Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    101s
  • max time network
    103s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    14/09/2022, 14:57

General

  • Target

    d3800f1215047099c01eda94a1ae2d2eea37021ed98ef8f13a36aee17e2e8cb8.exe

  • Size

    1.8MB

  • MD5

    d9dbbd5e28fd0377c8794750634b50fb

  • SHA1

    145583a7625b936af249b89dfce9d09ba9a8677b

  • SHA256

    d3800f1215047099c01eda94a1ae2d2eea37021ed98ef8f13a36aee17e2e8cb8

  • SHA512

    c474fb36b36ad111b731e2a3d2d6f98a311bfa9dd4effe7224f25247f749f4f9b786bba5498c500be70ff64b6e398615dfe97d73bcd532df68a53432b53b76d7

  • SSDEEP

    49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d3800f1215047099c01eda94a1ae2d2eea37021ed98ef8f13a36aee17e2e8cb8.exe
    "C:\Users\Admin\AppData\Local\Temp\d3800f1215047099c01eda94a1ae2d2eea37021ed98ef8f13a36aee17e2e8cb8.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2960
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4948
  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      2⤵
      • Creates scheduled task(s)
      PID:5036

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.8MB

    MD5

    d9dbbd5e28fd0377c8794750634b50fb

    SHA1

    145583a7625b936af249b89dfce9d09ba9a8677b

    SHA256

    d3800f1215047099c01eda94a1ae2d2eea37021ed98ef8f13a36aee17e2e8cb8

    SHA512

    c474fb36b36ad111b731e2a3d2d6f98a311bfa9dd4effe7224f25247f749f4f9b786bba5498c500be70ff64b6e398615dfe97d73bcd532df68a53432b53b76d7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.8MB

    MD5

    d9dbbd5e28fd0377c8794750634b50fb

    SHA1

    145583a7625b936af249b89dfce9d09ba9a8677b

    SHA256

    d3800f1215047099c01eda94a1ae2d2eea37021ed98ef8f13a36aee17e2e8cb8

    SHA512

    c474fb36b36ad111b731e2a3d2d6f98a311bfa9dd4effe7224f25247f749f4f9b786bba5498c500be70ff64b6e398615dfe97d73bcd532df68a53432b53b76d7

  • memory/1776-212-0x0000000000130000-0x000000000044F000-memory.dmp

    Filesize

    3.1MB

  • memory/1776-257-0x0000000000130000-0x000000000044F000-memory.dmp

    Filesize

    3.1MB

  • memory/1776-256-0x0000000000A40000-0x0000000000A84000-memory.dmp

    Filesize

    272KB

  • memory/1776-255-0x0000000000130000-0x000000000044F000-memory.dmp

    Filesize

    3.1MB

  • memory/1776-254-0x0000000000130000-0x000000000044F000-memory.dmp

    Filesize

    3.1MB

  • memory/1776-253-0x0000000000A40000-0x0000000000A84000-memory.dmp

    Filesize

    272KB

  • memory/2960-153-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-158-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-123-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-125-0x0000000000820000-0x0000000000B3F000-memory.dmp

    Filesize

    3.1MB

  • memory/2960-126-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-124-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-127-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-128-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-129-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-159-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-131-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-132-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-133-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-134-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-135-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-136-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-137-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-138-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-139-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-140-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-141-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-142-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-143-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-144-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-145-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-146-0x00000000007D0000-0x0000000000814000-memory.dmp

    Filesize

    272KB

  • memory/2960-147-0x0000000000820000-0x0000000000B3F000-memory.dmp

    Filesize

    3.1MB

  • memory/2960-148-0x0000000000820000-0x0000000000B3F000-memory.dmp

    Filesize

    3.1MB

  • memory/2960-149-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-150-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-151-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-152-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-121-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-154-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-156-0x0000000000820000-0x0000000000B3F000-memory.dmp

    Filesize

    3.1MB

  • memory/2960-155-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-122-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-157-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-130-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-160-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-161-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-162-0x0000000000820000-0x0000000000B3F000-memory.dmp

    Filesize

    3.1MB

  • memory/2960-164-0x0000000000821000-0x0000000000823000-memory.dmp

    Filesize

    8KB

  • memory/2960-165-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-163-0x0000000000821000-0x0000000000823000-memory.dmp

    Filesize

    8KB

  • memory/2960-166-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-186-0x0000000000820000-0x0000000000B3F000-memory.dmp

    Filesize

    3.1MB

  • memory/2960-187-0x00000000007D0000-0x0000000000814000-memory.dmp

    Filesize

    272KB

  • memory/2960-116-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-117-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-118-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-119-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/2960-120-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-182-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-173-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-174-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-175-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-176-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-177-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-178-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-179-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-172-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-180-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-184-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-181-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-183-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-185-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-171-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-170-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-169-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB

  • memory/4948-168-0x0000000077600000-0x000000007778E000-memory.dmp

    Filesize

    1.6MB