Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 02:16
Behavioral task
behavioral1
Sample
Delta hack pc.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
Delta hack pc.exe
Resource
win10v2004-20240802-en
General
-
Target
Delta hack pc.exe
-
Size
231KB
-
MD5
3b915b9bbc5ddf429f85bf939febe424
-
SHA1
2278baaf3764a27bc962de75601f4d49b2191592
-
SHA256
435a2c3b87a6d4e96690d2aae112660823dc52740222c85a80e5f01e9910ee92
-
SHA512
d83341bf784bed732bf120299824ea066f66f505b6dd0fb0b84396af34877a1ba0c483c805835179be2463dd34503b31260035e78f47ca1396305f60f2be50ed
-
SSDEEP
6144:xloZM+rIkd8g+EtXHkv/iD4LmfzMOsTPkPFQu//OPub8e1mt6i:DoZtL+EP8LwzMOsTPkPFQu//OKO/
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2436-1-0x0000000000E90000-0x0000000000ED0000-memory.dmp family_umbral -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2628 powershell.exe 2780 powershell.exe 2600 powershell.exe 2252 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Delta hack pc.exe -
Deletes itself 1 IoCs
pid Process 2832 cmd.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 discord.com 10 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2832 cmd.exe 2120 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1736 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2120 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2436 Delta hack pc.exe 2628 powershell.exe 2780 powershell.exe 2600 powershell.exe 2320 powershell.exe 2252 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2436 Delta hack pc.exe Token: SeIncreaseQuotaPrivilege 1732 wmic.exe Token: SeSecurityPrivilege 1732 wmic.exe Token: SeTakeOwnershipPrivilege 1732 wmic.exe Token: SeLoadDriverPrivilege 1732 wmic.exe Token: SeSystemProfilePrivilege 1732 wmic.exe Token: SeSystemtimePrivilege 1732 wmic.exe Token: SeProfSingleProcessPrivilege 1732 wmic.exe Token: SeIncBasePriorityPrivilege 1732 wmic.exe Token: SeCreatePagefilePrivilege 1732 wmic.exe Token: SeBackupPrivilege 1732 wmic.exe Token: SeRestorePrivilege 1732 wmic.exe Token: SeShutdownPrivilege 1732 wmic.exe Token: SeDebugPrivilege 1732 wmic.exe Token: SeSystemEnvironmentPrivilege 1732 wmic.exe Token: SeRemoteShutdownPrivilege 1732 wmic.exe Token: SeUndockPrivilege 1732 wmic.exe Token: SeManageVolumePrivilege 1732 wmic.exe Token: 33 1732 wmic.exe Token: 34 1732 wmic.exe Token: 35 1732 wmic.exe Token: SeIncreaseQuotaPrivilege 1732 wmic.exe Token: SeSecurityPrivilege 1732 wmic.exe Token: SeTakeOwnershipPrivilege 1732 wmic.exe Token: SeLoadDriverPrivilege 1732 wmic.exe Token: SeSystemProfilePrivilege 1732 wmic.exe Token: SeSystemtimePrivilege 1732 wmic.exe Token: SeProfSingleProcessPrivilege 1732 wmic.exe Token: SeIncBasePriorityPrivilege 1732 wmic.exe Token: SeCreatePagefilePrivilege 1732 wmic.exe Token: SeBackupPrivilege 1732 wmic.exe Token: SeRestorePrivilege 1732 wmic.exe Token: SeShutdownPrivilege 1732 wmic.exe Token: SeDebugPrivilege 1732 wmic.exe Token: SeSystemEnvironmentPrivilege 1732 wmic.exe Token: SeRemoteShutdownPrivilege 1732 wmic.exe Token: SeUndockPrivilege 1732 wmic.exe Token: SeManageVolumePrivilege 1732 wmic.exe Token: 33 1732 wmic.exe Token: 34 1732 wmic.exe Token: 35 1732 wmic.exe Token: SeDebugPrivilege 2628 powershell.exe Token: SeDebugPrivilege 2780 powershell.exe Token: SeDebugPrivilege 2600 powershell.exe Token: SeDebugPrivilege 2320 powershell.exe Token: SeIncreaseQuotaPrivilege 1228 wmic.exe Token: SeSecurityPrivilege 1228 wmic.exe Token: SeTakeOwnershipPrivilege 1228 wmic.exe Token: SeLoadDriverPrivilege 1228 wmic.exe Token: SeSystemProfilePrivilege 1228 wmic.exe Token: SeSystemtimePrivilege 1228 wmic.exe Token: SeProfSingleProcessPrivilege 1228 wmic.exe Token: SeIncBasePriorityPrivilege 1228 wmic.exe Token: SeCreatePagefilePrivilege 1228 wmic.exe Token: SeBackupPrivilege 1228 wmic.exe Token: SeRestorePrivilege 1228 wmic.exe Token: SeShutdownPrivilege 1228 wmic.exe Token: SeDebugPrivilege 1228 wmic.exe Token: SeSystemEnvironmentPrivilege 1228 wmic.exe Token: SeRemoteShutdownPrivilege 1228 wmic.exe Token: SeUndockPrivilege 1228 wmic.exe Token: SeManageVolumePrivilege 1228 wmic.exe Token: 33 1228 wmic.exe Token: 34 1228 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2436 wrote to memory of 1732 2436 Delta hack pc.exe 31 PID 2436 wrote to memory of 1732 2436 Delta hack pc.exe 31 PID 2436 wrote to memory of 1732 2436 Delta hack pc.exe 31 PID 2436 wrote to memory of 3036 2436 Delta hack pc.exe 34 PID 2436 wrote to memory of 3036 2436 Delta hack pc.exe 34 PID 2436 wrote to memory of 3036 2436 Delta hack pc.exe 34 PID 2436 wrote to memory of 2628 2436 Delta hack pc.exe 36 PID 2436 wrote to memory of 2628 2436 Delta hack pc.exe 36 PID 2436 wrote to memory of 2628 2436 Delta hack pc.exe 36 PID 2436 wrote to memory of 2780 2436 Delta hack pc.exe 38 PID 2436 wrote to memory of 2780 2436 Delta hack pc.exe 38 PID 2436 wrote to memory of 2780 2436 Delta hack pc.exe 38 PID 2436 wrote to memory of 2600 2436 Delta hack pc.exe 40 PID 2436 wrote to memory of 2600 2436 Delta hack pc.exe 40 PID 2436 wrote to memory of 2600 2436 Delta hack pc.exe 40 PID 2436 wrote to memory of 2320 2436 Delta hack pc.exe 42 PID 2436 wrote to memory of 2320 2436 Delta hack pc.exe 42 PID 2436 wrote to memory of 2320 2436 Delta hack pc.exe 42 PID 2436 wrote to memory of 1228 2436 Delta hack pc.exe 44 PID 2436 wrote to memory of 1228 2436 Delta hack pc.exe 44 PID 2436 wrote to memory of 1228 2436 Delta hack pc.exe 44 PID 2436 wrote to memory of 2000 2436 Delta hack pc.exe 46 PID 2436 wrote to memory of 2000 2436 Delta hack pc.exe 46 PID 2436 wrote to memory of 2000 2436 Delta hack pc.exe 46 PID 2436 wrote to memory of 1568 2436 Delta hack pc.exe 48 PID 2436 wrote to memory of 1568 2436 Delta hack pc.exe 48 PID 2436 wrote to memory of 1568 2436 Delta hack pc.exe 48 PID 2436 wrote to memory of 2252 2436 Delta hack pc.exe 50 PID 2436 wrote to memory of 2252 2436 Delta hack pc.exe 50 PID 2436 wrote to memory of 2252 2436 Delta hack pc.exe 50 PID 2436 wrote to memory of 1736 2436 Delta hack pc.exe 52 PID 2436 wrote to memory of 1736 2436 Delta hack pc.exe 52 PID 2436 wrote to memory of 1736 2436 Delta hack pc.exe 52 PID 2436 wrote to memory of 2832 2436 Delta hack pc.exe 54 PID 2436 wrote to memory of 2832 2436 Delta hack pc.exe 54 PID 2436 wrote to memory of 2832 2436 Delta hack pc.exe 54 PID 2832 wrote to memory of 2120 2832 cmd.exe 56 PID 2832 wrote to memory of 2120 2832 cmd.exe 56 PID 2832 wrote to memory of 2120 2832 cmd.exe 56 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3036 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Delta hack pc.exe"C:\Users\Admin\AppData\Local\Temp\Delta hack pc.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2436 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1732
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Delta hack pc.exe"2⤵
- Views/modifies file attributes
PID:3036
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Delta hack pc.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2628
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2780
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2600
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2320
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1228
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:2000
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1568
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2252
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1736
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Delta hack pc.exe" && pause2⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2120
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD57965ff7d46bb27aa4a1c13ded015d68d
SHA1f70884fb5506eed3e71b0527844741d6bb69da38
SHA2565857a581950464f8877c70fede9c25d2134662385672ef1b76979a1f39a7db19
SHA5129850dcbe074212b9eccaea6a5b0dfaee1e2e7c37fe8f663c5290b48b83d46b3fdf95f1e5e2e0910ed0f1d9b16e38f20521eb807701f4e139bf60b30e350b0acb