Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Sky Beta .exe
windows7-x64
7Sky Beta .exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1Sky Beta.exe
windows7-x64
1Sky Beta.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1locales/af.ps1
windows7-x64
1locales/af.ps1
windows10-2004-x64
1locales/en-GB.ps1
windows7-x64
1locales/en-GB.ps1
windows10-2004-x64
1locales/et.ps1
windows7-x64
1locales/et.ps1
windows10-2004-x64
1locales/pt-BR.ps1
windows7-x64
1locales/pt-BR.ps1
windows10-2004-x64
1locales/sk.ps1
windows7-x64
1locales/sk.ps1
windows10-2004-x64
1locales/uk.ps1
windows7-x64
1locales/uk.ps1
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1Analysis
-
max time kernel
152s -
max time network
165s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 02:57
Static task
static1
Behavioral task
behavioral1
Sample
Sky Beta .exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
Sky Beta .exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Sky Beta.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
Sky Beta.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
locales/af.ps1
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral19
Sample
locales/af.ps1
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
locales/en-GB.ps1
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral21
Sample
locales/en-GB.ps1
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
locales/et.ps1
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral23
Sample
locales/et.ps1
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
locales/pt-BR.ps1
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral25
Sample
locales/pt-BR.ps1
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
locales/sk.ps1
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral27
Sample
locales/sk.ps1
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
locales/uk.ps1
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral29
Sample
locales/uk.ps1
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
resources/elevate.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral31
Sample
resources/elevate.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
vk_swiftshader.dll
Resource
win7-20231215-en
windows7-x64
General
-
Target
Sky Beta.exe
-
Size
152.7MB
-
MD5
82bba5f337a5441c52486c72dbe1ae91
-
SHA1
8e31ee0ec80cbf883b5ee945fed9b9e330407f5b
-
SHA256
28654e3b799752f56c9699d156c01f21dbbe598058ba52e9b8f876a0e7c8ce09
-
SHA512
16300c7c590145f9da4b8c06b6efe1be77a3ba037234d4de8fae3586c9453698596f6fa2e0600a171d0512a9b9b28dfbe55d27bffafe673e4c8afcbfb12660e7
-
SSDEEP
1572864:qLBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:qypCmJctBjj2+Jv
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.exe Sky Beta.exe -
Loads dropped DLL 2 IoCs
pid Process 4692 Sky Beta.exe 4692 Sky Beta.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates processes with tasklist 1 TTPs 10 IoCs
pid Process 4012 tasklist.exe 468 tasklist.exe 864 tasklist.exe 2340 tasklist.exe 3188 tasklist.exe 4112 tasklist.exe 2508 tasklist.exe 1780 tasklist.exe 3260 tasklist.exe 1420 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1696 Sky Beta.exe 1696 Sky Beta.exe 1276 Sky Beta.exe 1276 Sky Beta.exe 1276 Sky Beta.exe 1276 Sky Beta.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1780 tasklist.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeDebugPrivilege 4012 tasklist.exe Token: SeDebugPrivilege 468 tasklist.exe Token: SeDebugPrivilege 1420 tasklist.exe Token: SeDebugPrivilege 864 tasklist.exe Token: SeDebugPrivilege 2340 tasklist.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeDebugPrivilege 3188 tasklist.exe Token: SeDebugPrivilege 4112 tasklist.exe Token: SeDebugPrivilege 3260 tasklist.exe Token: SeDebugPrivilege 2508 tasklist.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe Token: SeShutdownPrivilege 4692 Sky Beta.exe Token: SeCreatePagefilePrivilege 4692 Sky Beta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 4676 4692 Sky Beta.exe 86 PID 4692 wrote to memory of 4676 4692 Sky Beta.exe 86 PID 4676 wrote to memory of 1780 4676 cmd.exe 89 PID 4676 wrote to memory of 1780 4676 cmd.exe 89 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 2232 4692 Sky Beta.exe 87 PID 4692 wrote to memory of 1696 4692 Sky Beta.exe 90 PID 4692 wrote to memory of 1696 4692 Sky Beta.exe 90 PID 4692 wrote to memory of 528 4692 Sky Beta.exe 93 PID 4692 wrote to memory of 528 4692 Sky Beta.exe 93 PID 528 wrote to memory of 4012 528 cmd.exe 92 PID 528 wrote to memory of 4012 528 cmd.exe 92 PID 4692 wrote to memory of 5048 4692 Sky Beta.exe 96 PID 4692 wrote to memory of 5048 4692 Sky Beta.exe 96 PID 5048 wrote to memory of 468 5048 cmd.exe 94 PID 5048 wrote to memory of 468 5048 cmd.exe 94 PID 4692 wrote to memory of 1280 4692 Sky Beta.exe 101 PID 4692 wrote to memory of 1280 4692 Sky Beta.exe 101 PID 1280 wrote to memory of 1420 1280 cmd.exe 98 PID 1280 wrote to memory of 1420 1280 cmd.exe 98 PID 4692 wrote to memory of 4476 4692 Sky Beta.exe 102 PID 4692 wrote to memory of 4476 4692 Sky Beta.exe 102 PID 4476 wrote to memory of 864 4476 cmd.exe 104 PID 4476 wrote to memory of 864 4476 cmd.exe 104 PID 4692 wrote to memory of 3808 4692 Sky Beta.exe 105 PID 4692 wrote to memory of 3808 4692 Sky Beta.exe 105 PID 3808 wrote to memory of 2340 3808 cmd.exe 106 PID 3808 wrote to memory of 2340 3808 cmd.exe 106 PID 4692 wrote to memory of 4880 4692 Sky Beta.exe 110 PID 4692 wrote to memory of 4880 4692 Sky Beta.exe 110 PID 4880 wrote to memory of 3188 4880 cmd.exe 109 PID 4880 wrote to memory of 3188 4880 cmd.exe 109 PID 4692 wrote to memory of 4472 4692 Sky Beta.exe 113 PID 4692 wrote to memory of 4472 4692 Sky Beta.exe 113 PID 4472 wrote to memory of 4112 4472 cmd.exe 112
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe"C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:4676 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1780
-
-
-
C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe"C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1744,i,13181175687544420501,4742338557869405784,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:2232
-
-
C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe"C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --mojo-platform-channel-handle=1940 --field-trial-handle=1744,i,13181175687544420501,4742338557869405784,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1696
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:528
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:5048
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:1280
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:864
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:3808 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:4880
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:4472
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:5012
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:860
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2508
-
-
-
C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe"C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1212 --field-trial-handle=1744,i,13181175687544420501,4742338557869405784,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1276
-
-
C:\Windows\system32\tasklist.exetasklist1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4012
-
C:\Windows\system32\tasklist.exetasklist1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:468
-
C:\Windows\system32\tasklist.exetasklist1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1420
-
C:\Windows\system32\tasklist.exetasklist1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3188
-
C:\Windows\system32\tasklist.exetasklist1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
C:\Windows\system32\tasklist.exetasklist1⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155KB
MD55e5e518ef0b6fdc731da7c6b92478aa0
SHA1e2cd51e5ee4d2bb317d2eb88f1008c3a4d06616c
SHA256eec714e3ec4aa4f4894541829ebca1cea5bded48a1995ff9534ce57d41ffc3de
SHA5125532288bd119937122af641d580721205bdcbeb05bc8595a68f59879cb1b76cd950d1a2a28f1226c7642d2d423f2bffe6e6c7cf27cc3957d894324dd1d2ee07f
-
Filesize
1.6MB
MD5d4ea78aa02027fe173ece3c18d69f4df
SHA14d97b67d772b5980f75257104c3a6d52d160af37
SHA256a6436658f64a03171a5396b788fccd0f09fc450ba3c37806b6b96996ede330b1
SHA512d6b45631e6f99ab534617e8812d85c03d64758a095e8faa60804c11f11499e5c1a042e0fcf8d12b84a0d83b5b503bf375036471a435579858607e1f69c177b65