Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 01:02
Behavioral task
behavioral1
Sample
sinfulsassist.exe
Resource
win7-20231215-en
General
-
Target
sinfulsassist.exe
-
Size
232KB
-
MD5
6bd66ae3d6ad55de0d3bfd026ab642f8
-
SHA1
b9c03630edcb053a0f14970ea7085a8a2a285d8a
-
SHA256
80e1636664daed3c4c919584a40b1404807ff859fcb98267abdbe487c9a16c1f
-
SHA512
c776fe3939329bfd47c447d069f89976acedb90853ab3d16386afab6123c7f1dfd9aadbbefa458226c4065452fdfd6d5dfc0a8162950d65818d7039ab92513fa
-
SSDEEP
6144:tloZMArIkd8g+EtXHkv/iD4xR8KfVealwgRj++71Nb8e1mRi:voZHL+EP8xR8KfVealwgRj++7X3
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/5044-0-0x000002348C350000-0x000002348C390000-memory.dmp family_umbral -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts sinfulsassist.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 31 discord.com 32 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 24 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1436 wmic.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4240 powershell.exe 4240 powershell.exe 220 powershell.exe 220 powershell.exe 4940 powershell.exe 4940 powershell.exe 2288 powershell.exe 2288 powershell.exe 3388 powershell.exe 3388 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 5044 sinfulsassist.exe Token: SeDebugPrivilege 4240 powershell.exe Token: SeDebugPrivilege 220 powershell.exe Token: SeDebugPrivilege 4940 powershell.exe Token: SeDebugPrivilege 2288 powershell.exe Token: SeIncreaseQuotaPrivilege 2688 wmic.exe Token: SeSecurityPrivilege 2688 wmic.exe Token: SeTakeOwnershipPrivilege 2688 wmic.exe Token: SeLoadDriverPrivilege 2688 wmic.exe Token: SeSystemProfilePrivilege 2688 wmic.exe Token: SeSystemtimePrivilege 2688 wmic.exe Token: SeProfSingleProcessPrivilege 2688 wmic.exe Token: SeIncBasePriorityPrivilege 2688 wmic.exe Token: SeCreatePagefilePrivilege 2688 wmic.exe Token: SeBackupPrivilege 2688 wmic.exe Token: SeRestorePrivilege 2688 wmic.exe Token: SeShutdownPrivilege 2688 wmic.exe Token: SeDebugPrivilege 2688 wmic.exe Token: SeSystemEnvironmentPrivilege 2688 wmic.exe Token: SeRemoteShutdownPrivilege 2688 wmic.exe Token: SeUndockPrivilege 2688 wmic.exe Token: SeManageVolumePrivilege 2688 wmic.exe Token: 33 2688 wmic.exe Token: 34 2688 wmic.exe Token: 35 2688 wmic.exe Token: 36 2688 wmic.exe Token: SeIncreaseQuotaPrivilege 2688 wmic.exe Token: SeSecurityPrivilege 2688 wmic.exe Token: SeTakeOwnershipPrivilege 2688 wmic.exe Token: SeLoadDriverPrivilege 2688 wmic.exe Token: SeSystemProfilePrivilege 2688 wmic.exe Token: SeSystemtimePrivilege 2688 wmic.exe Token: SeProfSingleProcessPrivilege 2688 wmic.exe Token: SeIncBasePriorityPrivilege 2688 wmic.exe Token: SeCreatePagefilePrivilege 2688 wmic.exe Token: SeBackupPrivilege 2688 wmic.exe Token: SeRestorePrivilege 2688 wmic.exe Token: SeShutdownPrivilege 2688 wmic.exe Token: SeDebugPrivilege 2688 wmic.exe Token: SeSystemEnvironmentPrivilege 2688 wmic.exe Token: SeRemoteShutdownPrivilege 2688 wmic.exe Token: SeUndockPrivilege 2688 wmic.exe Token: SeManageVolumePrivilege 2688 wmic.exe Token: 33 2688 wmic.exe Token: 34 2688 wmic.exe Token: 35 2688 wmic.exe Token: 36 2688 wmic.exe Token: SeIncreaseQuotaPrivilege 2880 wmic.exe Token: SeSecurityPrivilege 2880 wmic.exe Token: SeTakeOwnershipPrivilege 2880 wmic.exe Token: SeLoadDriverPrivilege 2880 wmic.exe Token: SeSystemProfilePrivilege 2880 wmic.exe Token: SeSystemtimePrivilege 2880 wmic.exe Token: SeProfSingleProcessPrivilege 2880 wmic.exe Token: SeIncBasePriorityPrivilege 2880 wmic.exe Token: SeCreatePagefilePrivilege 2880 wmic.exe Token: SeBackupPrivilege 2880 wmic.exe Token: SeRestorePrivilege 2880 wmic.exe Token: SeShutdownPrivilege 2880 wmic.exe Token: SeDebugPrivilege 2880 wmic.exe Token: SeSystemEnvironmentPrivilege 2880 wmic.exe Token: SeRemoteShutdownPrivilege 2880 wmic.exe Token: SeUndockPrivilege 2880 wmic.exe Token: SeManageVolumePrivilege 2880 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 5044 wrote to memory of 4240 5044 sinfulsassist.exe 86 PID 5044 wrote to memory of 4240 5044 sinfulsassist.exe 86 PID 5044 wrote to memory of 220 5044 sinfulsassist.exe 88 PID 5044 wrote to memory of 220 5044 sinfulsassist.exe 88 PID 5044 wrote to memory of 4940 5044 sinfulsassist.exe 90 PID 5044 wrote to memory of 4940 5044 sinfulsassist.exe 90 PID 5044 wrote to memory of 2288 5044 sinfulsassist.exe 92 PID 5044 wrote to memory of 2288 5044 sinfulsassist.exe 92 PID 5044 wrote to memory of 2688 5044 sinfulsassist.exe 95 PID 5044 wrote to memory of 2688 5044 sinfulsassist.exe 95 PID 5044 wrote to memory of 2880 5044 sinfulsassist.exe 97 PID 5044 wrote to memory of 2880 5044 sinfulsassist.exe 97 PID 5044 wrote to memory of 3108 5044 sinfulsassist.exe 99 PID 5044 wrote to memory of 3108 5044 sinfulsassist.exe 99 PID 5044 wrote to memory of 3388 5044 sinfulsassist.exe 101 PID 5044 wrote to memory of 3388 5044 sinfulsassist.exe 101 PID 5044 wrote to memory of 1436 5044 sinfulsassist.exe 104 PID 5044 wrote to memory of 1436 5044 sinfulsassist.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\sinfulsassist.exe"C:\Users\Admin\AppData\Local\Temp\sinfulsassist.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sinfulsassist.exe'2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4240
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4940
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2688
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2880
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:3108
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3388
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1436
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
1KB
MD55423eae8a66353bd7e5a09531a03c014
SHA13ca22804ba343bd0dc2b2124990b082c024b7b3c
SHA256a6066c1711139e9e4844faf543d5818a4613d6c1baeb8040aaca15c19ca3339f
SHA51220e952424eb88f8268510c6b1de19ce796a624a19a4460fcaab915993a5c324c176e56d66eb8735a2c81731077868c6018ec938ac7215d739c9fa96a1182f515
-
Filesize
944B
MD56d3e9c29fe44e90aae6ed30ccf799ca8
SHA1c7974ef72264bbdf13a2793ccf1aed11bc565dce
SHA2562360634e63e8f0b5748e2c56ebb8f4aa78e71008ea7b5c9ca1c49be03b49557d
SHA51260c38c4367352537545d859f64b9c5cbada94240478d1d039fd27b5ecba4dc1c90051557c16d802269703b873546ead416279c0a80c6fd5e49ad361cef22596a
-
Filesize
948B
MD5c9b6705519e1eef08f86c4ba5f4286f3
SHA16c6b179e452ecee2673a1d4fe128f1c06f70577f
SHA2560f9cad44a79126871580e19b01dc3f880c5173b1faaf8b9018d5d1f829714705
SHA5126d8f85a7a8b0b124530f36a157cd0441b5c1eacdc35e274af9fbf0569d03d1d5e468651a5b2425f0215c282ecfa7b1ffeaeeaf18612822f00bd14306d30640c7
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82