Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
91s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2025, 01:18
Static task
static1
Behavioral task
behavioral1
Sample
a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe
Resource
win7-20240903-en
General
-
Target
a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe
-
Size
860KB
-
MD5
4eca898bf9412c9bdad5c4f648c42edb
-
SHA1
b9992977ecb115e8469a752398c3bf2f520c50a2
-
SHA256
a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662
-
SHA512
d881ca213a5763f0cd55f8479ded38658d39002431427b3ae0359bc72131b3d3840f75c10fe620213144a0ecdfd3f2e17fd3acca6cd665b8e097587e1bc32de3
-
SSDEEP
24576:/RmJkcoQricOIQxiZY1WNy7RxKdCij1IN:UJZoQrbTFZY1WNyCC21IN
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.antoniomayol.com:21 - Port:
21 - Username:
[email protected] - Password:
cMhKDQUk1{;%
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vaccinatory.vbs vaccinatory.exe -
Executes dropped EXE 1 IoCs
pid Process 3832 vaccinatory.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 12 ip-api.com -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/1396-0-0x0000000000400000-0x00000000004B5000-memory.dmp autoit_exe behavioral2/files/0x000a000000023b99-10.dat autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3832 set thread context of 1856 3832 vaccinatory.exe 83 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vaccinatory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1856 RegSvcs.exe 1856 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3832 vaccinatory.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1856 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1396 a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe 1396 a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe 3832 vaccinatory.exe 3832 vaccinatory.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1396 a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe 1396 a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe 3832 vaccinatory.exe 3832 vaccinatory.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1396 wrote to memory of 3832 1396 a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe 82 PID 1396 wrote to memory of 3832 1396 a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe 82 PID 1396 wrote to memory of 3832 1396 a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe 82 PID 3832 wrote to memory of 1856 3832 vaccinatory.exe 83 PID 3832 wrote to memory of 1856 3832 vaccinatory.exe 83 PID 3832 wrote to memory of 1856 3832 vaccinatory.exe 83 PID 3832 wrote to memory of 1856 3832 vaccinatory.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe"C:\Users\Admin\AppData\Local\Temp\a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1396 -
C:\Users\Admin\AppData\Local\turbinals\vaccinatory.exe"C:\Users\Admin\AppData\Local\Temp\a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3832 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
860KB
MD54eca898bf9412c9bdad5c4f648c42edb
SHA1b9992977ecb115e8469a752398c3bf2f520c50a2
SHA256a47b0a1c00799396c4b7b3df67dde47e2518c0657d634333f5c5c3e4cb6f7662
SHA512d881ca213a5763f0cd55f8479ded38658d39002431427b3ae0359bc72131b3d3840f75c10fe620213144a0ecdfd3f2e17fd3acca6cd665b8e097587e1bc32de3