Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
136s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 06:46
Static task
static1
Behavioral task
behavioral1
Sample
d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe
Resource
win10-20220812-en
General
-
Target
d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe
-
Size
323KB
-
MD5
2c29c035c713456f0877397d8f4ce600
-
SHA1
29eff186854eaa944972506c51145fedc5dabdf8
-
SHA256
d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452
-
SHA512
9af7636297988d49f17ea0d24341feea009055930aa378e11d9bcd531bb34a39ca6b11449fc8ad417356c057ab9140a30ebc9b0f7577e6ac9e13e68cfc262f47
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4876 oobeldr.exe 4788 oobeldr.exe 4872 oobeldr.exe 3140 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2620 set thread context of 2148 2620 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 66 PID 4876 set thread context of 4788 4876 oobeldr.exe 70 PID 4872 set thread context of 3140 4872 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1504 schtasks.exe 3716 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2620 wrote to memory of 2148 2620 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 66 PID 2620 wrote to memory of 2148 2620 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 66 PID 2620 wrote to memory of 2148 2620 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 66 PID 2620 wrote to memory of 2148 2620 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 66 PID 2620 wrote to memory of 2148 2620 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 66 PID 2620 wrote to memory of 2148 2620 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 66 PID 2620 wrote to memory of 2148 2620 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 66 PID 2620 wrote to memory of 2148 2620 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 66 PID 2620 wrote to memory of 2148 2620 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 66 PID 2148 wrote to memory of 1504 2148 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 67 PID 2148 wrote to memory of 1504 2148 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 67 PID 2148 wrote to memory of 1504 2148 d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe 67 PID 4876 wrote to memory of 4788 4876 oobeldr.exe 70 PID 4876 wrote to memory of 4788 4876 oobeldr.exe 70 PID 4876 wrote to memory of 4788 4876 oobeldr.exe 70 PID 4876 wrote to memory of 4788 4876 oobeldr.exe 70 PID 4876 wrote to memory of 4788 4876 oobeldr.exe 70 PID 4876 wrote to memory of 4788 4876 oobeldr.exe 70 PID 4876 wrote to memory of 4788 4876 oobeldr.exe 70 PID 4876 wrote to memory of 4788 4876 oobeldr.exe 70 PID 4876 wrote to memory of 4788 4876 oobeldr.exe 70 PID 4788 wrote to memory of 3716 4788 oobeldr.exe 71 PID 4788 wrote to memory of 3716 4788 oobeldr.exe 71 PID 4788 wrote to memory of 3716 4788 oobeldr.exe 71 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74 PID 4872 wrote to memory of 3140 4872 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe"C:\Users\Admin\AppData\Local\Temp\d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Users\Admin\AppData\Local\Temp\d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exeC:\Users\Admin\AppData\Local\Temp\d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:1504
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3716
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4872 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:3140
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
323KB
MD52c29c035c713456f0877397d8f4ce600
SHA129eff186854eaa944972506c51145fedc5dabdf8
SHA256d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452
SHA5129af7636297988d49f17ea0d24341feea009055930aa378e11d9bcd531bb34a39ca6b11449fc8ad417356c057ab9140a30ebc9b0f7577e6ac9e13e68cfc262f47
-
Filesize
323KB
MD52c29c035c713456f0877397d8f4ce600
SHA129eff186854eaa944972506c51145fedc5dabdf8
SHA256d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452
SHA5129af7636297988d49f17ea0d24341feea009055930aa378e11d9bcd531bb34a39ca6b11449fc8ad417356c057ab9140a30ebc9b0f7577e6ac9e13e68cfc262f47
-
Filesize
323KB
MD52c29c035c713456f0877397d8f4ce600
SHA129eff186854eaa944972506c51145fedc5dabdf8
SHA256d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452
SHA5129af7636297988d49f17ea0d24341feea009055930aa378e11d9bcd531bb34a39ca6b11449fc8ad417356c057ab9140a30ebc9b0f7577e6ac9e13e68cfc262f47
-
Filesize
323KB
MD52c29c035c713456f0877397d8f4ce600
SHA129eff186854eaa944972506c51145fedc5dabdf8
SHA256d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452
SHA5129af7636297988d49f17ea0d24341feea009055930aa378e11d9bcd531bb34a39ca6b11449fc8ad417356c057ab9140a30ebc9b0f7577e6ac9e13e68cfc262f47
-
Filesize
323KB
MD52c29c035c713456f0877397d8f4ce600
SHA129eff186854eaa944972506c51145fedc5dabdf8
SHA256d00f30f19d80ae9010af546de57f1868f3a7d36a2f3bf8ae13b54119e29a6452
SHA5129af7636297988d49f17ea0d24341feea009055930aa378e11d9bcd531bb34a39ca6b11449fc8ad417356c057ab9140a30ebc9b0f7577e6ac9e13e68cfc262f47