Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows10_x64 -
resource
win10v200430 -
submitted
10/07/2020, 11:03
Static task
static1
Behavioral task
behavioral1
Sample
oldmama.m83.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
oldmama.m83.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
-
Target
oldmama.m83.exe
-
Size
179KB
-
MD5
8ab3e8276a19c042ec7a789e86462aea
-
SHA1
86904ffb2bdf8fa3e864ab50471bc8086e720999
-
SHA256
035c2fa5d912202dd34e8410b14a42b0db007c2be8ed819bbc444f9818497f5b
-
SHA512
9c9ad8236eb69ae9a748d83ac35224d4de0a563ba0af0431e85a4354f5e81fe5ab0491d2c0f5bbc2c61789f27889545731db5fcd16a6a0264845517422afa78d
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
pid Process 972 oldmama.m83.exe 972 oldmama.m83.exe 972 oldmama.m83.exe 972 oldmama.m83.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 972 set thread context of 3004 972 oldmama.m83.exe 56 PID 1896 set thread context of 3004 1896 chkdsk.exe 56 -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3004 wrote to memory of 1896 3004 Explorer.EXE 68 PID 3004 wrote to memory of 1896 3004 Explorer.EXE 68 PID 3004 wrote to memory of 1896 3004 Explorer.EXE 68 PID 1896 wrote to memory of 1320 1896 chkdsk.exe 69 PID 1896 wrote to memory of 1320 1896 chkdsk.exe 69 PID 1896 wrote to memory of 1320 1896 chkdsk.exe 69 PID 1896 wrote to memory of 2864 1896 chkdsk.exe 75 PID 1896 wrote to memory of 2864 1896 chkdsk.exe 75 PID 1896 wrote to memory of 2864 1896 chkdsk.exe 75 PID 1896 wrote to memory of 4044 1896 chkdsk.exe 77 PID 1896 wrote to memory of 4044 1896 chkdsk.exe 77 PID 1896 wrote to memory of 4044 1896 chkdsk.exe 77 -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3004 Explorer.EXE -
description ioc Process Key created \Registry\User\S-1-5-21-1231583446-2617009595-2137880041-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 chkdsk.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run chkdsk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\8P8XBBM = "C:\\Program Files (x86)\\K9rrhzl\\taskhostfx4.exe" chkdsk.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 972 oldmama.m83.exe Token: SeDebugPrivilege 1896 chkdsk.exe Token: SeShutdownPrivilege 3004 Explorer.EXE Token: SeCreatePagefilePrivilege 3004 Explorer.EXE Token: SeShutdownPrivilege 3004 Explorer.EXE Token: SeCreatePagefilePrivilege 3004 Explorer.EXE Token: SeShutdownPrivilege 3004 Explorer.EXE Token: SeCreatePagefilePrivilege 3004 Explorer.EXE Token: SeShutdownPrivilege 3004 Explorer.EXE Token: SeCreatePagefilePrivilege 3004 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
pid Process 972 oldmama.m83.exe 972 oldmama.m83.exe 972 oldmama.m83.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe 1896 chkdsk.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3004 Explorer.EXE -
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier chkdsk.exe -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\K9rrhzl\taskhostfx4.exe chkdsk.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
PID:3004 -
C:\Users\Admin\AppData\Local\Temp\oldmama.m83.exe"C:\Users\Admin\AppData\Local\Temp\oldmama.m83.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:972
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
- Modifies Internet Explorer settings
- Adds Run entry to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
- Enumerates system info in registry
- Drops file in Program Files directory
PID:1896 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\oldmama.m83.exe"3⤵PID:1320
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:2864
-
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵PID:4044
-
-