Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
-
submitted
01/11/2022, 15:02 UTC
General
-
Target
ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997.exe
-
Size
324KB
-
MD5
ba238623aaecea28bc9cf546c7fe4a8f
-
SHA1
8dde5098006fbfcfa92b61f7a629ec016d1418f6
-
SHA256
ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997
-
SHA512
4530f4d85183fa2f71c7dcdf7ed6618e543b4ca2eee08c7fc77364bc6af5a3ead17656ca7dc97827bcd71a05a26e87fdf660a970f49f742def8b9344f8449ef2
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 6 IoCs
-
Suspicious use of SetThreadContext 4 IoCs
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious use of WriteProcessMemory 42 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997.exe"C:\Users\Admin\AppData\Local\Temp\ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997.exeC:\Users\Admin\AppData\Local\Temp\ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997.exe2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
-
Network
- No results found
-
20.50.80.210:443 -
67.27.153.254:80
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
324KB
MD5ba238623aaecea28bc9cf546c7fe4a8f
SHA18dde5098006fbfcfa92b61f7a629ec016d1418f6
SHA256ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997
SHA5124530f4d85183fa2f71c7dcdf7ed6618e543b4ca2eee08c7fc77364bc6af5a3ead17656ca7dc97827bcd71a05a26e87fdf660a970f49f742def8b9344f8449ef2
-
Filesize
324KB
MD5ba238623aaecea28bc9cf546c7fe4a8f
SHA18dde5098006fbfcfa92b61f7a629ec016d1418f6
SHA256ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997
SHA5124530f4d85183fa2f71c7dcdf7ed6618e543b4ca2eee08c7fc77364bc6af5a3ead17656ca7dc97827bcd71a05a26e87fdf660a970f49f742def8b9344f8449ef2
-
Filesize
324KB
MD5ba238623aaecea28bc9cf546c7fe4a8f
SHA18dde5098006fbfcfa92b61f7a629ec016d1418f6
SHA256ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997
SHA5124530f4d85183fa2f71c7dcdf7ed6618e543b4ca2eee08c7fc77364bc6af5a3ead17656ca7dc97827bcd71a05a26e87fdf660a970f49f742def8b9344f8449ef2
-
Filesize
324KB
MD5ba238623aaecea28bc9cf546c7fe4a8f
SHA18dde5098006fbfcfa92b61f7a629ec016d1418f6
SHA256ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997
SHA5124530f4d85183fa2f71c7dcdf7ed6618e543b4ca2eee08c7fc77364bc6af5a3ead17656ca7dc97827bcd71a05a26e87fdf660a970f49f742def8b9344f8449ef2
-
Filesize
324KB
MD5ba238623aaecea28bc9cf546c7fe4a8f
SHA18dde5098006fbfcfa92b61f7a629ec016d1418f6
SHA256ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997
SHA5124530f4d85183fa2f71c7dcdf7ed6618e543b4ca2eee08c7fc77364bc6af5a3ead17656ca7dc97827bcd71a05a26e87fdf660a970f49f742def8b9344f8449ef2
-
Filesize
324KB
MD5ba238623aaecea28bc9cf546c7fe4a8f
SHA18dde5098006fbfcfa92b61f7a629ec016d1418f6
SHA256ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997
SHA5124530f4d85183fa2f71c7dcdf7ed6618e543b4ca2eee08c7fc77364bc6af5a3ead17656ca7dc97827bcd71a05a26e87fdf660a970f49f742def8b9344f8449ef2
-
Filesize
324KB
MD5ba238623aaecea28bc9cf546c7fe4a8f
SHA18dde5098006fbfcfa92b61f7a629ec016d1418f6
SHA256ad24ffe7165218ceb872cb1cd99de072b159e44d4f367e23d750f5b631ab1997
SHA5124530f4d85183fa2f71c7dcdf7ed6618e543b4ca2eee08c7fc77364bc6af5a3ead17656ca7dc97827bcd71a05a26e87fdf660a970f49f742def8b9344f8449ef2
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
24KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
24KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
344KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
816KB
-
Filesize
5.0MB
-
Filesize
1.6MB
-
Filesize
584KB
-
Filesize
24KB
-
Filesize
1.6MB
-
Filesize
472KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
120KB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB
-
Filesize
1.6MB