Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
23/01/2025, 16:02
Static task
static1
Behavioral task
behavioral1
Sample
PI ITS15235.xll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
PI ITS15235.xll
Resource
win10v2004-20241007-en
General
-
Target
PI ITS15235.xll
-
Size
3KB
-
MD5
d137ab6fd155d9db65d23b1dd7aec43e
-
SHA1
4870806f3fa9d3bb3cd65cfaa9c47f7d83dfaa21
-
SHA256
ffc0753059b38955158a02220aea934a651977953f07e9cc1b4ea43797d3481b
-
SHA512
064b9fa2b89bdb0bcf8b0fa00ebb78f9b817f23f1b6ab4d8551541fa64cf6c9a754200a5c2dc184a444d6ecd14ffda6df4c78a8356c0887d7f11e6f090988daf
Malware Config
Extracted
vipkeylogger
https://api.telegram.org/bot7354418955:AAH10FAR8IByRBtd_Qs69uwN7lnhl-2X18k/sendMessage?chat_id=6851554211
Signatures
-
VIPKeylogger
VIPKeylogger is a keylogger and infostealer written in C# and it resembles SnakeKeylogger that was found in 2020.
-
Vipkeylogger family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 740 powershell.exe 1728 powershell.exe -
Downloads MZ/PE file
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation regasms.exe -
Executes dropped EXE 2 IoCs
pid Process 216 regasms.exe 4932 regasms.exe -
Loads dropped DLL 2 IoCs
pid Process 4760 EXCEL.EXE 4760 EXCEL.EXE -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regasms.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regasms.exe Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regasms.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 51 checkip.dyndns.org 53 reallyfreegeoip.org 54 reallyfreegeoip.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 216 set thread context of 4932 216 regasms.exe 101 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString EXCEL.EXE -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU EXCEL.EXE Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS EXCEL.EXE Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily EXCEL.EXE -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1632 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 4760 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 17 IoCs
pid Process 216 regasms.exe 216 regasms.exe 216 regasms.exe 216 regasms.exe 216 regasms.exe 216 regasms.exe 216 regasms.exe 216 regasms.exe 216 regasms.exe 216 regasms.exe 216 regasms.exe 1728 powershell.exe 740 powershell.exe 740 powershell.exe 4932 regasms.exe 1728 powershell.exe 4932 regasms.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 216 regasms.exe Token: SeDebugPrivilege 1728 powershell.exe Token: SeDebugPrivilege 740 powershell.exe Token: SeDebugPrivilege 4932 regasms.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4760 EXCEL.EXE -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 4760 EXCEL.EXE 4760 EXCEL.EXE 4760 EXCEL.EXE 4760 EXCEL.EXE 4760 EXCEL.EXE 4760 EXCEL.EXE -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 4760 wrote to memory of 216 4760 EXCEL.EXE 86 PID 4760 wrote to memory of 216 4760 EXCEL.EXE 86 PID 216 wrote to memory of 740 216 regasms.exe 95 PID 216 wrote to memory of 740 216 regasms.exe 95 PID 216 wrote to memory of 1728 216 regasms.exe 96 PID 216 wrote to memory of 1728 216 regasms.exe 96 PID 216 wrote to memory of 1632 216 regasms.exe 98 PID 216 wrote to memory of 1632 216 regasms.exe 98 PID 216 wrote to memory of 4932 216 regasms.exe 101 PID 216 wrote to memory of 4932 216 regasms.exe 101 PID 216 wrote to memory of 4932 216 regasms.exe 101 PID 216 wrote to memory of 4932 216 regasms.exe 101 PID 216 wrote to memory of 4932 216 regasms.exe 101 PID 216 wrote to memory of 4932 216 regasms.exe 101 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regasms.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 regasms.exe
Processes
-
C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\PI ITS15235.xll"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4760 -
C:\Users\Admin\AppData\Roaming\regasms.exeC:\Users\Admin\AppData\Roaming\regasms.exe2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\regasms.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:740
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\klGvCRWUCzHnCD.exe"3⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1728
-
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\klGvCRWUCzHnCD" /XML "C:\Users\Admin\AppData\Local\Temp\tmp3479.tmp"3⤵
- Scheduled Task/Job: Scheduled Task
PID:1632
-
-
C:\Users\Admin\AppData\Roaming\regasms.exeC:\Users\Admin\AppData\Roaming\regasms.exe3⤵
- Executes dropped EXE
- Accesses Microsoft Outlook profiles
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:4932
-
-
Network
MITRE ATT&CK Enterprise v15
Execution
Command and Scripting Interpreter
1PowerShell
1Scheduled Task/Job
1Scheduled Task
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
3KB
MD5d137ab6fd155d9db65d23b1dd7aec43e
SHA14870806f3fa9d3bb3cd65cfaa9c47f7d83dfaa21
SHA256ffc0753059b38955158a02220aea934a651977953f07e9cc1b4ea43797d3481b
SHA512064b9fa2b89bdb0bcf8b0fa00ebb78f9b817f23f1b6ab4d8551541fa64cf6c9a754200a5c2dc184a444d6ecd14ffda6df4c78a8356c0887d7f11e6f090988daf
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD5492c80e739e460bcf9363e0386567883
SHA121640ff7debaecfcb1afea6c370fdee8ad63fac2
SHA256b47680d527eba2f46e6232e7c822091295c11ddb186b87d469b2250f837a4008
SHA5128f7d2d0264e8ec09a78459d30b12b73a7ddfb84e9e1b8cee761a7ee17646cbc5616a0abed27326ffa173c7efda05500f4330f5915fb304e6a0ab21cd99dbca0c
-
Filesize
1.0MB
MD57e38676fd883ddb05265c87021166681
SHA18c02ce697b10a9055fbb367b55a38a060c86ba0f
SHA25668cbe81c23f778d1d4277ca334bb770c6178e9bd0430e78d1ecc3fe814b23a67
SHA51229daea733120587e4fc6bc29df2a59bec2121c3a3e50809b71d6733df6e1d91bde7b510002c2394ee7add4265123333652c4623677292cf9fca8a459745b3d2f