Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
139s -
max time network
55s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
02/11/2022, 19:51
Static task
static1
Behavioral task
behavioral1
Sample
34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe
Resource
win10-20220812-en
General
-
Target
34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe
-
Size
327KB
-
MD5
52b6b21a106b7bdbbb085c6261526691
-
SHA1
48e840add8902b89eda97b787b1334060ad2168e
-
SHA256
34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab
-
SHA512
26246f46fdf7a6131c41a824805d0c1b4b7647a98676d3bbd32df1e2ce18dd1e0a29617ebee1682f4672a485b668d8c2a9b456c0be26800beca184f601513999
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
pid Process 4916 oobeldr.exe 4284 oobeldr.exe 3948 oobeldr.exe 4440 oobeldr.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2100 set thread context of 4852 2100 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 66 PID 4916 set thread context of 4284 4916 oobeldr.exe 70 PID 3948 set thread context of 4440 3948 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1796 schtasks.exe 5096 schtasks.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 2100 wrote to memory of 4852 2100 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 66 PID 2100 wrote to memory of 4852 2100 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 66 PID 2100 wrote to memory of 4852 2100 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 66 PID 2100 wrote to memory of 4852 2100 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 66 PID 2100 wrote to memory of 4852 2100 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 66 PID 2100 wrote to memory of 4852 2100 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 66 PID 2100 wrote to memory of 4852 2100 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 66 PID 2100 wrote to memory of 4852 2100 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 66 PID 2100 wrote to memory of 4852 2100 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 66 PID 4852 wrote to memory of 1796 4852 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 67 PID 4852 wrote to memory of 1796 4852 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 67 PID 4852 wrote to memory of 1796 4852 34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe 67 PID 4916 wrote to memory of 4284 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4284 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4284 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4284 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4284 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4284 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4284 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4284 4916 oobeldr.exe 70 PID 4916 wrote to memory of 4284 4916 oobeldr.exe 70 PID 4284 wrote to memory of 5096 4284 oobeldr.exe 71 PID 4284 wrote to memory of 5096 4284 oobeldr.exe 71 PID 4284 wrote to memory of 5096 4284 oobeldr.exe 71 PID 3948 wrote to memory of 4440 3948 oobeldr.exe 74 PID 3948 wrote to memory of 4440 3948 oobeldr.exe 74 PID 3948 wrote to memory of 4440 3948 oobeldr.exe 74 PID 3948 wrote to memory of 4440 3948 oobeldr.exe 74 PID 3948 wrote to memory of 4440 3948 oobeldr.exe 74 PID 3948 wrote to memory of 4440 3948 oobeldr.exe 74 PID 3948 wrote to memory of 4440 3948 oobeldr.exe 74 PID 3948 wrote to memory of 4440 3948 oobeldr.exe 74 PID 3948 wrote to memory of 4440 3948 oobeldr.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe"C:\Users\Admin\AppData\Local\Temp\34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2100 -
C:\Users\Admin\AppData\Local\Temp\34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exeC:\Users\Admin\AppData\Local\Temp\34aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4852 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:1796
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4916 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:5096
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
PID:4440
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
Filesize
327KB
MD552b6b21a106b7bdbbb085c6261526691
SHA148e840add8902b89eda97b787b1334060ad2168e
SHA25634aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab
SHA51226246f46fdf7a6131c41a824805d0c1b4b7647a98676d3bbd32df1e2ce18dd1e0a29617ebee1682f4672a485b668d8c2a9b456c0be26800beca184f601513999
-
Filesize
327KB
MD552b6b21a106b7bdbbb085c6261526691
SHA148e840add8902b89eda97b787b1334060ad2168e
SHA25634aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab
SHA51226246f46fdf7a6131c41a824805d0c1b4b7647a98676d3bbd32df1e2ce18dd1e0a29617ebee1682f4672a485b668d8c2a9b456c0be26800beca184f601513999
-
Filesize
327KB
MD552b6b21a106b7bdbbb085c6261526691
SHA148e840add8902b89eda97b787b1334060ad2168e
SHA25634aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab
SHA51226246f46fdf7a6131c41a824805d0c1b4b7647a98676d3bbd32df1e2ce18dd1e0a29617ebee1682f4672a485b668d8c2a9b456c0be26800beca184f601513999
-
Filesize
327KB
MD552b6b21a106b7bdbbb085c6261526691
SHA148e840add8902b89eda97b787b1334060ad2168e
SHA25634aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab
SHA51226246f46fdf7a6131c41a824805d0c1b4b7647a98676d3bbd32df1e2ce18dd1e0a29617ebee1682f4672a485b668d8c2a9b456c0be26800beca184f601513999
-
Filesize
327KB
MD552b6b21a106b7bdbbb085c6261526691
SHA148e840add8902b89eda97b787b1334060ad2168e
SHA25634aeb33233a1c9d4599a6095e23d4885c259e292cda7ddd139342d9e90f197ab
SHA51226246f46fdf7a6131c41a824805d0c1b4b7647a98676d3bbd32df1e2ce18dd1e0a29617ebee1682f4672a485b668d8c2a9b456c0be26800beca184f601513999