Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/01/2025, 22:16
Static task
static1
Behavioral task
behavioral1
Sample
Orden de compra-password(Y6V1AmQz).zip
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
9d12b6e43b876a44527607a4dfdeb5f125020bbb3b674cae1886fea0812d1c5d.eml
Resource
win7-20240708-en
Behavioral task
behavioral3
Sample
840a07a2.png
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
Nueva Orden de Compra 5424.rar
Resource
win7-20241010-en
Behavioral task
behavioral5
Sample
Nueva Orden de Compra 5424.exe
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
email-html-2.html
Resource
win7-20240903-en
General
-
Target
Nueva Orden de Compra 5424.exe
-
Size
1.3MB
-
MD5
70b62fe5c9f6a8bfccb0b2a4b8d45e84
-
SHA1
129d8ca1944bcf608fa12a032d254e7dc08c2cc7
-
SHA256
3c0c387ff08da55e2f2f8062bae3732ff7787a95aa8c6371482be5b9c719ef9e
-
SHA512
dcd7ef997cc75035340e68706094a0c118f1beccdcc5862c21a96458726b89b6fdb3f9563734630796bdd164e5f93dc0e61ccb27df27235c376c4e54ecbe6170
-
SSDEEP
24576:ctb20pkaCqT5TBWgNQ7aWQXC9PnTYBN9mSSsNcG6A:FVg5tQ7aWYBBBSA35
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.solucionesmexico.mx - Port:
21 - Username:
[email protected] - Password:
dGG^ZYIxX5!B
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 ip-api.com -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2348 set thread context of 3036 2348 Nueva Orden de Compra 5424.exe 31 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Nueva Orden de Compra 5424.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3036 RegSvcs.exe 3036 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2348 Nueva Orden de Compra 5424.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3036 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 2348 Nueva Orden de Compra 5424.exe 2348 Nueva Orden de Compra 5424.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 2348 Nueva Orden de Compra 5424.exe 2348 Nueva Orden de Compra 5424.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2348 wrote to memory of 3036 2348 Nueva Orden de Compra 5424.exe 31 PID 2348 wrote to memory of 3036 2348 Nueva Orden de Compra 5424.exe 31 PID 2348 wrote to memory of 3036 2348 Nueva Orden de Compra 5424.exe 31 PID 2348 wrote to memory of 3036 2348 Nueva Orden de Compra 5424.exe 31 PID 2348 wrote to memory of 3036 2348 Nueva Orden de Compra 5424.exe 31 PID 2348 wrote to memory of 3036 2348 Nueva Orden de Compra 5424.exe 31 PID 2348 wrote to memory of 3036 2348 Nueva Orden de Compra 5424.exe 31 PID 2348 wrote to memory of 3036 2348 Nueva Orden de Compra 5424.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\Nueva Orden de Compra 5424.exe"C:\Users\Admin\AppData\Local\Temp\Nueva Orden de Compra 5424.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\Nueva Orden de Compra 5424.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3036
-