Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
06/02/2024, 09:40
Behavioral task
behavioral1
Sample
Spoofer.exe
Resource
win7-20231129-en
General
-
Target
Spoofer.exe
-
Size
231KB
-
MD5
c964c96a473bbd29377a62c0d6e1d100
-
SHA1
879c4eebdfce76f13a2be8209c5b1ce3676152ef
-
SHA256
e6ce3dd93c2d407085ea10bb6f22bd89a34e7fff719e5579ee47f4f2fdaed921
-
SHA512
36e472d0b7d34a3b9968eb4c540cf839592df4b1147c1063fd0be4b72748cd48c0d8d46ef5cb6949932844951cd2f2dc5de7fdecbc98fc232958fe285813cf95
-
SSDEEP
6144:xloZM9rIkd8g+EtXHkv/iD4085oBPUon6WvRsY9+N0C8e1mkHi:DoZOL+EP8085oBPUon6WvRsY9eHC
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1712-0-0x0000000000D20000-0x0000000000D60000-memory.dmp family_umbral -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Spoofer.exe -
Deletes itself 1 IoCs
pid Process 836 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 15 discord.com 16 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 13 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1456 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 648 PING.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2720 powershell.exe 2224 powershell.exe 2528 powershell.exe 1664 powershell.exe 1964 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1712 Spoofer.exe Token: SeDebugPrivilege 2720 powershell.exe Token: SeDebugPrivilege 2224 powershell.exe Token: SeDebugPrivilege 2528 powershell.exe Token: SeDebugPrivilege 1664 powershell.exe Token: SeIncreaseQuotaPrivilege 2824 wmic.exe Token: SeSecurityPrivilege 2824 wmic.exe Token: SeTakeOwnershipPrivilege 2824 wmic.exe Token: SeLoadDriverPrivilege 2824 wmic.exe Token: SeSystemProfilePrivilege 2824 wmic.exe Token: SeSystemtimePrivilege 2824 wmic.exe Token: SeProfSingleProcessPrivilege 2824 wmic.exe Token: SeIncBasePriorityPrivilege 2824 wmic.exe Token: SeCreatePagefilePrivilege 2824 wmic.exe Token: SeBackupPrivilege 2824 wmic.exe Token: SeRestorePrivilege 2824 wmic.exe Token: SeShutdownPrivilege 2824 wmic.exe Token: SeDebugPrivilege 2824 wmic.exe Token: SeSystemEnvironmentPrivilege 2824 wmic.exe Token: SeRemoteShutdownPrivilege 2824 wmic.exe Token: SeUndockPrivilege 2824 wmic.exe Token: SeManageVolumePrivilege 2824 wmic.exe Token: 33 2824 wmic.exe Token: 34 2824 wmic.exe Token: 35 2824 wmic.exe Token: SeIncreaseQuotaPrivilege 2824 wmic.exe Token: SeSecurityPrivilege 2824 wmic.exe Token: SeTakeOwnershipPrivilege 2824 wmic.exe Token: SeLoadDriverPrivilege 2824 wmic.exe Token: SeSystemProfilePrivilege 2824 wmic.exe Token: SeSystemtimePrivilege 2824 wmic.exe Token: SeProfSingleProcessPrivilege 2824 wmic.exe Token: SeIncBasePriorityPrivilege 2824 wmic.exe Token: SeCreatePagefilePrivilege 2824 wmic.exe Token: SeBackupPrivilege 2824 wmic.exe Token: SeRestorePrivilege 2824 wmic.exe Token: SeShutdownPrivilege 2824 wmic.exe Token: SeDebugPrivilege 2824 wmic.exe Token: SeSystemEnvironmentPrivilege 2824 wmic.exe Token: SeRemoteShutdownPrivilege 2824 wmic.exe Token: SeUndockPrivilege 2824 wmic.exe Token: SeManageVolumePrivilege 2824 wmic.exe Token: 33 2824 wmic.exe Token: 34 2824 wmic.exe Token: 35 2824 wmic.exe Token: SeIncreaseQuotaPrivilege 3000 wmic.exe Token: SeSecurityPrivilege 3000 wmic.exe Token: SeTakeOwnershipPrivilege 3000 wmic.exe Token: SeLoadDriverPrivilege 3000 wmic.exe Token: SeSystemProfilePrivilege 3000 wmic.exe Token: SeSystemtimePrivilege 3000 wmic.exe Token: SeProfSingleProcessPrivilege 3000 wmic.exe Token: SeIncBasePriorityPrivilege 3000 wmic.exe Token: SeCreatePagefilePrivilege 3000 wmic.exe Token: SeBackupPrivilege 3000 wmic.exe Token: SeRestorePrivilege 3000 wmic.exe Token: SeShutdownPrivilege 3000 wmic.exe Token: SeDebugPrivilege 3000 wmic.exe Token: SeSystemEnvironmentPrivilege 3000 wmic.exe Token: SeRemoteShutdownPrivilege 3000 wmic.exe Token: SeUndockPrivilege 3000 wmic.exe Token: SeManageVolumePrivilege 3000 wmic.exe Token: 33 3000 wmic.exe Token: 34 3000 wmic.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1712 wrote to memory of 2628 1712 Spoofer.exe 29 PID 1712 wrote to memory of 2628 1712 Spoofer.exe 29 PID 1712 wrote to memory of 2628 1712 Spoofer.exe 29 PID 1712 wrote to memory of 2720 1712 Spoofer.exe 31 PID 1712 wrote to memory of 2720 1712 Spoofer.exe 31 PID 1712 wrote to memory of 2720 1712 Spoofer.exe 31 PID 1712 wrote to memory of 2224 1712 Spoofer.exe 33 PID 1712 wrote to memory of 2224 1712 Spoofer.exe 33 PID 1712 wrote to memory of 2224 1712 Spoofer.exe 33 PID 1712 wrote to memory of 2528 1712 Spoofer.exe 35 PID 1712 wrote to memory of 2528 1712 Spoofer.exe 35 PID 1712 wrote to memory of 2528 1712 Spoofer.exe 35 PID 1712 wrote to memory of 1664 1712 Spoofer.exe 37 PID 1712 wrote to memory of 1664 1712 Spoofer.exe 37 PID 1712 wrote to memory of 1664 1712 Spoofer.exe 37 PID 1712 wrote to memory of 2824 1712 Spoofer.exe 40 PID 1712 wrote to memory of 2824 1712 Spoofer.exe 40 PID 1712 wrote to memory of 2824 1712 Spoofer.exe 40 PID 1712 wrote to memory of 3000 1712 Spoofer.exe 42 PID 1712 wrote to memory of 3000 1712 Spoofer.exe 42 PID 1712 wrote to memory of 3000 1712 Spoofer.exe 42 PID 1712 wrote to memory of 2268 1712 Spoofer.exe 46 PID 1712 wrote to memory of 2268 1712 Spoofer.exe 46 PID 1712 wrote to memory of 2268 1712 Spoofer.exe 46 PID 1712 wrote to memory of 1964 1712 Spoofer.exe 45 PID 1712 wrote to memory of 1964 1712 Spoofer.exe 45 PID 1712 wrote to memory of 1964 1712 Spoofer.exe 45 PID 1712 wrote to memory of 1456 1712 Spoofer.exe 48 PID 1712 wrote to memory of 1456 1712 Spoofer.exe 48 PID 1712 wrote to memory of 1456 1712 Spoofer.exe 48 PID 1712 wrote to memory of 836 1712 Spoofer.exe 51 PID 1712 wrote to memory of 836 1712 Spoofer.exe 51 PID 1712 wrote to memory of 836 1712 Spoofer.exe 51 PID 836 wrote to memory of 648 836 cmd.exe 49 PID 836 wrote to memory of 648 836 cmd.exe 49 PID 836 wrote to memory of 648 836 cmd.exe 49 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2628 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"2⤵
- Views/modifies file attributes
PID:2628
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Spoofer.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2224
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2528
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1964
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:2268
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1456
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Spoofer.exe" && pause2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:836
-
-
C:\Windows\system32\PING.EXEping localhost1⤵
- Runs ping.exe
PID:648
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\52ICUN7JW5SQARYY7ZAE.temp
Filesize7KB
MD5bbcfa3ab3a661e5441dd5c4c7897ea6c
SHA1013e55ccf5642ae2dc008cf75e98b0f9f237c740
SHA256a242d741e9c741616727e0a01216ee7832df5643f0d807e171f8a1c80f5298b1
SHA512ae791b4dd6d3cb9339f03aeaaf983e22322161471f9ee496cbdcfea277dd2b3cf0a4d2a806debf57452bf07da69b12b95274725f3ff657f6248d4931282234bf