Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
54s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 00:48
Static task
static1
Behavioral task
behavioral1
Sample
4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe
Resource
win10-20220812-en
General
-
Target
4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe
-
Size
322KB
-
MD5
b81fb6eb1723b9e6f2f4310d6ec88565
-
SHA1
06a1502edfe1f3a428d7fff71f7f40b58e6a6e52
-
SHA256
4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827
-
SHA512
2d99d09c7e4e6e92c784c259c4ef9b8a040d88fbe25b17c13ac79a74d875015339b8c828d263fed2392d337a94612be76a15c2b1ec6cb4f0d6c8610440861cd1
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1148 oobeldr.exe 2224 oobeldr.exe 4344 oobeldr.exe 5016 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2692 set thread context of 2132 2692 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 66 PID 1148 set thread context of 2224 1148 oobeldr.exe 70 PID 4344 set thread context of 5016 4344 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3408 schtasks.exe 4752 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2132 2692 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 66 PID 2692 wrote to memory of 2132 2692 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 66 PID 2692 wrote to memory of 2132 2692 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 66 PID 2692 wrote to memory of 2132 2692 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 66 PID 2692 wrote to memory of 2132 2692 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 66 PID 2692 wrote to memory of 2132 2692 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 66 PID 2692 wrote to memory of 2132 2692 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 66 PID 2692 wrote to memory of 2132 2692 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 66 PID 2692 wrote to memory of 2132 2692 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 66 PID 2132 wrote to memory of 3408 2132 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 67 PID 2132 wrote to memory of 3408 2132 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 67 PID 2132 wrote to memory of 3408 2132 4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe 67 PID 1148 wrote to memory of 2224 1148 oobeldr.exe 70 PID 1148 wrote to memory of 2224 1148 oobeldr.exe 70 PID 1148 wrote to memory of 2224 1148 oobeldr.exe 70 PID 1148 wrote to memory of 2224 1148 oobeldr.exe 70 PID 1148 wrote to memory of 2224 1148 oobeldr.exe 70 PID 1148 wrote to memory of 2224 1148 oobeldr.exe 70 PID 1148 wrote to memory of 2224 1148 oobeldr.exe 70 PID 1148 wrote to memory of 2224 1148 oobeldr.exe 70 PID 1148 wrote to memory of 2224 1148 oobeldr.exe 70 PID 2224 wrote to memory of 4752 2224 oobeldr.exe 71 PID 2224 wrote to memory of 4752 2224 oobeldr.exe 71 PID 2224 wrote to memory of 4752 2224 oobeldr.exe 71 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe"C:\Users\Admin\AppData\Local\Temp\4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exeC:\Users\Admin\AppData\Local\Temp\4b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3408
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4752
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:5016
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
322KB
MD5b81fb6eb1723b9e6f2f4310d6ec88565
SHA106a1502edfe1f3a428d7fff71f7f40b58e6a6e52
SHA2564b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827
SHA5122d99d09c7e4e6e92c784c259c4ef9b8a040d88fbe25b17c13ac79a74d875015339b8c828d263fed2392d337a94612be76a15c2b1ec6cb4f0d6c8610440861cd1
-
Filesize
322KB
MD5b81fb6eb1723b9e6f2f4310d6ec88565
SHA106a1502edfe1f3a428d7fff71f7f40b58e6a6e52
SHA2564b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827
SHA5122d99d09c7e4e6e92c784c259c4ef9b8a040d88fbe25b17c13ac79a74d875015339b8c828d263fed2392d337a94612be76a15c2b1ec6cb4f0d6c8610440861cd1
-
Filesize
322KB
MD5b81fb6eb1723b9e6f2f4310d6ec88565
SHA106a1502edfe1f3a428d7fff71f7f40b58e6a6e52
SHA2564b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827
SHA5122d99d09c7e4e6e92c784c259c4ef9b8a040d88fbe25b17c13ac79a74d875015339b8c828d263fed2392d337a94612be76a15c2b1ec6cb4f0d6c8610440861cd1
-
Filesize
322KB
MD5b81fb6eb1723b9e6f2f4310d6ec88565
SHA106a1502edfe1f3a428d7fff71f7f40b58e6a6e52
SHA2564b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827
SHA5122d99d09c7e4e6e92c784c259c4ef9b8a040d88fbe25b17c13ac79a74d875015339b8c828d263fed2392d337a94612be76a15c2b1ec6cb4f0d6c8610440861cd1
-
Filesize
322KB
MD5b81fb6eb1723b9e6f2f4310d6ec88565
SHA106a1502edfe1f3a428d7fff71f7f40b58e6a6e52
SHA2564b52fbed6026c5067e24ce3db28fbfe8521aecbd85bb9e78f2483e7c93f75827
SHA5122d99d09c7e4e6e92c784c259c4ef9b8a040d88fbe25b17c13ac79a74d875015339b8c828d263fed2392d337a94612be76a15c2b1ec6cb4f0d6c8610440861cd1