Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
7Static
static
3Sky Beta .exe
windows7-x64
7Sky Beta .exe
windows10-2004-x64
7$PLUGINSDI...ls.dll
windows7-x64
3$PLUGINSDI...ls.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3LICENSES.c...m.html
windows7-x64
1LICENSES.c...m.html
windows10-2004-x64
1Sky Beta.exe
windows7-x64
1Sky Beta.exe
windows10-2004-x64
7d3dcompiler_47.dll
windows10-2004-x64
1ffmpeg.dll
windows7-x64
1ffmpeg.dll
windows10-2004-x64
1libEGL.dll
windows7-x64
1libEGL.dll
windows10-2004-x64
1libGLESv2.dll
windows7-x64
1libGLESv2.dll
windows10-2004-x64
1locales/af.ps1
windows7-x64
1locales/af.ps1
windows10-2004-x64
1locales/en-GB.ps1
windows7-x64
1locales/en-GB.ps1
windows10-2004-x64
1locales/et.ps1
windows7-x64
1locales/et.ps1
windows10-2004-x64
1locales/pt-BR.ps1
windows7-x64
1locales/pt-BR.ps1
windows10-2004-x64
1locales/sk.ps1
windows7-x64
1locales/sk.ps1
windows10-2004-x64
1locales/uk.ps1
windows7-x64
1locales/uk.ps1
windows10-2004-x64
1resources/elevate.exe
windows7-x64
1resources/elevate.exe
windows10-2004-x64
1vk_swiftshader.dll
windows7-x64
1Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
12/02/2024, 03:01
Static task
static1
Behavioral task
behavioral1
Sample
Sky Beta .exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
Sky Beta .exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/StdUtils.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
LICENSES.chromium.html
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral8
Sample
LICENSES.chromium.html
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
Sky Beta.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral10
Sample
Sky Beta.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
d3dcompiler_47.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
ffmpeg.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral13
Sample
ffmpeg.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
libEGL.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral15
Sample
libEGL.dll
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
libGLESv2.dll
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral17
Sample
libGLESv2.dll
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
locales/af.ps1
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral19
Sample
locales/af.ps1
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
locales/en-GB.ps1
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral21
Sample
locales/en-GB.ps1
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
locales/et.ps1
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral23
Sample
locales/et.ps1
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
locales/pt-BR.ps1
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral25
Sample
locales/pt-BR.ps1
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
locales/sk.ps1
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral27
Sample
locales/sk.ps1
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
locales/uk.ps1
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral29
Sample
locales/uk.ps1
Resource
win10v2004-20231222-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
resources/elevate.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral31
Sample
resources/elevate.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
vk_swiftshader.dll
Resource
win7-20231215-en
windows7-x64
General
-
Target
Sky Beta.exe
-
Size
152.7MB
-
MD5
82bba5f337a5441c52486c72dbe1ae91
-
SHA1
8e31ee0ec80cbf883b5ee945fed9b9e330407f5b
-
SHA256
28654e3b799752f56c9699d156c01f21dbbe598058ba52e9b8f876a0e7c8ce09
-
SHA512
16300c7c590145f9da4b8c06b6efe1be77a3ba037234d4de8fae3586c9453698596f6fa2e0600a171d0512a9b9b28dfbe55d27bffafe673e4c8afcbfb12660e7
-
SSDEEP
1572864:qLBZB52nvuZ7wVuMbgR7Sp6kYdEctmhoLsPagBsgkx52HYhwj+vfIBUdoJnP9Dj0:qypCmJctBjj2+Jv
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Updater.exe Sky Beta.exe -
Loads dropped DLL 2 IoCs
pid Process 4080 Sky Beta.exe 4080 Sky Beta.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates processes with tasklist 1 TTPs 10 IoCs
pid Process 2856 tasklist.exe 4844 tasklist.exe 3884 tasklist.exe 2344 tasklist.exe 3912 tasklist.exe 2232 tasklist.exe 1464 tasklist.exe 4300 tasklist.exe 4112 tasklist.exe 64 tasklist.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 4384 Sky Beta.exe 4384 Sky Beta.exe 4652 Sky Beta.exe 4652 Sky Beta.exe 4652 Sky Beta.exe 4652 Sky Beta.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3912 tasklist.exe Token: SeDebugPrivilege 2232 tasklist.exe Token: SeDebugPrivilege 1464 tasklist.exe Token: SeDebugPrivilege 4300 tasklist.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeDebugPrivilege 4112 tasklist.exe Token: SeDebugPrivilege 64 tasklist.exe Token: SeDebugPrivilege 2856 tasklist.exe Token: SeDebugPrivilege 4844 tasklist.exe Token: SeDebugPrivilege 2344 tasklist.exe Token: SeDebugPrivilege 3884 tasklist.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe Token: SeShutdownPrivilege 4080 Sky Beta.exe Token: SeCreatePagefilePrivilege 4080 Sky Beta.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4080 wrote to memory of 2752 4080 Sky Beta.exe 89 PID 4080 wrote to memory of 2752 4080 Sky Beta.exe 89 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 4080 wrote to memory of 4540 4080 Sky Beta.exe 91 PID 2752 wrote to memory of 3912 2752 cmd.exe 92 PID 2752 wrote to memory of 3912 2752 cmd.exe 92 PID 4080 wrote to memory of 4384 4080 Sky Beta.exe 93 PID 4080 wrote to memory of 4384 4080 Sky Beta.exe 93 PID 4080 wrote to memory of 1488 4080 Sky Beta.exe 94 PID 4080 wrote to memory of 1488 4080 Sky Beta.exe 94 PID 1488 wrote to memory of 2232 1488 cmd.exe 96 PID 1488 wrote to memory of 2232 1488 cmd.exe 96 PID 4080 wrote to memory of 1976 4080 Sky Beta.exe 97 PID 4080 wrote to memory of 1976 4080 Sky Beta.exe 97 PID 1976 wrote to memory of 1464 1976 cmd.exe 99 PID 1976 wrote to memory of 1464 1976 cmd.exe 99 PID 4080 wrote to memory of 4912 4080 Sky Beta.exe 100 PID 4080 wrote to memory of 4912 4080 Sky Beta.exe 100 PID 4912 wrote to memory of 4300 4912 cmd.exe 102 PID 4912 wrote to memory of 4300 4912 cmd.exe 102 PID 4080 wrote to memory of 644 4080 Sky Beta.exe 103 PID 4080 wrote to memory of 644 4080 Sky Beta.exe 103 PID 644 wrote to memory of 4112 644 cmd.exe 105 PID 644 wrote to memory of 4112 644 cmd.exe 105 PID 4080 wrote to memory of 3288 4080 Sky Beta.exe 106 PID 4080 wrote to memory of 3288 4080 Sky Beta.exe 106 PID 3288 wrote to memory of 64 3288 cmd.exe 108 PID 3288 wrote to memory of 64 3288 cmd.exe 108 PID 4080 wrote to memory of 4744 4080 Sky Beta.exe 109 PID 4080 wrote to memory of 4744 4080 Sky Beta.exe 109 PID 4744 wrote to memory of 2856 4744 cmd.exe 111 PID 4744 wrote to memory of 2856 4744 cmd.exe 111 PID 4080 wrote to memory of 3736 4080 Sky Beta.exe 112 PID 4080 wrote to memory of 3736 4080 Sky Beta.exe 112 PID 3736 wrote to memory of 4844 3736 cmd.exe 114
Processes
-
C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe"C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3912
-
-
-
C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe"C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1680,i,8003340748033330071,17179015242705847583,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵PID:4540
-
-
C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe"C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --mojo-platform-channel-handle=1960 --field-trial-handle=1680,i,8003340748033330071,17179015242705847583,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4384
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2232
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1464
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:4912 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4300
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4112
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:3288 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:64
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:4744 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:4844
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:4988
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /d /s /c "tasklist"2⤵PID:3916
-
C:\Windows\system32\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:3884
-
-
-
C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe"C:\Users\Admin\AppData\Local\Temp\Sky Beta.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --user-data-dir="C:\Users\Admin\AppData\Roaming\project" --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAAAGAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1680,i,8003340748033330071,17179015242705847583,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155KB
MD55e5e518ef0b6fdc731da7c6b92478aa0
SHA1e2cd51e5ee4d2bb317d2eb88f1008c3a4d06616c
SHA256eec714e3ec4aa4f4894541829ebca1cea5bded48a1995ff9534ce57d41ffc3de
SHA5125532288bd119937122af641d580721205bdcbeb05bc8595a68f59879cb1b76cd950d1a2a28f1226c7642d2d423f2bffe6e6c7cf27cc3957d894324dd1d2ee07f
-
Filesize
1.8MB
MD5beb8d911d40e8fe94770d9d341e0de11
SHA1d24d31e5b44a4a80969e2a669fb9b0ed42cfd479
SHA256ec41fc2fee2abcbf0559965501f54aae47cff24a87204fd3a85d86c7d53d53c7
SHA512079c43c2533fa35411247dd091c5caedb4a0dbdeee7b8f9fbbba6f521d760856822d373f1e6682eff10bebc63168cb4a445aee7b23047e4d784ab28891d07bfe