Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
55s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 13:57
Static task
static1
Behavioral task
behavioral1
Sample
c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe
Resource
win10-20220812-en
General
-
Target
c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe
-
Size
324KB
-
MD5
a391768a4cae29da69f59ec7e4dff547
-
SHA1
23b3203b46de8d359cc690c77208b624b2a58d89
-
SHA256
c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723
-
SHA512
81b1221a359c7d7c8b835b6b848de98231102229e68d87a5daf57d4df6cc35b292ff1c2357e27d58d15d4403567c2a6ce6946f59288539d9a5b703b63e10d784
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 1152 oobeldr.exe 2236 oobeldr.exe 4344 oobeldr.exe 5016 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2692 set thread context of 2132 2692 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 66 PID 1152 set thread context of 2236 1152 oobeldr.exe 70 PID 4344 set thread context of 5016 4344 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3408 schtasks.exe 3248 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2692 wrote to memory of 2132 2692 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 66 PID 2692 wrote to memory of 2132 2692 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 66 PID 2692 wrote to memory of 2132 2692 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 66 PID 2692 wrote to memory of 2132 2692 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 66 PID 2692 wrote to memory of 2132 2692 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 66 PID 2692 wrote to memory of 2132 2692 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 66 PID 2692 wrote to memory of 2132 2692 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 66 PID 2692 wrote to memory of 2132 2692 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 66 PID 2692 wrote to memory of 2132 2692 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 66 PID 2132 wrote to memory of 3408 2132 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 67 PID 2132 wrote to memory of 3408 2132 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 67 PID 2132 wrote to memory of 3408 2132 c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe 67 PID 1152 wrote to memory of 2236 1152 oobeldr.exe 70 PID 1152 wrote to memory of 2236 1152 oobeldr.exe 70 PID 1152 wrote to memory of 2236 1152 oobeldr.exe 70 PID 1152 wrote to memory of 2236 1152 oobeldr.exe 70 PID 1152 wrote to memory of 2236 1152 oobeldr.exe 70 PID 1152 wrote to memory of 2236 1152 oobeldr.exe 70 PID 1152 wrote to memory of 2236 1152 oobeldr.exe 70 PID 1152 wrote to memory of 2236 1152 oobeldr.exe 70 PID 1152 wrote to memory of 2236 1152 oobeldr.exe 70 PID 2236 wrote to memory of 3248 2236 oobeldr.exe 71 PID 2236 wrote to memory of 3248 2236 oobeldr.exe 71 PID 2236 wrote to memory of 3248 2236 oobeldr.exe 71 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74 PID 4344 wrote to memory of 5016 4344 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe"C:\Users\Admin\AppData\Local\Temp\c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Users\Admin\AppData\Local\Temp\c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exeC:\Users\Admin\AppData\Local\Temp\c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3408
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3248
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4344 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:5016
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD5a391768a4cae29da69f59ec7e4dff547
SHA123b3203b46de8d359cc690c77208b624b2a58d89
SHA256c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723
SHA51281b1221a359c7d7c8b835b6b848de98231102229e68d87a5daf57d4df6cc35b292ff1c2357e27d58d15d4403567c2a6ce6946f59288539d9a5b703b63e10d784
-
Filesize
324KB
MD5a391768a4cae29da69f59ec7e4dff547
SHA123b3203b46de8d359cc690c77208b624b2a58d89
SHA256c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723
SHA51281b1221a359c7d7c8b835b6b848de98231102229e68d87a5daf57d4df6cc35b292ff1c2357e27d58d15d4403567c2a6ce6946f59288539d9a5b703b63e10d784
-
Filesize
324KB
MD5a391768a4cae29da69f59ec7e4dff547
SHA123b3203b46de8d359cc690c77208b624b2a58d89
SHA256c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723
SHA51281b1221a359c7d7c8b835b6b848de98231102229e68d87a5daf57d4df6cc35b292ff1c2357e27d58d15d4403567c2a6ce6946f59288539d9a5b703b63e10d784
-
Filesize
324KB
MD5a391768a4cae29da69f59ec7e4dff547
SHA123b3203b46de8d359cc690c77208b624b2a58d89
SHA256c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723
SHA51281b1221a359c7d7c8b835b6b848de98231102229e68d87a5daf57d4df6cc35b292ff1c2357e27d58d15d4403567c2a6ce6946f59288539d9a5b703b63e10d784
-
Filesize
324KB
MD5a391768a4cae29da69f59ec7e4dff547
SHA123b3203b46de8d359cc690c77208b624b2a58d89
SHA256c528d9c816ac1c7d0e5fb6ece35301891cdb101dc3ce18e2a1be7154252ab723
SHA51281b1221a359c7d7c8b835b6b848de98231102229e68d87a5daf57d4df6cc35b292ff1c2357e27d58d15d4403567c2a6ce6946f59288539d9a5b703b63e10d784