Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 10:13
Static task
static1
Behavioral task
behavioral1
Sample
9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe
Resource
win10-20220812-en
General
-
Target
9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe
-
Size
324KB
-
MD5
3c232d9d498fc6af3261848eb9c3be83
-
SHA1
d777626a0b27e72a8cbdc34f52bea1860a3967bb
-
SHA256
9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b
-
SHA512
616462f72707b005ad391c34383dcd5ba49af18215f8760215e34450a0f1addd8de4ad8070d285d38d175c6368e5890c91147b73137096f1a3ad01bffc620bc6
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1972 oobeldr.exe 4712 oobeldr.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4660 set thread context of 5104 4660 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 67 PID 1972 set thread context of 4712 1972 oobeldr.exe 71 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3452 schtasks.exe 3052 schtasks.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4660 wrote to memory of 5104 4660 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 67 PID 4660 wrote to memory of 5104 4660 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 67 PID 4660 wrote to memory of 5104 4660 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 67 PID 4660 wrote to memory of 5104 4660 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 67 PID 4660 wrote to memory of 5104 4660 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 67 PID 4660 wrote to memory of 5104 4660 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 67 PID 4660 wrote to memory of 5104 4660 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 67 PID 4660 wrote to memory of 5104 4660 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 67 PID 4660 wrote to memory of 5104 4660 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 67 PID 5104 wrote to memory of 3452 5104 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 68 PID 5104 wrote to memory of 3452 5104 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 68 PID 5104 wrote to memory of 3452 5104 9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe 68 PID 1972 wrote to memory of 4712 1972 oobeldr.exe 71 PID 1972 wrote to memory of 4712 1972 oobeldr.exe 71 PID 1972 wrote to memory of 4712 1972 oobeldr.exe 71 PID 1972 wrote to memory of 4712 1972 oobeldr.exe 71 PID 1972 wrote to memory of 4712 1972 oobeldr.exe 71 PID 1972 wrote to memory of 4712 1972 oobeldr.exe 71 PID 1972 wrote to memory of 4712 1972 oobeldr.exe 71 PID 1972 wrote to memory of 4712 1972 oobeldr.exe 71 PID 1972 wrote to memory of 4712 1972 oobeldr.exe 71 PID 4712 wrote to memory of 3052 4712 oobeldr.exe 72 PID 4712 wrote to memory of 3052 4712 oobeldr.exe 72 PID 4712 wrote to memory of 3052 4712 oobeldr.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe"C:\Users\Admin\AppData\Local\Temp\9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Users\Admin\AppData\Local\Temp\9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exeC:\Users\Admin\AppData\Local\Temp\9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe2⤵
- Suspicious use of WriteProcessMemory
PID:5104 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3452
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3052
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
324KB
MD53c232d9d498fc6af3261848eb9c3be83
SHA1d777626a0b27e72a8cbdc34f52bea1860a3967bb
SHA2569be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b
SHA512616462f72707b005ad391c34383dcd5ba49af18215f8760215e34450a0f1addd8de4ad8070d285d38d175c6368e5890c91147b73137096f1a3ad01bffc620bc6
-
Filesize
324KB
MD53c232d9d498fc6af3261848eb9c3be83
SHA1d777626a0b27e72a8cbdc34f52bea1860a3967bb
SHA2569be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b
SHA512616462f72707b005ad391c34383dcd5ba49af18215f8760215e34450a0f1addd8de4ad8070d285d38d175c6368e5890c91147b73137096f1a3ad01bffc620bc6
-
Filesize
324KB
MD53c232d9d498fc6af3261848eb9c3be83
SHA1d777626a0b27e72a8cbdc34f52bea1860a3967bb
SHA2569be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b
SHA512616462f72707b005ad391c34383dcd5ba49af18215f8760215e34450a0f1addd8de4ad8070d285d38d175c6368e5890c91147b73137096f1a3ad01bffc620bc6