Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
06/02/2024, 09:40
Behavioral task
behavioral1
Sample
Spoofer.exe
Resource
win7-20231129-en
General
-
Target
Spoofer.exe
-
Size
231KB
-
MD5
c964c96a473bbd29377a62c0d6e1d100
-
SHA1
879c4eebdfce76f13a2be8209c5b1ce3676152ef
-
SHA256
e6ce3dd93c2d407085ea10bb6f22bd89a34e7fff719e5579ee47f4f2fdaed921
-
SHA512
36e472d0b7d34a3b9968eb4c540cf839592df4b1147c1063fd0be4b72748cd48c0d8d46ef5cb6949932844951cd2f2dc5de7fdecbc98fc232958fe285813cf95
-
SSDEEP
6144:xloZM9rIkd8g+EtXHkv/iD4085oBPUon6WvRsY9+N0C8e1mkHi:DoZOL+EP8085oBPUon6WvRsY9eHC
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/2440-0-0x000002419F560000-0x000002419F5A0000-memory.dmp family_umbral -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Spoofer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 19 discord.com 20 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 11 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1480 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4296 PING.EXE -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2404 powershell.exe 2404 powershell.exe 4640 powershell.exe 4640 powershell.exe 680 powershell.exe 680 powershell.exe 1244 powershell.exe 1244 powershell.exe 2572 powershell.exe 2572 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2440 Spoofer.exe Token: SeDebugPrivilege 2404 powershell.exe Token: SeDebugPrivilege 4640 powershell.exe Token: SeDebugPrivilege 680 powershell.exe Token: SeDebugPrivilege 1244 powershell.exe Token: SeIncreaseQuotaPrivilege 3484 wmic.exe Token: SeSecurityPrivilege 3484 wmic.exe Token: SeTakeOwnershipPrivilege 3484 wmic.exe Token: SeLoadDriverPrivilege 3484 wmic.exe Token: SeSystemProfilePrivilege 3484 wmic.exe Token: SeSystemtimePrivilege 3484 wmic.exe Token: SeProfSingleProcessPrivilege 3484 wmic.exe Token: SeIncBasePriorityPrivilege 3484 wmic.exe Token: SeCreatePagefilePrivilege 3484 wmic.exe Token: SeBackupPrivilege 3484 wmic.exe Token: SeRestorePrivilege 3484 wmic.exe Token: SeShutdownPrivilege 3484 wmic.exe Token: SeDebugPrivilege 3484 wmic.exe Token: SeSystemEnvironmentPrivilege 3484 wmic.exe Token: SeRemoteShutdownPrivilege 3484 wmic.exe Token: SeUndockPrivilege 3484 wmic.exe Token: SeManageVolumePrivilege 3484 wmic.exe Token: 33 3484 wmic.exe Token: 34 3484 wmic.exe Token: 35 3484 wmic.exe Token: 36 3484 wmic.exe Token: SeIncreaseQuotaPrivilege 3484 wmic.exe Token: SeSecurityPrivilege 3484 wmic.exe Token: SeTakeOwnershipPrivilege 3484 wmic.exe Token: SeLoadDriverPrivilege 3484 wmic.exe Token: SeSystemProfilePrivilege 3484 wmic.exe Token: SeSystemtimePrivilege 3484 wmic.exe Token: SeProfSingleProcessPrivilege 3484 wmic.exe Token: SeIncBasePriorityPrivilege 3484 wmic.exe Token: SeCreatePagefilePrivilege 3484 wmic.exe Token: SeBackupPrivilege 3484 wmic.exe Token: SeRestorePrivilege 3484 wmic.exe Token: SeShutdownPrivilege 3484 wmic.exe Token: SeDebugPrivilege 3484 wmic.exe Token: SeSystemEnvironmentPrivilege 3484 wmic.exe Token: SeRemoteShutdownPrivilege 3484 wmic.exe Token: SeUndockPrivilege 3484 wmic.exe Token: SeManageVolumePrivilege 3484 wmic.exe Token: 33 3484 wmic.exe Token: 34 3484 wmic.exe Token: 35 3484 wmic.exe Token: 36 3484 wmic.exe Token: SeIncreaseQuotaPrivilege 4648 wmic.exe Token: SeSecurityPrivilege 4648 wmic.exe Token: SeTakeOwnershipPrivilege 4648 wmic.exe Token: SeLoadDriverPrivilege 4648 wmic.exe Token: SeSystemProfilePrivilege 4648 wmic.exe Token: SeSystemtimePrivilege 4648 wmic.exe Token: SeProfSingleProcessPrivilege 4648 wmic.exe Token: SeIncBasePriorityPrivilege 4648 wmic.exe Token: SeCreatePagefilePrivilege 4648 wmic.exe Token: SeBackupPrivilege 4648 wmic.exe Token: SeRestorePrivilege 4648 wmic.exe Token: SeShutdownPrivilege 4648 wmic.exe Token: SeDebugPrivilege 4648 wmic.exe Token: SeSystemEnvironmentPrivilege 4648 wmic.exe Token: SeRemoteShutdownPrivilege 4648 wmic.exe Token: SeUndockPrivilege 4648 wmic.exe Token: SeManageVolumePrivilege 4648 wmic.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2440 wrote to memory of 4372 2440 Spoofer.exe 31 PID 2440 wrote to memory of 4372 2440 Spoofer.exe 31 PID 2440 wrote to memory of 2404 2440 Spoofer.exe 29 PID 2440 wrote to memory of 2404 2440 Spoofer.exe 29 PID 2440 wrote to memory of 4640 2440 Spoofer.exe 35 PID 2440 wrote to memory of 4640 2440 Spoofer.exe 35 PID 2440 wrote to memory of 680 2440 Spoofer.exe 37 PID 2440 wrote to memory of 680 2440 Spoofer.exe 37 PID 2440 wrote to memory of 1244 2440 Spoofer.exe 42 PID 2440 wrote to memory of 1244 2440 Spoofer.exe 42 PID 2440 wrote to memory of 3484 2440 Spoofer.exe 98 PID 2440 wrote to memory of 3484 2440 Spoofer.exe 98 PID 2440 wrote to memory of 4648 2440 Spoofer.exe 107 PID 2440 wrote to memory of 4648 2440 Spoofer.exe 107 PID 2440 wrote to memory of 1704 2440 Spoofer.exe 100 PID 2440 wrote to memory of 1704 2440 Spoofer.exe 100 PID 2440 wrote to memory of 2572 2440 Spoofer.exe 103 PID 2440 wrote to memory of 2572 2440 Spoofer.exe 103 PID 2440 wrote to memory of 1480 2440 Spoofer.exe 104 PID 2440 wrote to memory of 1480 2440 Spoofer.exe 104 PID 2440 wrote to memory of 4416 2440 Spoofer.exe 110 PID 2440 wrote to memory of 4416 2440 Spoofer.exe 110 PID 4416 wrote to memory of 4296 4416 cmd.exe 108 PID 4416 wrote to memory of 4296 4416 cmd.exe 108 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 4372 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Spoofer.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2404
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Spoofer.exe"2⤵
- Views/modifies file attributes
PID:4372
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4640
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1244
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1480
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4648
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Spoofer.exe" && pause2⤵
- Suspicious use of WriteProcessMemory
PID:4416
-
-
C:\Windows\system32\PING.EXEping localhost1⤵
- Runs ping.exe
PID:4296
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
948B
MD574a6b79d36b4aae8b027a218bc6e1af7
SHA10350e46c1df6934903c4820a00b0bc4721779e5f
SHA25660c64f6803d7ad1408d0a8628100470859b16ef332d5f1bd8bb2debe51251d04
SHA51260e71435a9a23f4c144d641844f4182ddc9aa4ccd3e99232149a187112dce96458aab9587e9fea46f5dc5a52f5ca758969a04657a2b5b10241d3e4554f7c85e0
-
Filesize
1KB
MD588be3bc8a7f90e3953298c0fdbec4d72
SHA1f4969784ad421cc80ef45608727aacd0f6bf2e4b
SHA256533c8470b41084e40c5660569ebbdb7496520d449629a235e8053e84025f348a
SHA5124fce64e2dacddbc03314048fef1ce356ee2647c14733da121c23c65507eeb8d721d6b690ad5463319b364dc4fa95904ad6ab096907f32918e3406ef438a6ef7c
-
Filesize
1KB
MD523272afe282560b0a5abad03e415e79b
SHA1d24997643237343f0db0d9ab70e445450c70c795
SHA256b3e29a57ee8c2da3dd7df14e6fd34632246e41950f3efd9ce9d35f1797ece1c9
SHA512bc013bbd6083ef858570cdcdc89f761177f298cc394a0acfc553b2decc61e056459a539037ed67af13c2c4851e20d8df92a1c23d3d0b818a2e585506f28053c4
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82