Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
64s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
31/10/2022, 19:47
Static task
static1
Behavioral task
behavioral1
Sample
f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe
Resource
win10-20220901-en
General
-
Target
f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe
-
Size
321KB
-
MD5
69ebb99c95195e25513505feb874af96
-
SHA1
f2ce843d5590796204c34175c2ed56bb893f24e0
-
SHA256
f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252
-
SHA512
d650ab98499b38e41113311be5fe32f35c40f2737bad8e845c4467018a60d77e1dfb8c379f41c6162ebbabd9997bf368999e550a996e16a677d5bccdc9eb8026
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 4936 oobeldr.exe 4956 oobeldr.exe 3600 oobeldr.exe 4056 oobeldr.exe 4404 oobeldr.exe 1440 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2744 set thread context of 2264 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 67 PID 4936 set thread context of 4056 4936 oobeldr.exe 73 PID 4404 set thread context of 1440 4404 oobeldr.exe 77 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4364 schtasks.exe 4576 schtasks.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 2744 wrote to memory of 2028 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 66 PID 2744 wrote to memory of 2028 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 66 PID 2744 wrote to memory of 2028 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 66 PID 2744 wrote to memory of 2264 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 67 PID 2744 wrote to memory of 2264 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 67 PID 2744 wrote to memory of 2264 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 67 PID 2744 wrote to memory of 2264 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 67 PID 2744 wrote to memory of 2264 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 67 PID 2744 wrote to memory of 2264 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 67 PID 2744 wrote to memory of 2264 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 67 PID 2744 wrote to memory of 2264 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 67 PID 2744 wrote to memory of 2264 2744 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 67 PID 2264 wrote to memory of 4364 2264 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 68 PID 2264 wrote to memory of 4364 2264 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 68 PID 2264 wrote to memory of 4364 2264 f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe 68 PID 4936 wrote to memory of 4956 4936 oobeldr.exe 71 PID 4936 wrote to memory of 4956 4936 oobeldr.exe 71 PID 4936 wrote to memory of 4956 4936 oobeldr.exe 71 PID 4936 wrote to memory of 3600 4936 oobeldr.exe 72 PID 4936 wrote to memory of 3600 4936 oobeldr.exe 72 PID 4936 wrote to memory of 3600 4936 oobeldr.exe 72 PID 4936 wrote to memory of 4056 4936 oobeldr.exe 73 PID 4936 wrote to memory of 4056 4936 oobeldr.exe 73 PID 4936 wrote to memory of 4056 4936 oobeldr.exe 73 PID 4936 wrote to memory of 4056 4936 oobeldr.exe 73 PID 4936 wrote to memory of 4056 4936 oobeldr.exe 73 PID 4936 wrote to memory of 4056 4936 oobeldr.exe 73 PID 4936 wrote to memory of 4056 4936 oobeldr.exe 73 PID 4936 wrote to memory of 4056 4936 oobeldr.exe 73 PID 4936 wrote to memory of 4056 4936 oobeldr.exe 73 PID 4056 wrote to memory of 4576 4056 oobeldr.exe 74 PID 4056 wrote to memory of 4576 4056 oobeldr.exe 74 PID 4056 wrote to memory of 4576 4056 oobeldr.exe 74 PID 4404 wrote to memory of 1440 4404 oobeldr.exe 77 PID 4404 wrote to memory of 1440 4404 oobeldr.exe 77 PID 4404 wrote to memory of 1440 4404 oobeldr.exe 77 PID 4404 wrote to memory of 1440 4404 oobeldr.exe 77 PID 4404 wrote to memory of 1440 4404 oobeldr.exe 77 PID 4404 wrote to memory of 1440 4404 oobeldr.exe 77 PID 4404 wrote to memory of 1440 4404 oobeldr.exe 77 PID 4404 wrote to memory of 1440 4404 oobeldr.exe 77 PID 4404 wrote to memory of 1440 4404 oobeldr.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe"C:\Users\Admin\AppData\Local\Temp\f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2744 -
C:\Users\Admin\AppData\Local\Temp\f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exeC:\Users\Admin\AppData\Local\Temp\f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe2⤵PID:2028
-
-
C:\Users\Admin\AppData\Local\Temp\f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exeC:\Users\Admin\AppData\Local\Temp\f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4364
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4956
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:3600
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4576
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4404 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:1440
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
321KB
MD569ebb99c95195e25513505feb874af96
SHA1f2ce843d5590796204c34175c2ed56bb893f24e0
SHA256f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252
SHA512d650ab98499b38e41113311be5fe32f35c40f2737bad8e845c4467018a60d77e1dfb8c379f41c6162ebbabd9997bf368999e550a996e16a677d5bccdc9eb8026
-
Filesize
321KB
MD569ebb99c95195e25513505feb874af96
SHA1f2ce843d5590796204c34175c2ed56bb893f24e0
SHA256f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252
SHA512d650ab98499b38e41113311be5fe32f35c40f2737bad8e845c4467018a60d77e1dfb8c379f41c6162ebbabd9997bf368999e550a996e16a677d5bccdc9eb8026
-
Filesize
321KB
MD569ebb99c95195e25513505feb874af96
SHA1f2ce843d5590796204c34175c2ed56bb893f24e0
SHA256f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252
SHA512d650ab98499b38e41113311be5fe32f35c40f2737bad8e845c4467018a60d77e1dfb8c379f41c6162ebbabd9997bf368999e550a996e16a677d5bccdc9eb8026
-
Filesize
321KB
MD569ebb99c95195e25513505feb874af96
SHA1f2ce843d5590796204c34175c2ed56bb893f24e0
SHA256f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252
SHA512d650ab98499b38e41113311be5fe32f35c40f2737bad8e845c4467018a60d77e1dfb8c379f41c6162ebbabd9997bf368999e550a996e16a677d5bccdc9eb8026
-
Filesize
321KB
MD569ebb99c95195e25513505feb874af96
SHA1f2ce843d5590796204c34175c2ed56bb893f24e0
SHA256f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252
SHA512d650ab98499b38e41113311be5fe32f35c40f2737bad8e845c4467018a60d77e1dfb8c379f41c6162ebbabd9997bf368999e550a996e16a677d5bccdc9eb8026
-
Filesize
321KB
MD569ebb99c95195e25513505feb874af96
SHA1f2ce843d5590796204c34175c2ed56bb893f24e0
SHA256f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252
SHA512d650ab98499b38e41113311be5fe32f35c40f2737bad8e845c4467018a60d77e1dfb8c379f41c6162ebbabd9997bf368999e550a996e16a677d5bccdc9eb8026
-
Filesize
321KB
MD569ebb99c95195e25513505feb874af96
SHA1f2ce843d5590796204c34175c2ed56bb893f24e0
SHA256f48f97ec89eccc5c9f8f21619abf55722c033435b092c67b538d18340f973252
SHA512d650ab98499b38e41113311be5fe32f35c40f2737bad8e845c4467018a60d77e1dfb8c379f41c6162ebbabd9997bf368999e550a996e16a677d5bccdc9eb8026