Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
254s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
18/07/2023, 04:47
Static task
static1
Behavioral task
behavioral1
Sample
761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe
Resource
win10-20230703-en
General
-
Target
761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe
-
Size
321KB
-
MD5
f0ff9f4c20f1584e3d731f89d2473075
-
SHA1
e5d9234d814589cd734b4acec635c129b9a4b030
-
SHA256
761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27
-
SHA512
5ea1b1a8ecae84b2a64774d843c2f00fd9f1f8578f0da9c32d363075e1703d9181783416d5f60e0baae553fc8fc32ebd53215a0ae213b7207cf1194318aa21ae
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 2716 oobeldr.exe 3028 oobeldr.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 328 set thread context of 4616 328 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 70 PID 2716 set thread context of 3028 2716 oobeldr.exe 74 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2648 schtasks.exe 4980 schtasks.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 328 wrote to memory of 4616 328 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 70 PID 328 wrote to memory of 4616 328 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 70 PID 328 wrote to memory of 4616 328 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 70 PID 328 wrote to memory of 4616 328 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 70 PID 328 wrote to memory of 4616 328 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 70 PID 328 wrote to memory of 4616 328 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 70 PID 328 wrote to memory of 4616 328 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 70 PID 328 wrote to memory of 4616 328 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 70 PID 328 wrote to memory of 4616 328 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 70 PID 4616 wrote to memory of 2648 4616 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 71 PID 4616 wrote to memory of 2648 4616 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 71 PID 4616 wrote to memory of 2648 4616 761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe 71 PID 2716 wrote to memory of 3028 2716 oobeldr.exe 74 PID 2716 wrote to memory of 3028 2716 oobeldr.exe 74 PID 2716 wrote to memory of 3028 2716 oobeldr.exe 74 PID 2716 wrote to memory of 3028 2716 oobeldr.exe 74 PID 2716 wrote to memory of 3028 2716 oobeldr.exe 74 PID 2716 wrote to memory of 3028 2716 oobeldr.exe 74 PID 2716 wrote to memory of 3028 2716 oobeldr.exe 74 PID 2716 wrote to memory of 3028 2716 oobeldr.exe 74 PID 2716 wrote to memory of 3028 2716 oobeldr.exe 74 PID 3028 wrote to memory of 4980 3028 oobeldr.exe 75 PID 3028 wrote to memory of 4980 3028 oobeldr.exe 75 PID 3028 wrote to memory of 4980 3028 oobeldr.exe 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe"C:\Users\Admin\AppData\Local\Temp\761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Users\Admin\AppData\Local\Temp\761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exeC:\Users\Admin\AppData\Local\Temp\761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4616 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2648
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:4980
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
321KB
MD5f0ff9f4c20f1584e3d731f89d2473075
SHA1e5d9234d814589cd734b4acec635c129b9a4b030
SHA256761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27
SHA5125ea1b1a8ecae84b2a64774d843c2f00fd9f1f8578f0da9c32d363075e1703d9181783416d5f60e0baae553fc8fc32ebd53215a0ae213b7207cf1194318aa21ae
-
Filesize
321KB
MD5f0ff9f4c20f1584e3d731f89d2473075
SHA1e5d9234d814589cd734b4acec635c129b9a4b030
SHA256761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27
SHA5125ea1b1a8ecae84b2a64774d843c2f00fd9f1f8578f0da9c32d363075e1703d9181783416d5f60e0baae553fc8fc32ebd53215a0ae213b7207cf1194318aa21ae
-
Filesize
321KB
MD5f0ff9f4c20f1584e3d731f89d2473075
SHA1e5d9234d814589cd734b4acec635c129b9a4b030
SHA256761019bfe1b9b687425431dee4646f1a79ca1806237d4ff2edf0473425e79f27
SHA5125ea1b1a8ecae84b2a64774d843c2f00fd9f1f8578f0da9c32d363075e1703d9181783416d5f60e0baae553fc8fc32ebd53215a0ae213b7207cf1194318aa21ae