Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    55s
  • max time network
    74s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18/09/2022, 22:47

General

  • Target

    ba19584a7fb91f89a4bf864b77477e108c2329816ea50eb635ee8138eadad415.exe

  • Size

    1.8MB

  • MD5

    8a04966531e93843ce8b35fd58964b21

  • SHA1

    a3a0b3151214d3df93eb9e6cf25620bf3d134943

  • SHA256

    ba19584a7fb91f89a4bf864b77477e108c2329816ea50eb635ee8138eadad415

  • SHA512

    acf0c645cb7ace3db4921216689945f0043774daf1c1ced25a6167dd9bcf762d4df28acdafcbcfbb4aa347b2cc0d3341d2df4d3bccb18682e1dae0df766a977b

  • SSDEEP

    49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ba19584a7fb91f89a4bf864b77477e108c2329816ea50eb635ee8138eadad415.exe
    "C:\Users\Admin\AppData\Local\Temp\ba19584a7fb91f89a4bf864b77477e108c2329816ea50eb635ee8138eadad415.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4920
  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4972

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.8MB

    MD5

    8a04966531e93843ce8b35fd58964b21

    SHA1

    a3a0b3151214d3df93eb9e6cf25620bf3d134943

    SHA256

    ba19584a7fb91f89a4bf864b77477e108c2329816ea50eb635ee8138eadad415

    SHA512

    acf0c645cb7ace3db4921216689945f0043774daf1c1ced25a6167dd9bcf762d4df28acdafcbcfbb4aa347b2cc0d3341d2df4d3bccb18682e1dae0df766a977b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.8MB

    MD5

    8a04966531e93843ce8b35fd58964b21

    SHA1

    a3a0b3151214d3df93eb9e6cf25620bf3d134943

    SHA256

    ba19584a7fb91f89a4bf864b77477e108c2329816ea50eb635ee8138eadad415

    SHA512

    acf0c645cb7ace3db4921216689945f0043774daf1c1ced25a6167dd9bcf762d4df28acdafcbcfbb4aa347b2cc0d3341d2df4d3bccb18682e1dae0df766a977b

  • memory/4288-247-0x0000000000FD0000-0x00000000012EF000-memory.dmp

    Filesize

    3.1MB

  • memory/4288-255-0x00000000012F0000-0x0000000001334000-memory.dmp

    Filesize

    272KB

  • memory/4288-254-0x0000000000FD0000-0x00000000012EF000-memory.dmp

    Filesize

    3.1MB

  • memory/4288-249-0x00000000012F0000-0x0000000001334000-memory.dmp

    Filesize

    272KB

  • memory/4788-150-0x0000000000CC0000-0x0000000000FDF000-memory.dmp

    Filesize

    3.1MB

  • memory/4788-156-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-121-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-122-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-123-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-125-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-126-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-127-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-128-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-157-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-130-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-131-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-132-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-133-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-135-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-136-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-138-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-137-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-134-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-124-0x0000000000CC0000-0x0000000000FDF000-memory.dmp

    Filesize

    3.1MB

  • memory/4788-139-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-140-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-141-0x0000000000C30000-0x0000000000C74000-memory.dmp

    Filesize

    272KB

  • memory/4788-142-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-143-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-144-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-145-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-146-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-147-0x0000000000CC0000-0x0000000000FDF000-memory.dmp

    Filesize

    3.1MB

  • memory/4788-148-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-149-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-151-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-119-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-152-0x0000000000CC0000-0x0000000000FDF000-memory.dmp

    Filesize

    3.1MB

  • memory/4788-153-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-154-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-120-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-155-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-129-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-158-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-159-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-160-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-161-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-162-0x0000000000CC1000-0x0000000000CC3000-memory.dmp

    Filesize

    8KB

  • memory/4788-163-0x0000000000CC1000-0x0000000000CC3000-memory.dmp

    Filesize

    8KB

  • memory/4788-164-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-165-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-167-0x0000000000CC0000-0x0000000000FDF000-memory.dmp

    Filesize

    3.1MB

  • memory/4788-186-0x0000000000CC0000-0x0000000000FDF000-memory.dmp

    Filesize

    3.1MB

  • memory/4788-187-0x0000000000C30000-0x0000000000C74000-memory.dmp

    Filesize

    272KB

  • memory/4788-116-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-117-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4788-118-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-180-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-171-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-172-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-173-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-174-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-175-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-177-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-176-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-170-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-179-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-182-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-178-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-181-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-183-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-184-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-185-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-169-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB

  • memory/4920-168-0x00000000777D0000-0x000000007795E000-memory.dmp

    Filesize

    1.6MB