Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
68s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02/06/2022, 05:37
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe
Resource
win10v2004-20220414-en
General
-
Target
SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe
-
Size
743KB
-
MD5
6bc672d5f96b14084c561a217731c5a4
-
SHA1
7ff84c9fe7594826d2c8689279979bdc75f0b561
-
SHA256
cd238eae8acd5aaece92a1c264437fedea2fd7088df8353d81cdfd6af037e69b
-
SHA512
6c06111139ff6f35ceb302cb7f0d1e960134d1a46fee4fe2727310a416b36c35e6c10372cbdd5107b01af833d3e3f3ec5bf0186a7fdd62b02e9d86ea2184fd7a
Malware Config
Extracted
oski
unitech.co.vu
Signatures
-
Oski
Oski is an infostealer targeting browser data, crypto wallets.
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt) M2
-
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (passwords.txt) M2
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil
-
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer HTTP POST Pattern
-
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe -
Loads dropped DLL 3 IoCs
pid Process 4628 MSBuild.exe 4628 MSBuild.exe 4628 MSBuild.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1372 set thread context of 4628 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 92 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 1 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString MSBuild.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5084 schtasks.exe -
Kills process with taskkill 1 IoCs
pid Process 3860 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe Token: SeDebugPrivilege 3860 taskkill.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 1372 wrote to memory of 5084 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 90 PID 1372 wrote to memory of 5084 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 90 PID 1372 wrote to memory of 5084 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 90 PID 1372 wrote to memory of 4628 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 92 PID 1372 wrote to memory of 4628 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 92 PID 1372 wrote to memory of 4628 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 92 PID 1372 wrote to memory of 4628 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 92 PID 1372 wrote to memory of 4628 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 92 PID 1372 wrote to memory of 4628 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 92 PID 1372 wrote to memory of 4628 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 92 PID 1372 wrote to memory of 4628 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 92 PID 1372 wrote to memory of 4628 1372 SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe 92 PID 4628 wrote to memory of 3476 4628 MSBuild.exe 93 PID 4628 wrote to memory of 3476 4628 MSBuild.exe 93 PID 4628 wrote to memory of 3476 4628 MSBuild.exe 93 PID 3476 wrote to memory of 3860 3476 cmd.exe 95 PID 3476 wrote to memory of 3860 3476 cmd.exe 95 PID 3476 wrote to memory of 3860 3476 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.IL.Trojan.MSILMamut.3044.28554.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XukguFq" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD249.tmp"2⤵
- Creates scheduled task(s)
PID:5084
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"{path}"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:4628 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /pid 4628 & erase C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe & RD /S /Q C:\\ProgramData\\059434714861759\\* & exit3⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\taskkill.exetaskkill /pid 46284⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
Filesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
Filesize
630KB
MD5e477a96c8f2b18d6b5c27bde49c990bf
SHA1e980c9bf41330d1e5bd04556db4646a0210f7409
SHA25616574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
SHA512335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c
-
Filesize
1KB
MD56057795a82888eb61b98922601824cc4
SHA1b478a7f45f8321d7781d355a8143877508787d68
SHA2567e60fad5192ec7f667549dd506ba70cbc883bc2eb88b5b0fd245dc80928f3bbc
SHA512ab6e4b67bffd1f7d615cae4863dbd1943721407b251d0fc3b6dc69498fa8741f083dadbda978ec510b5c7b425727aa85503f2d86005dffa43659efb5bf429521