Managed XDR

scratch-zoo-2025-03-05...a0b061b8851b7fa1824e8b (Agent Tesla) — отчёт о динамическом анализе вредоносного файла

Информация о файле

Имя файла
scratch-zoo-2025-03-05-bc9c07de08a0b061b8851b7fa1824e8b
Тип файла
SMTP mail, UTF-8 Unicode text
Размер файла
744.3 KB
Первое обнаружение
Последнее обнаружение

Окружение

w10/x86 en

Хеши

SHA1
014e7b2650a3ed3720704bd3f084c317c94c9b13
SHA256
b80d3a96768d9a7f6a808f036648a00d82a5b8a499726e4141856836df28decd
MD5
bc9c07de08a0b061b8851b7fa1824e8b

Вредоносное ПО

  • Agent Tesla

Сигнатуры

Execution

T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1047 has_wmi: Executes one or several WMI requests

Persistence

T1053.005 creates_tasks: Creates a delayed task using Task Scheduler

Privilege Escalation

T1055.002 inject_write_pe: Writes PE file to another process's memory
T1055.012 injection_runpe: Injects code into another process
T1053.005 creates_tasks: Creates a delayed task using Task Scheduler
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process

Defense Evasion

T1055.002 inject_write_pe: Writes PE file to another process's memory
T1055.012 injection_runpe: Injects code into another process
T1562.001 disables_security: Disables Windows Security options
T1497.001 antivm_generic_bios: Checks the BIOS version, possibly for anti-virtualization
T1497.001 antivm_sandboxie: Attempts to detect Sandboxie
T1497.001 antivm_vbox_keys: Detects VirtualBox through the presence of a registry key
T1497.001 antivm_vmware_keys: Detects VMware through the presence of a registry key
T1497.001 antivm_generic_scsi: Attempts to detect virtualization by SCSI Disk Identifier
T1564.001 stealth_file: Creates hidden or system files
T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1027.002 packer_entropy: Probably contains compressed or encrypted data
T1497.001 antivm_generic_video: Checks information about video adapters in registry, possibly for anti-virtualization
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.003 antisandbox_sleep: The process attempted to slow down analysis
T1134 sets_privilegies_via_adjusttokenprivileges: Sets process privilege via AdjustTokenPrivileges
T1134 opens_thread_token: Opens the access token associated with a thread
T1134 opens_process_token: Opens the access token associated with a process
T1070 stealth_window: A process created a hidden window

Discovery

T1497.001 antivm_generic_bios: Checks the BIOS version, possibly for anti-virtualization
T1497.001 antivm_sandboxie: Attempts to detect Sandboxie
T1497.001 antivm_vbox_keys: Detects VirtualBox through the presence of a registry key
T1497.001 antivm_vmware_keys: Detects VMware through the presence of a registry key
T1497.001 antivm_generic_scsi: Attempts to detect virtualization by SCSI Disk Identifier
T1497.003 antisandbox_idletime: Detects Windows Idle Time to determine the uptime
T1518 locates_browser: Attempts to identify where browsers are installed
T1497.001 antivm_generic_video: Checks information about video adapters in registry, possibly for anti-virtualization
T1497.001 antivm_queries_computername: Retrieves the computer name
T1497.003 antisandbox_sleep: The process attempted to slow down analysis

Other

yara_rules: Static rules
creates_exe: Creates executable files in the file system
unpacker_wrong_base: Possibly, an error occured in the file unpacker
copies_self: Creates a copy of itself
process_crashed: One of the processes has failed
no_graphical_activity: No graphic activity
dotnet_suspicious_resources_names: Dotnet program has suspicious resources names
create_rpc_bindings: Creates RPC connection
creates_suspended_process: Creates suspended process
break_limit_exceeded: Warning: function calls limit has been exceeded
dotnet_obfuscated: Dotnet program is potentially obfuscated
checktokenmembership: Checks user token with CheckTokenMembership call
dotnet_suspicious_entrypoint: Dotnet program has suspicious entrypoint
dotnet_suspicious_module_name: Dotnet program has suspicious module name

Похожие отчёты