Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
23/08/2024, 21:52
Behavioral task
behavioral1
Sample
lsass.exe
Resource
win7-20240704-en
General
-
Target
lsass.exe
-
Size
231KB
-
MD5
3593f099b9c3e67320e88a6934eaaa25
-
SHA1
280da4c122c680ecb0f246c67e3913eb1cc923a1
-
SHA256
78f05b962a93bd4cd6086b6d785c987b18891f3a9e39866a5115c80bbcd51f3c
-
SHA512
b3c391e9e652fa8918fe9b7e0f9ee53166840a688b1dffb3dc8d045c879b5f825c0a571c306d98cf2b5c44e88a99e8d8fcfede310f063df506acce09e31ee75c
-
SSDEEP
6144:5loZM+rIkd8g+EtXHkv/iD4S08Cls8e1mrci:LoZtL+EP8DQ01
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1848-1-0x0000000001130000-0x0000000001170000-memory.dmp family_umbral -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2600 powershell.exe 3016 powershell.exe 2988 powershell.exe 2524 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts lsass.exe -
Deletes itself 1 IoCs
pid Process 2224 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 discord.com 10 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2224 cmd.exe 1284 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1508 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1284 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1848 lsass.exe 2600 powershell.exe 3016 powershell.exe 2988 powershell.exe 1960 powershell.exe 2524 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1848 lsass.exe Token: SeIncreaseQuotaPrivilege 2244 wmic.exe Token: SeSecurityPrivilege 2244 wmic.exe Token: SeTakeOwnershipPrivilege 2244 wmic.exe Token: SeLoadDriverPrivilege 2244 wmic.exe Token: SeSystemProfilePrivilege 2244 wmic.exe Token: SeSystemtimePrivilege 2244 wmic.exe Token: SeProfSingleProcessPrivilege 2244 wmic.exe Token: SeIncBasePriorityPrivilege 2244 wmic.exe Token: SeCreatePagefilePrivilege 2244 wmic.exe Token: SeBackupPrivilege 2244 wmic.exe Token: SeRestorePrivilege 2244 wmic.exe Token: SeShutdownPrivilege 2244 wmic.exe Token: SeDebugPrivilege 2244 wmic.exe Token: SeSystemEnvironmentPrivilege 2244 wmic.exe Token: SeRemoteShutdownPrivilege 2244 wmic.exe Token: SeUndockPrivilege 2244 wmic.exe Token: SeManageVolumePrivilege 2244 wmic.exe Token: 33 2244 wmic.exe Token: 34 2244 wmic.exe Token: 35 2244 wmic.exe Token: SeIncreaseQuotaPrivilege 2244 wmic.exe Token: SeSecurityPrivilege 2244 wmic.exe Token: SeTakeOwnershipPrivilege 2244 wmic.exe Token: SeLoadDriverPrivilege 2244 wmic.exe Token: SeSystemProfilePrivilege 2244 wmic.exe Token: SeSystemtimePrivilege 2244 wmic.exe Token: SeProfSingleProcessPrivilege 2244 wmic.exe Token: SeIncBasePriorityPrivilege 2244 wmic.exe Token: SeCreatePagefilePrivilege 2244 wmic.exe Token: SeBackupPrivilege 2244 wmic.exe Token: SeRestorePrivilege 2244 wmic.exe Token: SeShutdownPrivilege 2244 wmic.exe Token: SeDebugPrivilege 2244 wmic.exe Token: SeSystemEnvironmentPrivilege 2244 wmic.exe Token: SeRemoteShutdownPrivilege 2244 wmic.exe Token: SeUndockPrivilege 2244 wmic.exe Token: SeManageVolumePrivilege 2244 wmic.exe Token: 33 2244 wmic.exe Token: 34 2244 wmic.exe Token: 35 2244 wmic.exe Token: SeDebugPrivilege 2600 powershell.exe Token: SeDebugPrivilege 3016 powershell.exe Token: SeDebugPrivilege 2988 powershell.exe Token: SeDebugPrivilege 1960 powershell.exe Token: SeIncreaseQuotaPrivilege 2040 wmic.exe Token: SeSecurityPrivilege 2040 wmic.exe Token: SeTakeOwnershipPrivilege 2040 wmic.exe Token: SeLoadDriverPrivilege 2040 wmic.exe Token: SeSystemProfilePrivilege 2040 wmic.exe Token: SeSystemtimePrivilege 2040 wmic.exe Token: SeProfSingleProcessPrivilege 2040 wmic.exe Token: SeIncBasePriorityPrivilege 2040 wmic.exe Token: SeCreatePagefilePrivilege 2040 wmic.exe Token: SeBackupPrivilege 2040 wmic.exe Token: SeRestorePrivilege 2040 wmic.exe Token: SeShutdownPrivilege 2040 wmic.exe Token: SeDebugPrivilege 2040 wmic.exe Token: SeSystemEnvironmentPrivilege 2040 wmic.exe Token: SeRemoteShutdownPrivilege 2040 wmic.exe Token: SeUndockPrivilege 2040 wmic.exe Token: SeManageVolumePrivilege 2040 wmic.exe Token: 33 2040 wmic.exe Token: 34 2040 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2244 1848 lsass.exe 31 PID 1848 wrote to memory of 2244 1848 lsass.exe 31 PID 1848 wrote to memory of 2244 1848 lsass.exe 31 PID 1848 wrote to memory of 2680 1848 lsass.exe 34 PID 1848 wrote to memory of 2680 1848 lsass.exe 34 PID 1848 wrote to memory of 2680 1848 lsass.exe 34 PID 1848 wrote to memory of 2600 1848 lsass.exe 36 PID 1848 wrote to memory of 2600 1848 lsass.exe 36 PID 1848 wrote to memory of 2600 1848 lsass.exe 36 PID 1848 wrote to memory of 3016 1848 lsass.exe 38 PID 1848 wrote to memory of 3016 1848 lsass.exe 38 PID 1848 wrote to memory of 3016 1848 lsass.exe 38 PID 1848 wrote to memory of 2988 1848 lsass.exe 40 PID 1848 wrote to memory of 2988 1848 lsass.exe 40 PID 1848 wrote to memory of 2988 1848 lsass.exe 40 PID 1848 wrote to memory of 1960 1848 lsass.exe 42 PID 1848 wrote to memory of 1960 1848 lsass.exe 42 PID 1848 wrote to memory of 1960 1848 lsass.exe 42 PID 1848 wrote to memory of 2040 1848 lsass.exe 44 PID 1848 wrote to memory of 2040 1848 lsass.exe 44 PID 1848 wrote to memory of 2040 1848 lsass.exe 44 PID 1848 wrote to memory of 2532 1848 lsass.exe 46 PID 1848 wrote to memory of 2532 1848 lsass.exe 46 PID 1848 wrote to memory of 2532 1848 lsass.exe 46 PID 1848 wrote to memory of 880 1848 lsass.exe 48 PID 1848 wrote to memory of 880 1848 lsass.exe 48 PID 1848 wrote to memory of 880 1848 lsass.exe 48 PID 1848 wrote to memory of 2524 1848 lsass.exe 50 PID 1848 wrote to memory of 2524 1848 lsass.exe 50 PID 1848 wrote to memory of 2524 1848 lsass.exe 50 PID 1848 wrote to memory of 1508 1848 lsass.exe 52 PID 1848 wrote to memory of 1508 1848 lsass.exe 52 PID 1848 wrote to memory of 1508 1848 lsass.exe 52 PID 1848 wrote to memory of 2224 1848 lsass.exe 54 PID 1848 wrote to memory of 2224 1848 lsass.exe 54 PID 1848 wrote to memory of 2224 1848 lsass.exe 54 PID 2224 wrote to memory of 1284 2224 cmd.exe 56 PID 2224 wrote to memory of 1284 2224 cmd.exe 56 PID 2224 wrote to memory of 1284 2224 cmd.exe 56 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2680 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\lsass.exe"C:\Users\Admin\AppData\Local\Temp\lsass.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\lsass.exe"2⤵
- Views/modifies file attributes
PID:2680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\lsass.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3016
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2988
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2040
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:2532
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:880
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2524
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1508
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\lsass.exe" && pause2⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1284
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD519e4b9e04b2fa2c72c13d8e51148ea2d
SHA1789b996275e836d04818321fb608cde050230e12
SHA2566c8964b12fcb3df2f465b8340f32b7019ca5638f5a586d700c248045d13dce93
SHA51249bf5d5f30a58c599598e755c73e97ef138028fce9ee347ee7fcaa0b11e1ff18dbcb6df7b8bb8516cff74aa86930d5bb2a79fd94e5c458e77590fe0e640baef1