Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
16/03/2024, 02:11
Static task
static1
Behavioral task
behavioral1
Sample
Bibeskftigelserne221.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Bibeskftigelserne221.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Schizopod/Nonmakeup101.ps1
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Schizopod/Nonmakeup101.ps1
Resource
win10v2004-20240226-en
General
-
Target
Bibeskftigelserne221.exe
-
Size
1.2MB
-
MD5
792dec181c3f286826d04aecd6cf32f1
-
SHA1
d71c41fd445053571453dd43f8071e058de19ced
-
SHA256
ec9fe9526ec132e17c934f5b3993f164b8cb5ec15813171c04f63ff563ad4f1e
-
SHA512
fddd91dc77476ba57be516a4a4893beadcb84cf7d916bc80fda92640ec8a5a6b3e3a3efba72f5d56b9a0af6bf2a8092d40131825ed2c10b99a1367e47c169748
-
SSDEEP
24576:7BG3e6TOKsix+24/2LoxYHum/1DJQRzEWbo/bwo:dGe6TOiE202sxYOO10UDwo
Malware Config
Signatures
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2556 powershell.exe 2472 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2556 set thread context of 2472 2556 powershell.exe 32 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 2556 powershell.exe 2556 powershell.exe 2556 powershell.exe 2556 powershell.exe 2556 powershell.exe 2556 powershell.exe 2556 powershell.exe 2556 powershell.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2556 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2556 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2856 wrote to memory of 2556 2856 Bibeskftigelserne221.exe 28 PID 2856 wrote to memory of 2556 2856 Bibeskftigelserne221.exe 28 PID 2856 wrote to memory of 2556 2856 Bibeskftigelserne221.exe 28 PID 2856 wrote to memory of 2556 2856 Bibeskftigelserne221.exe 28 PID 2556 wrote to memory of 2560 2556 powershell.exe 30 PID 2556 wrote to memory of 2560 2556 powershell.exe 30 PID 2556 wrote to memory of 2560 2556 powershell.exe 30 PID 2556 wrote to memory of 2560 2556 powershell.exe 30 PID 2556 wrote to memory of 2472 2556 powershell.exe 32 PID 2556 wrote to memory of 2472 2556 powershell.exe 32 PID 2556 wrote to memory of 2472 2556 powershell.exe 32 PID 2556 wrote to memory of 2472 2556 powershell.exe 32 PID 2556 wrote to memory of 2472 2556 powershell.exe 32 PID 2556 wrote to memory of 2472 2556 powershell.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bibeskftigelserne221.exe"C:\Users\Admin\AppData\Local\Temp\Bibeskftigelserne221.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -windowstyle hidden "$Coveter=Get-Content 'C:\Users\Admin\AppData\Roaming\Bilithon\benthoscope\Schizopod\Nonmakeup101.Pan55';$Paatalemyndighederne=$Coveter.SubString(54624,3);.$Paatalemyndighederne($Coveter)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"3⤵PID:2560
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2472
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
325KB
MD517afb85f7d98834a22aa2d79adcc4952
SHA1e4d0af396242985d07bec411d80e6516161a283f
SHA2566d1b4dff638e2368991cce0c1fa8a7023764807dd6d9b053589053f4ac6e8cd8
SHA512ce847608470eb94614c0d6ae272be49f1653bab99127d7ee5ae22fb35c35f9f91be36bf44fe30ddb2bec8841c674da6794b0c3dd067b168a5bdd313308a8d57d
-
Filesize
53KB
MD52e56e126a7f68c9dbb6167bfc1cd26c2
SHA1e45b4e9dff74f0711968994253b8fcaf39a5f8e3
SHA256b3fb58fdae2d31784f1b1c4f62b2c20a985789de7cb63b6e4748168aac4fb70a
SHA51215b0861ae57b05cc8906d8706332797da2152d44f16ba4c89da37fc6ec5753d543e890d898ecda384bcf1cf18894291a94262959dd7f395649e220629a814e3d