCUMENTS.exe 102 PID 4676 wrote to memory of 4752 4676 NEW SHIPPING DOCUMENTS.exe 102 PID 4676 wrote to memory of 4752 4676 NEW SHIPPING DOCUMENTS.exe 102 PID 4676 wrote to memory of 4752 4676 NEW SHIPPING DOCUMENTS.exe 102 PID 4676 wrote to memory of 4752 4676 NEW SHIPPING DOCUMENTS.exe 102 PID 4676 wrote to memory of 4752 4676 NEW SHIPPING DOCUMENTS.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEW SHIPPING DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\NEW SHIPPING DOCUMENTS.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NEW SHIPPING DOCUMENTS.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\RvUJzKx.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4584
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\RvUJzKx" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDFD1.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1260
-
-
C:\Users\Admin\AppData\Local\Temp\NEW SHIPPING DOCUMENTS.exe"C:\Users\Admin\AppData\Local\Temp\NEW SHIPPING DOCUMENTS.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4752
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
4Credentials In Files
3Credentials in Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5968cb9309758126772781b83adb8a28f
SHA18da30e71accf186b2ba11da1797cf67f8f78b47c
SHA25692099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a
SHA5124bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3
-
Filesize
18KB
MD5576e9c8ca41b33718d5812829df4391f
SHA185ba25ef9a4b9b23992f0eed4235d0e60dab22f2
SHA256290cb49236b794c83acabd15e28f4a56abc9a65e8ce2d6ba81656c1deb96e889
SHA5123c7545a9988731d8fce9e6eab0a46b8b6142b32bcd1214adc241c9453a1dd72f8f61716042129fa2a72e321ff3f19abd7e5bfb649d0955e8800d63a4310a7c60
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD59c9491281cc34e43092c0ec396a5206f
SHA13dad54d39ec1de129fa014db19770a13bd4be317
SHA256e069b855377297b02e07e6acf8a9b56882395f05bc8496eda9b88f751ec205d6
SHA5124e9f08dcbb7386c28a4182eaac845c51f4bac8117de32bab661d4ed98e8316c46e8a7f7a7d96e6c06b83b3620c72ec9a9bedad45b75a6539da9860692967ca65