Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230831-en
General
-
Target
tmp
-
Size
230KB
-
MD5
9b8f2f4b5dd94329b4f79b9a829d73ae
-
SHA1
a8f7cc119eebfe74a5c8e37b72f784270acc9976
-
SHA256
89942c4a6e1e3f33fa950549133aca7dcc154c7d88cea43d78aa3669de12eba6
-
SHA512
6ef635a35083573e5d142d7a900c60bc32b8096b31762d6f08fd8b532b518a40eef59f8be44e34699f4a624c47bdbb639051877d305588761868bb93c2523c50
-
SSDEEP
6144:9loZMYrIkd8g+EtXHkv/iD4sf9Ghv0IHx2PxM4dVHb8e1m+i:foZvL+EP8sf9Ghv0IHx2PxM4d54
Malware Config
Extracted
umbral
https://discord.com/api/webhooks/1150555857097080872/lm70Xbzg4b7iQf-7bYKRoJzpldQyC6B9MRF8b8VtWe79cxa7np8xoHZxHKC2mHfEgDER
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule sample family_umbral -
Umbral family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource tmp
Files
-
tmp.exe windows x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 228KB - Virtual size: 227KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ