Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    67s
  • max time network
    126s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/09/2022, 19:25

General

  • Target

    b7abf3965ad21c9abdd8a54d36c5b28beeefe13948bd5c1ff9d27195b20024f0.exe

  • Size

    1.8MB

  • MD5

    3f16503c9c363f3ada46a5718e4ad98e

  • SHA1

    9ccff0c044bb392db3376006bfc7d0b44ffc75e5

  • SHA256

    b7abf3965ad21c9abdd8a54d36c5b28beeefe13948bd5c1ff9d27195b20024f0

  • SHA512

    a832f5aa0c9b35b4576d23fdada21fa309efb07ab0f5d8a9c275d8ebf352552442d76f3232d81e33545787eaad5dd7bfbeed42f9661473ece6eef3e50bb72746

  • SSDEEP

    49152:AiSzCD+K95aLs7zeqLTVtXtHFIDP8EehiM8qZA:AiSzCD+K95aUeqFtXtHwEEehig

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b7abf3965ad21c9abdd8a54d36c5b28beeefe13948bd5c1ff9d27195b20024f0.exe
    "C:\Users\Admin\AppData\Local\Temp\b7abf3965ad21c9abdd8a54d36c5b28beeefe13948bd5c1ff9d27195b20024f0.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      2⤵
      • Creates scheduled task(s)
      PID:4892
  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5036
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
      2⤵
      • Creates scheduled task(s)
      PID:2796

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.8MB

    MD5

    3f16503c9c363f3ada46a5718e4ad98e

    SHA1

    9ccff0c044bb392db3376006bfc7d0b44ffc75e5

    SHA256

    b7abf3965ad21c9abdd8a54d36c5b28beeefe13948bd5c1ff9d27195b20024f0

    SHA512

    a832f5aa0c9b35b4576d23fdada21fa309efb07ab0f5d8a9c275d8ebf352552442d76f3232d81e33545787eaad5dd7bfbeed42f9661473ece6eef3e50bb72746

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.8MB

    MD5

    3f16503c9c363f3ada46a5718e4ad98e

    SHA1

    9ccff0c044bb392db3376006bfc7d0b44ffc75e5

    SHA256

    b7abf3965ad21c9abdd8a54d36c5b28beeefe13948bd5c1ff9d27195b20024f0

    SHA512

    a832f5aa0c9b35b4576d23fdada21fa309efb07ab0f5d8a9c275d8ebf352552442d76f3232d81e33545787eaad5dd7bfbeed42f9661473ece6eef3e50bb72746

  • memory/4656-144-0x0000000002F30000-0x0000000002F74000-memory.dmp

    Filesize

    272KB

  • memory/4656-133-0x0000000000C90000-0x0000000000FAF000-memory.dmp

    Filesize

    3.1MB

  • memory/4656-137-0x0000000000C91000-0x0000000000C93000-memory.dmp

    Filesize

    8KB

  • memory/4656-138-0x0000000000C90000-0x0000000000FAF000-memory.dmp

    Filesize

    3.1MB

  • memory/4656-139-0x0000000000C91000-0x0000000000C93000-memory.dmp

    Filesize

    8KB

  • memory/4656-141-0x0000000077500000-0x00000000776A3000-memory.dmp

    Filesize

    1.6MB

  • memory/4656-136-0x0000000000C90000-0x0000000000FAF000-memory.dmp

    Filesize

    3.1MB

  • memory/4656-142-0x0000000000C90000-0x0000000000FAF000-memory.dmp

    Filesize

    3.1MB

  • memory/4656-143-0x0000000077500000-0x00000000776A3000-memory.dmp

    Filesize

    1.6MB

  • memory/4656-132-0x0000000000C90000-0x0000000000FAF000-memory.dmp

    Filesize

    3.1MB

  • memory/4656-135-0x0000000000C90000-0x0000000000FAF000-memory.dmp

    Filesize

    3.1MB

  • memory/4656-134-0x0000000002F30000-0x0000000002F74000-memory.dmp

    Filesize

    272KB

  • memory/5036-148-0x0000000000F90000-0x00000000012AF000-memory.dmp

    Filesize

    3.1MB

  • memory/5036-149-0x0000000001600000-0x0000000001644000-memory.dmp

    Filesize

    272KB

  • memory/5036-150-0x0000000077500000-0x00000000776A3000-memory.dmp

    Filesize

    1.6MB

  • memory/5036-152-0x0000000000F91000-0x0000000000F93000-memory.dmp

    Filesize

    8KB

  • memory/5036-147-0x0000000000F90000-0x00000000012AF000-memory.dmp

    Filesize

    3.1MB

  • memory/5036-154-0x0000000000F90000-0x00000000012AF000-memory.dmp

    Filesize

    3.1MB

  • memory/5036-155-0x0000000001600000-0x0000000001644000-memory.dmp

    Filesize

    272KB

  • memory/5036-156-0x0000000077500000-0x00000000776A3000-memory.dmp

    Filesize

    1.6MB