Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
289s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
05/08/2023, 04:11
Static task
static1
Behavioral task
behavioral1
Sample
d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe
Resource
win7-20230712-en
Behavioral task
behavioral2
Sample
d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe
Resource
win10-20230703-en
General
-
Target
d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe
-
Size
321KB
-
MD5
f482ddb3f28d88ceab9f7022c0a088de
-
SHA1
dde24811ad85a222f572fc743b07648a7e6acbc6
-
SHA256
d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
-
SHA512
d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716
-
SSDEEP
6144:eKlzr1sYCzek2ciDaP9Xk6Ln1W8W/9InBSkZZmLdGcAdgdY6RKpjS:eGhQ2ciDq9ZL1W8q9InBRqELdolRKpj
Malware Config
Signatures
-
Executes dropped EXE 11 IoCs
pid Process 2760 oobeldr.exe 2104 oobeldr.exe 1624 oobeldr.exe 2168 oobeldr.exe 628 oobeldr.exe 1096 oobeldr.exe 2952 oobeldr.exe 820 oobeldr.exe 572 oobeldr.exe 1152 oobeldr.exe 1380 oobeldr.exe -
Suspicious use of SetThreadContext 6 IoCs
description pid Process procid_target PID 2780 set thread context of 2328 2780 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 28 PID 2760 set thread context of 2104 2760 oobeldr.exe 35 PID 1624 set thread context of 2168 1624 oobeldr.exe 39 PID 628 set thread context of 2952 628 oobeldr.exe 42 PID 820 set thread context of 572 820 oobeldr.exe 44 PID 1152 set thread context of 1380 1152 oobeldr.exe 46 -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2852 schtasks.exe 1464 schtasks.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2780 wrote to memory of 2328 2780 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 28 PID 2780 wrote to memory of 2328 2780 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 28 PID 2780 wrote to memory of 2328 2780 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 28 PID 2780 wrote to memory of 2328 2780 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 28 PID 2780 wrote to memory of 2328 2780 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 28 PID 2780 wrote to memory of 2328 2780 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 28 PID 2780 wrote to memory of 2328 2780 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 28 PID 2780 wrote to memory of 2328 2780 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 28 PID 2780 wrote to memory of 2328 2780 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 28 PID 2328 wrote to memory of 2852 2328 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 29 PID 2328 wrote to memory of 2852 2328 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 29 PID 2328 wrote to memory of 2852 2328 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 29 PID 2328 wrote to memory of 2852 2328 d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe 29 PID 2696 wrote to memory of 2760 2696 taskeng.exe 34 PID 2696 wrote to memory of 2760 2696 taskeng.exe 34 PID 2696 wrote to memory of 2760 2696 taskeng.exe 34 PID 2696 wrote to memory of 2760 2696 taskeng.exe 34 PID 2760 wrote to memory of 2104 2760 oobeldr.exe 35 PID 2760 wrote to memory of 2104 2760 oobeldr.exe 35 PID 2760 wrote to memory of 2104 2760 oobeldr.exe 35 PID 2760 wrote to memory of 2104 2760 oobeldr.exe 35 PID 2760 wrote to memory of 2104 2760 oobeldr.exe 35 PID 2760 wrote to memory of 2104 2760 oobeldr.exe 35 PID 2760 wrote to memory of 2104 2760 oobeldr.exe 35 PID 2760 wrote to memory of 2104 2760 oobeldr.exe 35 PID 2760 wrote to memory of 2104 2760 oobeldr.exe 35 PID 2104 wrote to memory of 1464 2104 oobeldr.exe 36 PID 2104 wrote to memory of 1464 2104 oobeldr.exe 36 PID 2104 wrote to memory of 1464 2104 oobeldr.exe 36 PID 2104 wrote to memory of 1464 2104 oobeldr.exe 36 PID 2696 wrote to memory of 1624 2696 taskeng.exe 38 PID 2696 wrote to memory of 1624 2696 taskeng.exe 38 PID 2696 wrote to memory of 1624 2696 taskeng.exe 38 PID 2696 wrote to memory of 1624 2696 taskeng.exe 38 PID 1624 wrote to memory of 2168 1624 oobeldr.exe 39 PID 1624 wrote to memory of 2168 1624 oobeldr.exe 39 PID 1624 wrote to memory of 2168 1624 oobeldr.exe 39 PID 1624 wrote to memory of 2168 1624 oobeldr.exe 39 PID 1624 wrote to memory of 2168 1624 oobeldr.exe 39 PID 1624 wrote to memory of 2168 1624 oobeldr.exe 39 PID 1624 wrote to memory of 2168 1624 oobeldr.exe 39 PID 1624 wrote to memory of 2168 1624 oobeldr.exe 39 PID 1624 wrote to memory of 2168 1624 oobeldr.exe 39 PID 2696 wrote to memory of 628 2696 taskeng.exe 40 PID 2696 wrote to memory of 628 2696 taskeng.exe 40 PID 2696 wrote to memory of 628 2696 taskeng.exe 40 PID 2696 wrote to memory of 628 2696 taskeng.exe 40 PID 628 wrote to memory of 1096 628 oobeldr.exe 41 PID 628 wrote to memory of 1096 628 oobeldr.exe 41 PID 628 wrote to memory of 1096 628 oobeldr.exe 41 PID 628 wrote to memory of 1096 628 oobeldr.exe 41 PID 628 wrote to memory of 2952 628 oobeldr.exe 42 PID 628 wrote to memory of 2952 628 oobeldr.exe 42 PID 628 wrote to memory of 2952 628 oobeldr.exe 42 PID 628 wrote to memory of 2952 628 oobeldr.exe 42 PID 628 wrote to memory of 2952 628 oobeldr.exe 42 PID 628 wrote to memory of 2952 628 oobeldr.exe 42 PID 628 wrote to memory of 2952 628 oobeldr.exe 42 PID 628 wrote to memory of 2952 628 oobeldr.exe 42 PID 628 wrote to memory of 2952 628 oobeldr.exe 42 PID 2696 wrote to memory of 820 2696 taskeng.exe 43 PID 2696 wrote to memory of 820 2696 taskeng.exe 43 PID 2696 wrote to memory of 820 2696 taskeng.exe 43 PID 2696 wrote to memory of 820 2696 taskeng.exe 43
Processes
-
C:\Users\Admin\AppData\Local\Temp\d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe"C:\Users\Admin\AppData\Local\Temp\d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2780 -
C:\Users\Admin\AppData\Local\Temp\d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exeC:\Users\Admin\AppData\Local\Temp\d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
PID:2852
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {A7F2B097-BCD7-414E-88A4-F757EC9EC291} S-1-5-21-4159544280-4273523227-683900707-1000:UMAXQRGK\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2760 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2104 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"4⤵
- Creates scheduled task(s)
PID:1464
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1624 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe3⤵
- Executes dropped EXE
PID:2168
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe3⤵
- Executes dropped EXE
PID:1096
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe3⤵
- Executes dropped EXE
PID:2952
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:820 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe3⤵
- Executes dropped EXE
PID:572
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1152 -
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe3⤵
- Executes dropped EXE
PID:1380
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
321KB
MD5f482ddb3f28d88ceab9f7022c0a088de
SHA1dde24811ad85a222f572fc743b07648a7e6acbc6
SHA256d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
SHA512d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716
-
Filesize
321KB
MD5f482ddb3f28d88ceab9f7022c0a088de
SHA1dde24811ad85a222f572fc743b07648a7e6acbc6
SHA256d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
SHA512d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716
-
Filesize
321KB
MD5f482ddb3f28d88ceab9f7022c0a088de
SHA1dde24811ad85a222f572fc743b07648a7e6acbc6
SHA256d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
SHA512d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716
-
Filesize
321KB
MD5f482ddb3f28d88ceab9f7022c0a088de
SHA1dde24811ad85a222f572fc743b07648a7e6acbc6
SHA256d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
SHA512d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716
-
Filesize
321KB
MD5f482ddb3f28d88ceab9f7022c0a088de
SHA1dde24811ad85a222f572fc743b07648a7e6acbc6
SHA256d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
SHA512d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716
-
Filesize
321KB
MD5f482ddb3f28d88ceab9f7022c0a088de
SHA1dde24811ad85a222f572fc743b07648a7e6acbc6
SHA256d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
SHA512d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716
-
Filesize
321KB
MD5f482ddb3f28d88ceab9f7022c0a088de
SHA1dde24811ad85a222f572fc743b07648a7e6acbc6
SHA256d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
SHA512d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716
-
Filesize
321KB
MD5f482ddb3f28d88ceab9f7022c0a088de
SHA1dde24811ad85a222f572fc743b07648a7e6acbc6
SHA256d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
SHA512d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716
-
Filesize
321KB
MD5f482ddb3f28d88ceab9f7022c0a088de
SHA1dde24811ad85a222f572fc743b07648a7e6acbc6
SHA256d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
SHA512d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716
-
Filesize
321KB
MD5f482ddb3f28d88ceab9f7022c0a088de
SHA1dde24811ad85a222f572fc743b07648a7e6acbc6
SHA256d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
SHA512d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716
-
Filesize
321KB
MD5f482ddb3f28d88ceab9f7022c0a088de
SHA1dde24811ad85a222f572fc743b07648a7e6acbc6
SHA256d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
SHA512d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716
-
Filesize
321KB
MD5f482ddb3f28d88ceab9f7022c0a088de
SHA1dde24811ad85a222f572fc743b07648a7e6acbc6
SHA256d328a096bd45f0a176a716fbaa43661eba51d61ac5892a7ab3de736bde59caf0
SHA512d63cbcd0de342e2cad78096f47402247b5105944ce2266d5a763e0d4987f5b1391506b14f2d8a9140066aa203dd1e687e9619b4e8889dd1a0265cb6145f47716