Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    239s
  • max time network
    180s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/02/2023, 22:17

General

  • Target

    556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31.exe

  • Size

    1.2MB

  • MD5

    c2e1f7053399c7ef6794899229759d45

  • SHA1

    8966b43643502130633fcac26eec77bd6597643f

  • SHA256

    556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31

  • SHA512

    f0642da957342fcf0cb868efdd5fe53c20bccca5eee04a54e25a1da9acf843ceadc78fa053414c816f02585faae18a6603868dc4594d118dca4129b997f0f047

  • SSDEEP

    12288:3FpiynWz6ktHUB7lceAvgDl+t4EUSIr0eaBiqXLtb3viAYf1w:3F05iZ

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 9 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 49 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31.exe
    "C:\Users\Admin\AppData\Local\Temp\556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1524
    • C:\Users\Admin\AppData\Local\Temp\556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31.exe
      C:\Users\Admin\AppData\Local\Temp\556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31.exe
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4264
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3660
  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3208
    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3832
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"
        3⤵
        • Creates scheduled task(s)
        PID:4244
  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4212
    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      2⤵
      • Executes dropped EXE
      PID:1056
  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      2⤵
      • Executes dropped EXE
      PID:2152
  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4952
    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      2⤵
      • Executes dropped EXE
      PID:2840
    • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe
      2⤵
      • Executes dropped EXE
      PID:3580

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\oobeldr.exe.log

    Filesize

    1KB

    MD5

    5c01a57bb6376dc958d99ed7a67870ff

    SHA1

    d092c7dfd148ac12b086049d215e6b00bd78628d

    SHA256

    cb8fd245425e915bfc5ff411f26303f7cb4a30ed37f2ea4a2f0a12501aa5f2a4

    SHA512

    e4e3a4b74f8e209573cce58b572c1f71653e6f4df98f98c5a1cecdf76c9ffb91d5e6994c89df41c9f3613a0584301a56ca922ab7497a434e108b28dcd7d33038

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.2MB

    MD5

    c2e1f7053399c7ef6794899229759d45

    SHA1

    8966b43643502130633fcac26eec77bd6597643f

    SHA256

    556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31

    SHA512

    f0642da957342fcf0cb868efdd5fe53c20bccca5eee04a54e25a1da9acf843ceadc78fa053414c816f02585faae18a6603868dc4594d118dca4129b997f0f047

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.2MB

    MD5

    c2e1f7053399c7ef6794899229759d45

    SHA1

    8966b43643502130633fcac26eec77bd6597643f

    SHA256

    556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31

    SHA512

    f0642da957342fcf0cb868efdd5fe53c20bccca5eee04a54e25a1da9acf843ceadc78fa053414c816f02585faae18a6603868dc4594d118dca4129b997f0f047

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.2MB

    MD5

    c2e1f7053399c7ef6794899229759d45

    SHA1

    8966b43643502130633fcac26eec77bd6597643f

    SHA256

    556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31

    SHA512

    f0642da957342fcf0cb868efdd5fe53c20bccca5eee04a54e25a1da9acf843ceadc78fa053414c816f02585faae18a6603868dc4594d118dca4129b997f0f047

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.2MB

    MD5

    c2e1f7053399c7ef6794899229759d45

    SHA1

    8966b43643502130633fcac26eec77bd6597643f

    SHA256

    556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31

    SHA512

    f0642da957342fcf0cb868efdd5fe53c20bccca5eee04a54e25a1da9acf843ceadc78fa053414c816f02585faae18a6603868dc4594d118dca4129b997f0f047

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.2MB

    MD5

    c2e1f7053399c7ef6794899229759d45

    SHA1

    8966b43643502130633fcac26eec77bd6597643f

    SHA256

    556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31

    SHA512

    f0642da957342fcf0cb868efdd5fe53c20bccca5eee04a54e25a1da9acf843ceadc78fa053414c816f02585faae18a6603868dc4594d118dca4129b997f0f047

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.2MB

    MD5

    c2e1f7053399c7ef6794899229759d45

    SHA1

    8966b43643502130633fcac26eec77bd6597643f

    SHA256

    556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31

    SHA512

    f0642da957342fcf0cb868efdd5fe53c20bccca5eee04a54e25a1da9acf843ceadc78fa053414c816f02585faae18a6603868dc4594d118dca4129b997f0f047

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.2MB

    MD5

    c2e1f7053399c7ef6794899229759d45

    SHA1

    8966b43643502130633fcac26eec77bd6597643f

    SHA256

    556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31

    SHA512

    f0642da957342fcf0cb868efdd5fe53c20bccca5eee04a54e25a1da9acf843ceadc78fa053414c816f02585faae18a6603868dc4594d118dca4129b997f0f047

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.2MB

    MD5

    c2e1f7053399c7ef6794899229759d45

    SHA1

    8966b43643502130633fcac26eec77bd6597643f

    SHA256

    556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31

    SHA512

    f0642da957342fcf0cb868efdd5fe53c20bccca5eee04a54e25a1da9acf843ceadc78fa053414c816f02585faae18a6603868dc4594d118dca4129b997f0f047

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.2MB

    MD5

    c2e1f7053399c7ef6794899229759d45

    SHA1

    8966b43643502130633fcac26eec77bd6597643f

    SHA256

    556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31

    SHA512

    f0642da957342fcf0cb868efdd5fe53c20bccca5eee04a54e25a1da9acf843ceadc78fa053414c816f02585faae18a6603868dc4594d118dca4129b997f0f047

  • C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe

    Filesize

    1.2MB

    MD5

    c2e1f7053399c7ef6794899229759d45

    SHA1

    8966b43643502130633fcac26eec77bd6597643f

    SHA256

    556200dcfe72c4d0565bebccb09460f894eef54959ab607cbc0e2b55531c7a31

    SHA512

    f0642da957342fcf0cb868efdd5fe53c20bccca5eee04a54e25a1da9acf843ceadc78fa053414c816f02585faae18a6603868dc4594d118dca4129b997f0f047

  • memory/1524-158-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-163-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-128-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-129-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-130-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-131-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-132-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-133-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-134-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-135-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-136-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-137-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-138-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-139-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-140-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-141-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-142-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-143-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-144-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-145-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-146-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-147-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-148-0x00000000009D0000-0x0000000000B04000-memory.dmp

    Filesize

    1.2MB

  • memory/1524-149-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-150-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-151-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-152-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-153-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-154-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-155-0x0000000002DF0000-0x0000000002E8C000-memory.dmp

    Filesize

    624KB

  • memory/1524-156-0x00000000052F0000-0x00000000052F8000-memory.dmp

    Filesize

    32KB

  • memory/1524-157-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-126-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-159-0x0000000005360000-0x0000000005382000-memory.dmp

    Filesize

    136KB

  • memory/1524-160-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-161-0x00000000053A0000-0x00000000056F0000-memory.dmp

    Filesize

    3.3MB

  • memory/1524-162-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-127-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-164-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-165-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-169-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-116-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-117-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-118-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-119-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-120-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-121-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-122-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-123-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-124-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/1524-125-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4212-367-0x0000000005400000-0x0000000005750000-memory.dmp

    Filesize

    3.3MB

  • memory/4264-182-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-168-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-175-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-176-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-174-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-171-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-180-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-172-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-170-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-183-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-181-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-166-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4264-179-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-178-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-177-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-184-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-185-0x00000000770F0000-0x000000007727E000-memory.dmp

    Filesize

    1.6MB

  • memory/4264-220-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB