Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
102s -
max time network
103s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01/11/2022, 14:21
Static task
static1
Behavioral task
behavioral1
Sample
ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe
Resource
win10-20220812-en
General
-
Target
ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe
-
Size
324KB
-
MD5
061e25b6a0253f7ea8dec26de1a32419
-
SHA1
91f8061ac72079e1791e57f0b470e0024151ac08
-
SHA256
ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9
-
SHA512
42ffb1a7b1c84c6cef6e54b2ced2dace5b3ac2cd90dc96855bbe1f58dcf084dba322cd367dd08527f057407f67ba8a7058e88cfe12e9dcd09e8e413f188d8fac
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
pid Process 5004 oobeldr.exe 4356 oobeldr.exe 4928 oobeldr.exe 4768 oobeldr.exe 648 oobeldr.exe 4824 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2960 set thread context of 4988 2960 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 66 PID 5004 set thread context of 4928 5004 oobeldr.exe 71 PID 4768 set thread context of 4824 4768 oobeldr.exe 76 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2732 schtasks.exe 3780 schtasks.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2960 wrote to memory of 4988 2960 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 66 PID 2960 wrote to memory of 4988 2960 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 66 PID 2960 wrote to memory of 4988 2960 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 66 PID 2960 wrote to memory of 4988 2960 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 66 PID 2960 wrote to memory of 4988 2960 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 66 PID 2960 wrote to memory of 4988 2960 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 66 PID 2960 wrote to memory of 4988 2960 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 66 PID 2960 wrote to memory of 4988 2960 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 66 PID 2960 wrote to memory of 4988 2960 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 66 PID 4988 wrote to memory of 2732 4988 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 67 PID 4988 wrote to memory of 2732 4988 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 67 PID 4988 wrote to memory of 2732 4988 ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe 67 PID 5004 wrote to memory of 4356 5004 oobeldr.exe 70 PID 5004 wrote to memory of 4356 5004 oobeldr.exe 70 PID 5004 wrote to memory of 4356 5004 oobeldr.exe 70 PID 5004 wrote to memory of 4928 5004 oobeldr.exe 71 PID 5004 wrote to memory of 4928 5004 oobeldr.exe 71 PID 5004 wrote to memory of 4928 5004 oobeldr.exe 71 PID 5004 wrote to memory of 4928 5004 oobeldr.exe 71 PID 5004 wrote to memory of 4928 5004 oobeldr.exe 71 PID 5004 wrote to memory of 4928 5004 oobeldr.exe 71 PID 5004 wrote to memory of 4928 5004 oobeldr.exe 71 PID 5004 wrote to memory of 4928 5004 oobeldr.exe 71 PID 5004 wrote to memory of 4928 5004 oobeldr.exe 71 PID 4928 wrote to memory of 3780 4928 oobeldr.exe 72 PID 4928 wrote to memory of 3780 4928 oobeldr.exe 72 PID 4928 wrote to memory of 3780 4928 oobeldr.exe 72 PID 4768 wrote to memory of 648 4768 oobeldr.exe 75 PID 4768 wrote to memory of 648 4768 oobeldr.exe 75 PID 4768 wrote to memory of 648 4768 oobeldr.exe 75 PID 4768 wrote to memory of 4824 4768 oobeldr.exe 76 PID 4768 wrote to memory of 4824 4768 oobeldr.exe 76 PID 4768 wrote to memory of 4824 4768 oobeldr.exe 76 PID 4768 wrote to memory of 4824 4768 oobeldr.exe 76 PID 4768 wrote to memory of 4824 4768 oobeldr.exe 76 PID 4768 wrote to memory of 4824 4768 oobeldr.exe 76 PID 4768 wrote to memory of 4824 4768 oobeldr.exe 76 PID 4768 wrote to memory of 4824 4768 oobeldr.exe 76 PID 4768 wrote to memory of 4824 4768 oobeldr.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe"C:\Users\Admin\AppData\Local\Temp\ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2960 -
C:\Users\Admin\AppData\Local\Temp\ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exeC:\Users\Admin\AppData\Local\Temp\ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4988 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2732
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:5004 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4356
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4928 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:3780
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4768 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:648
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4824
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD5061e25b6a0253f7ea8dec26de1a32419
SHA191f8061ac72079e1791e57f0b470e0024151ac08
SHA256ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9
SHA51242ffb1a7b1c84c6cef6e54b2ced2dace5b3ac2cd90dc96855bbe1f58dcf084dba322cd367dd08527f057407f67ba8a7058e88cfe12e9dcd09e8e413f188d8fac
-
Filesize
324KB
MD5061e25b6a0253f7ea8dec26de1a32419
SHA191f8061ac72079e1791e57f0b470e0024151ac08
SHA256ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9
SHA51242ffb1a7b1c84c6cef6e54b2ced2dace5b3ac2cd90dc96855bbe1f58dcf084dba322cd367dd08527f057407f67ba8a7058e88cfe12e9dcd09e8e413f188d8fac
-
Filesize
324KB
MD5061e25b6a0253f7ea8dec26de1a32419
SHA191f8061ac72079e1791e57f0b470e0024151ac08
SHA256ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9
SHA51242ffb1a7b1c84c6cef6e54b2ced2dace5b3ac2cd90dc96855bbe1f58dcf084dba322cd367dd08527f057407f67ba8a7058e88cfe12e9dcd09e8e413f188d8fac
-
Filesize
324KB
MD5061e25b6a0253f7ea8dec26de1a32419
SHA191f8061ac72079e1791e57f0b470e0024151ac08
SHA256ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9
SHA51242ffb1a7b1c84c6cef6e54b2ced2dace5b3ac2cd90dc96855bbe1f58dcf084dba322cd367dd08527f057407f67ba8a7058e88cfe12e9dcd09e8e413f188d8fac
-
Filesize
324KB
MD5061e25b6a0253f7ea8dec26de1a32419
SHA191f8061ac72079e1791e57f0b470e0024151ac08
SHA256ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9
SHA51242ffb1a7b1c84c6cef6e54b2ced2dace5b3ac2cd90dc96855bbe1f58dcf084dba322cd367dd08527f057407f67ba8a7058e88cfe12e9dcd09e8e413f188d8fac
-
Filesize
324KB
MD5061e25b6a0253f7ea8dec26de1a32419
SHA191f8061ac72079e1791e57f0b470e0024151ac08
SHA256ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9
SHA51242ffb1a7b1c84c6cef6e54b2ced2dace5b3ac2cd90dc96855bbe1f58dcf084dba322cd367dd08527f057407f67ba8a7058e88cfe12e9dcd09e8e413f188d8fac
-
Filesize
324KB
MD5061e25b6a0253f7ea8dec26de1a32419
SHA191f8061ac72079e1791e57f0b470e0024151ac08
SHA256ae0190d6a16ed03474309a8664dcd4a9a90961ef310953f601458bd8656e78e9
SHA51242ffb1a7b1c84c6cef6e54b2ced2dace5b3ac2cd90dc96855bbe1f58dcf084dba322cd367dd08527f057407f67ba8a7058e88cfe12e9dcd09e8e413f188d8fac