Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    133s
  • platform
    windows7_x64
  • resource
    win7-20241023-en
  • resource tags

    arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
  • submitted
    22/01/2025, 02:41 UTC

General

  • Target

    MBL & HBL ADJKT2411000812 -BLJKT2411809005/MBL & HBL ADJKT2411000812 -BLJKT2411809005.scr

  • Size

    1.7MB

  • MD5

    b80331ab84fb85129717d5d846097bdb

  • SHA1

    cee98d946b4dd163997031702718aaeace697b6c

  • SHA256

    45717708e1d13150abc0d57e9c014443649b4e50243dc3409dda599cfcb2f4e0

  • SHA512

    5e8f3173a92dae236f5c9529aca481c3875cb227c859d686308ab1edac416cd5a55acc4bee83fa293dfd71937850dea000dbdc6c0605de0dc48a1eaea855bc28

  • SSDEEP

    24576:ASexfdr+bRvWH/i+vKzm3EEExkXq7TYA2rQtlHPI47s:dLReHaol0QQB

Malware Config

Extracted

Family

agenttesla

Credentials

  • Protocol:
    ftp
  • Host:
    ftp://s4.serv00.com
  • Port:
    21
  • Username:
    f2241_evica
  • Password:
    Doll280@@

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Agenttesla family
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 -BLJKT2411809005\MBL & HBL ADJKT2411000812 -BLJKT2411809005.scr
    "C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 -BLJKT2411809005\MBL & HBL ADJKT2411000812 -BLJKT2411809005.scr" /S
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2644
    • C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 -BLJKT2411809005\MBL & HBL ADJKT2411000812 -BLJKT2411809005.scr
      "C:\Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 -BLJKT2411809005\MBL & HBL ADJKT2411000812 -BLJKT2411809005.scr"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2316

Network

  • flag-us
    DNS
    api.ipify.org
    MBL & HBL ADJKT2411000812 -BLJKT2411809005.scr
    Remote address:
    8.8.8.8:53
    Request
    api.ipify.org
    IN A
    Response
    api.ipify.org
    IN A
    104.26.12.205
    api.ipify.org
    IN A
    172.67.74.152
    api.ipify.org
    IN A
    104.26.13.205
  • flag-us
    GET
    https://api.ipify.org/
    MBL & HBL ADJKT2411000812 -BLJKT2411809005.scr
    Remote address:
    104.26.12.205:443
    Request
    GET / HTTP/1.1
    User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:99.0) Gecko/20100101 Firefox/99.0
    Host: api.ipify.org
    Connection: Keep-Alive
    Response
    HTTP/1.1 200 OK
    Date: Wed, 22 Jan 2025 02:42:23 GMT
    Content-Type: text/plain
    Content-Length: 14
    Connection: keep-alive
    Vary: Origin
    cf-cache-status: DYNAMIC
    Server: cloudflare
    CF-RAY: 905c30c1f8e6643c-LHR
    server-timing: cfL4;desc="?proto=TCP&rtt=53163&min_rtt=46967&rtt_var=25057&sent=6&recv=6&lost=0&retrans=1&sent_bytes=2830&recv_bytes=465&delivery_rate=73085&cwnd=253&unsent_bytes=0&cid=c1de4d3963a79938&ts=223&x=0"
  • 104.26.12.205:443
    https://api.ipify.org/
    tls, http
    MBL & HBL ADJKT2411000812 -BLJKT2411809005.scr
    971 B
    4.2kB
    11
    10

    HTTP Request

    GET https://api.ipify.org/

    HTTP Response

    200
  • 8.8.8.8:53
    api.ipify.org
    dns
    MBL & HBL ADJKT2411000812 -BLJKT2411809005.scr
    59 B
    107 B
    1
    1

    DNS Request

    api.ipify.org

    DNS Response

    104.26.12.205
    172.67.74.152
    104.26.13.205

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\MBL & HBL ADJKT2411000812 -BLJKT2411809005\MBL & HBL ADJKT2411000812 -BLJKT2411809005.scr

    Filesize

    1.7MB

    MD5

    b80331ab84fb85129717d5d846097bdb

    SHA1

    cee98d946b4dd163997031702718aaeace697b6c

    SHA256

    45717708e1d13150abc0d57e9c014443649b4e50243dc3409dda599cfcb2f4e0

    SHA512

    5e8f3173a92dae236f5c9529aca481c3875cb227c859d686308ab1edac416cd5a55acc4bee83fa293dfd71937850dea000dbdc6c0605de0dc48a1eaea855bc28

  • memory/2316-8-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2316-16-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

    Filesize

    4KB

  • memory/2316-30-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2316-29-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2316-24-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2316-21-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2316-26-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2316-23-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2316-18-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2316-10-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2316-12-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2316-14-0x0000000000400000-0x0000000000442000-memory.dmp

    Filesize

    264KB

  • memory/2644-6-0x0000000000570000-0x0000000000578000-memory.dmp

    Filesize

    32KB

  • memory/2644-2-0x0000000000BA0000-0x0000000000C10000-memory.dmp

    Filesize

    448KB

  • memory/2644-0-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

    Filesize

    4KB

  • memory/2644-25-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2644-1-0x00000000013C0000-0x000000000156E000-memory.dmp

    Filesize

    1.7MB

  • memory/2644-5-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

  • memory/2644-4-0x0000000074B8E000-0x0000000074B8F000-memory.dmp

    Filesize

    4KB

  • memory/2644-3-0x0000000074B80000-0x000000007526E000-memory.dmp

    Filesize

    6.9MB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.