The installed software package appears to have been trying to masquerade as the 1Password windows installer and password vault software. Having obtained sensitive credentials, WMIC was used to deploy a fake password manager application across multiple systems in the network. Shortly after applying this registry modification, the LSASS process was dumped to disk using the Sysinternals tool ProcDump. This enforces credential information to be saved in cleartext in memory. Within two minutes of the discovery activity, WDigest authentication was enabled (disabled by default in Windows 10) in the registry on the infected host.

The threat actor then utilized built-in Windows utilities such as net.exe, ipconfig.exe and nltest.exe for performing internal reconnaissance.

The Trickbot payload injected itself into the system process wermgr.exe - the Windows process responsible for error reporting. The zip attachment would likely contain a Word or Excel document with macros, which upon execution, would start a Trickbot infection. We assess with medium confidence that the initial threat vector for this intrusion was a password protected archive, delivered via malspam campaigns.

A setup file, which attempted to masquerade as a legitimate software installer, was deployed on several systems to fetch additional Cobalt Strike beacons. In this intrusion, we will take a look at a Trickbot infection, where soon after gaining access, the threat actor deployed Cobalt Strike and then started to enumerate the target network and dump credential information.

More recently, Trickbot has been known for its involvement in ransomware attacks, deploying Ryuk and Conti in target environments. Initially focusing on bank credential theft, the Trickbot operators have extended its capabilities. Over the past years, Trickbot has established itself as modular and multifunctional malware.

Onepassword windows