Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
117s -
max time network
73s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 05:26
Static task
static1
Behavioral task
behavioral1
Sample
71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe
Resource
win10-20220812-en
General
-
Target
71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe
-
Size
323KB
-
MD5
caf8bbba8521bf99d5f1cbcdd2f9d84d
-
SHA1
f90407be8584226836c3d1491a62e1f2088890ae
-
SHA256
71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f
-
SHA512
77424e7b0ce64a3297334aabbcfe6f6cf306ee5f185a6a7fe8724e1eba505a53d43c3fe9862abe299fec741a0c93ca2bba87e6d6dec11dfab4f04adef2a82b13
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 5 IoCs
pid Process 4968 oobeldr.exe 4912 oobeldr.exe 688 oobeldr.exe 4580 oobeldr.exe 1740 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3972 set thread context of 3300 3972 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 66 PID 4968 set thread context of 688 4968 oobeldr.exe 71 PID 4580 set thread context of 1740 4580 oobeldr.exe 75 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4292 schtasks.exe 5036 schtasks.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 3972 wrote to memory of 3300 3972 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 66 PID 3972 wrote to memory of 3300 3972 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 66 PID 3972 wrote to memory of 3300 3972 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 66 PID 3972 wrote to memory of 3300 3972 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 66 PID 3972 wrote to memory of 3300 3972 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 66 PID 3972 wrote to memory of 3300 3972 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 66 PID 3972 wrote to memory of 3300 3972 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 66 PID 3972 wrote to memory of 3300 3972 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 66 PID 3972 wrote to memory of 3300 3972 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 66 PID 3300 wrote to memory of 4292 3300 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 67 PID 3300 wrote to memory of 4292 3300 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 67 PID 3300 wrote to memory of 4292 3300 71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe 67 PID 4968 wrote to memory of 4912 4968 oobeldr.exe 70 PID 4968 wrote to memory of 4912 4968 oobeldr.exe 70 PID 4968 wrote to memory of 4912 4968 oobeldr.exe 70 PID 4968 wrote to memory of 688 4968 oobeldr.exe 71 PID 4968 wrote to memory of 688 4968 oobeldr.exe 71 PID 4968 wrote to memory of 688 4968 oobeldr.exe 71 PID 4968 wrote to memory of 688 4968 oobeldr.exe 71 PID 4968 wrote to memory of 688 4968 oobeldr.exe 71 PID 4968 wrote to memory of 688 4968 oobeldr.exe 71 PID 4968 wrote to memory of 688 4968 oobeldr.exe 71 PID 4968 wrote to memory of 688 4968 oobeldr.exe 71 PID 4968 wrote to memory of 688 4968 oobeldr.exe 71 PID 688 wrote to memory of 5036 688 oobeldr.exe 72 PID 688 wrote to memory of 5036 688 oobeldr.exe 72 PID 688 wrote to memory of 5036 688 oobeldr.exe 72 PID 4580 wrote to memory of 1740 4580 oobeldr.exe 75 PID 4580 wrote to memory of 1740 4580 oobeldr.exe 75 PID 4580 wrote to memory of 1740 4580 oobeldr.exe 75 PID 4580 wrote to memory of 1740 4580 oobeldr.exe 75 PID 4580 wrote to memory of 1740 4580 oobeldr.exe 75 PID 4580 wrote to memory of 1740 4580 oobeldr.exe 75 PID 4580 wrote to memory of 1740 4580 oobeldr.exe 75 PID 4580 wrote to memory of 1740 4580 oobeldr.exe 75 PID 4580 wrote to memory of 1740 4580 oobeldr.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe"C:\Users\Admin\AppData\Local\Temp\71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Users\Admin\AppData\Local\Temp\71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exeC:\Users\Admin\AppData\Local\Temp\71dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4292
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4968 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4912
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:688 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:5036
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:1740
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
323KB
MD5caf8bbba8521bf99d5f1cbcdd2f9d84d
SHA1f90407be8584226836c3d1491a62e1f2088890ae
SHA25671dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f
SHA51277424e7b0ce64a3297334aabbcfe6f6cf306ee5f185a6a7fe8724e1eba505a53d43c3fe9862abe299fec741a0c93ca2bba87e6d6dec11dfab4f04adef2a82b13
-
Filesize
323KB
MD5caf8bbba8521bf99d5f1cbcdd2f9d84d
SHA1f90407be8584226836c3d1491a62e1f2088890ae
SHA25671dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f
SHA51277424e7b0ce64a3297334aabbcfe6f6cf306ee5f185a6a7fe8724e1eba505a53d43c3fe9862abe299fec741a0c93ca2bba87e6d6dec11dfab4f04adef2a82b13
-
Filesize
323KB
MD5caf8bbba8521bf99d5f1cbcdd2f9d84d
SHA1f90407be8584226836c3d1491a62e1f2088890ae
SHA25671dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f
SHA51277424e7b0ce64a3297334aabbcfe6f6cf306ee5f185a6a7fe8724e1eba505a53d43c3fe9862abe299fec741a0c93ca2bba87e6d6dec11dfab4f04adef2a82b13
-
Filesize
323KB
MD5caf8bbba8521bf99d5f1cbcdd2f9d84d
SHA1f90407be8584226836c3d1491a62e1f2088890ae
SHA25671dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f
SHA51277424e7b0ce64a3297334aabbcfe6f6cf306ee5f185a6a7fe8724e1eba505a53d43c3fe9862abe299fec741a0c93ca2bba87e6d6dec11dfab4f04adef2a82b13
-
Filesize
323KB
MD5caf8bbba8521bf99d5f1cbcdd2f9d84d
SHA1f90407be8584226836c3d1491a62e1f2088890ae
SHA25671dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f
SHA51277424e7b0ce64a3297334aabbcfe6f6cf306ee5f185a6a7fe8724e1eba505a53d43c3fe9862abe299fec741a0c93ca2bba87e6d6dec11dfab4f04adef2a82b13
-
Filesize
323KB
MD5caf8bbba8521bf99d5f1cbcdd2f9d84d
SHA1f90407be8584226836c3d1491a62e1f2088890ae
SHA25671dc0ef5e84e84c1a1c93d191513c5a50cdfd5da4aa2e6e92a04ed1044f63c1f
SHA51277424e7b0ce64a3297334aabbcfe6f6cf306ee5f185a6a7fe8724e1eba505a53d43c3fe9862abe299fec741a0c93ca2bba87e6d6dec11dfab4f04adef2a82b13