Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
94s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
28/01/2025, 07:08
Behavioral task
behavioral1
Sample
dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe
Resource
win7-20241010-en
General
-
Target
dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe
-
Size
520KB
-
MD5
a295f1e268dc1500b898844b02d58248
-
SHA1
c8f629f60c14bbeb810d80e6918ed7ee56ac50f5
-
SHA256
dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12
-
SHA512
b68440775f974b2449a3be357e18786d7cfce5996ab3c9f287805393f5ac0cfa8d74a3de2322caf7cc5fb667b7640caf8e720d06b9dcfb93e8e9f61297eb9c28
-
SSDEEP
12288:v6Wq4aaE6KwyF5L0Y2D1PqLbRxKFLCiN5qwtyLN:tthEVaPqLbRxKdCij1IN
Malware Config
Extracted
agenttesla
Protocol: ftp- Host:
ftp://ftp.antoniomayol.com:21 - Port:
21 - Username:
[email protected] - Password:
cMhKDQUk1{;%
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Agenttesla family
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vaccinatory.vbs vaccinatory.exe -
Executes dropped EXE 1 IoCs
pid Process 3364 vaccinatory.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 16 ip-api.com -
AutoIT Executable 2 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral2/memory/3728-13-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe behavioral2/memory/3364-25-0x0000000000400000-0x00000000004C2000-memory.dmp autoit_exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3364 set thread context of 1460 3364 vaccinatory.exe 84 -
resource yara_rule behavioral2/memory/3728-0-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/files/0x0007000000023c73-10.dat upx behavioral2/memory/3728-13-0x0000000000400000-0x00000000004C2000-memory.dmp upx behavioral2/memory/3364-25-0x0000000000400000-0x00000000004C2000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vaccinatory.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1460 RegSvcs.exe 1460 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 3364 vaccinatory.exe 3364 vaccinatory.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1460 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3728 dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe 3728 dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe 3364 vaccinatory.exe 3364 vaccinatory.exe -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 3728 dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe 3728 dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe 3364 vaccinatory.exe 3364 vaccinatory.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3728 wrote to memory of 3364 3728 dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe 83 PID 3728 wrote to memory of 3364 3728 dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe 83 PID 3728 wrote to memory of 3364 3728 dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe 83 PID 3364 wrote to memory of 1460 3364 vaccinatory.exe 84 PID 3364 wrote to memory of 1460 3364 vaccinatory.exe 84 PID 3364 wrote to memory of 1460 3364 vaccinatory.exe 84 PID 3364 wrote to memory of 1460 3364 vaccinatory.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe"C:\Users\Admin\AppData\Local\Temp\dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Users\Admin\AppData\Local\turbinals\vaccinatory.exe"C:\Users\Admin\AppData\Local\Temp\dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12.exe"3⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
239KB
MD5885b6ea3051451ee410c3ef9c7f8f85e
SHA13bb9e425a17d324652c5a304f89a78774564b93d
SHA2563ecab50f5e3b9ddef521b28f34aa8bf5734f0f313f70440cf9e439c9b0653c0b
SHA512683551b88887c4295fc667736961fc0f96ba2a8c90981e81f255bd21f09a442de1ed5f6703c342388e4926099123046f941a47f6d69132baa0f85b8df9ee9ede
-
Filesize
520KB
MD5a295f1e268dc1500b898844b02d58248
SHA1c8f629f60c14bbeb810d80e6918ed7ee56ac50f5
SHA256dd6f99ed2cc3586d2af65cc1b359ccfa3448cde53ca4465f9ffe3e8bc4c86e12
SHA512b68440775f974b2449a3be357e18786d7cfce5996ab3c9f287805393f5ac0cfa8d74a3de2322caf7cc5fb667b7640caf8e720d06b9dcfb93e8e9f61297eb9c28