Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    147s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/11/2022, 10:13

General

  • Target

    9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe

  • Size

    324KB

  • MD5

    3c232d9d498fc6af3261848eb9c3be83

  • SHA1

    d777626a0b27e72a8cbdc34f52bea1860a3967bb

  • SHA256

    9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b

  • SHA512

    616462f72707b005ad391c34383dcd5ba49af18215f8760215e34450a0f1addd8de4ad8070d285d38d175c6368e5890c91147b73137096f1a3ad01bffc620bc6

  • SSDEEP

    6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe
    "C:\Users\Admin\AppData\Local\Temp\9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4660
    • C:\Users\Admin\AppData\Local\Temp\9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe
      C:\Users\Admin\AppData\Local\Temp\9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5104
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3452
  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1972
    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4712
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3052

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    324KB

    MD5

    3c232d9d498fc6af3261848eb9c3be83

    SHA1

    d777626a0b27e72a8cbdc34f52bea1860a3967bb

    SHA256

    9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b

    SHA512

    616462f72707b005ad391c34383dcd5ba49af18215f8760215e34450a0f1addd8de4ad8070d285d38d175c6368e5890c91147b73137096f1a3ad01bffc620bc6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    324KB

    MD5

    3c232d9d498fc6af3261848eb9c3be83

    SHA1

    d777626a0b27e72a8cbdc34f52bea1860a3967bb

    SHA256

    9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b

    SHA512

    616462f72707b005ad391c34383dcd5ba49af18215f8760215e34450a0f1addd8de4ad8070d285d38d175c6368e5890c91147b73137096f1a3ad01bffc620bc6

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    324KB

    MD5

    3c232d9d498fc6af3261848eb9c3be83

    SHA1

    d777626a0b27e72a8cbdc34f52bea1860a3967bb

    SHA256

    9be5ba501dba6c9fb4f09060de75878a7a53e13ede3b0a3d4ef942d5dd66f56b

    SHA512

    616462f72707b005ad391c34383dcd5ba49af18215f8760215e34450a0f1addd8de4ad8070d285d38d175c6368e5890c91147b73137096f1a3ad01bffc620bc6

  • memory/4660-152-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-156-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-120-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-121-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-122-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-123-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-124-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-125-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-126-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-155-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-129-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-128-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-130-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-131-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-132-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-133-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-134-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-135-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-136-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-137-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-138-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-140-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-142-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-143-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-141-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-139-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-144-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-145-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-146-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-147-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-148-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-149-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-150-0x00000000008D0000-0x0000000000926000-memory.dmp

    Filesize

    344KB

  • memory/4660-118-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-151-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-153-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-119-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-154-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-127-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-157-0x00000000075D0000-0x000000000769C000-memory.dmp

    Filesize

    816KB

  • memory/4660-158-0x0000000007BA0000-0x000000000809E000-memory.dmp

    Filesize

    5.0MB

  • memory/4660-159-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-160-0x0000000007740000-0x00000000077D2000-memory.dmp

    Filesize

    584KB

  • memory/4660-161-0x0000000005220000-0x0000000005226000-memory.dmp

    Filesize

    24KB

  • memory/4660-162-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-163-0x00000000079E0000-0x0000000007A56000-memory.dmp

    Filesize

    472KB

  • memory/4660-164-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-166-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-165-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-167-0x00000000076E0000-0x00000000076FE000-memory.dmp

    Filesize

    120KB

  • memory/4660-170-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-173-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-172-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-171-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-169-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-168-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-180-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-116-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/4660-117-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-177-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-182-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-179-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-176-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-178-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-187-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-185-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-184-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-183-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-186-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/5104-174-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/5104-228-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB