Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
15s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
08/01/2025, 23:08
Behavioral task
behavioral1
Sample
2.exe
Resource
win10ltsc2021-20241211-en
General
-
Target
2.exe
-
Size
228KB
-
MD5
22c66a144f89f219d9f7bef81578dd48
-
SHA1
ad7235aadd9583fd423a5f36a5c65a6213d23fff
-
SHA256
9c1f1a7105e258fc4b5df94ba02bd41ddbe55bc82c88cd718fa5b2fac5969f00
-
SHA512
78316d05a92f3c4d9be0f18d1bbc86529961917d83cb00de36a396e96b2357564e354e9cfdc364f08d7e96bdd8602296e6df6eb0d2ea21029c7a45e116edb7a0
-
SSDEEP
6144:uloZMmrIkd8g+EtXHkv/iD4k5MTaL7j8e1myi:4oZ1L+EP8+LPW
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/396-1-0x000001F2C4CE0000-0x000001F2C4D20000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 4800 powershell.exe 3620 powershell.exe 4864 powershell.exe 1872 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 22 discord.com 21 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 4760 wmic.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
pid Process 32 wmic.exe 32 wmic.exe 32 wmic.exe 32 wmic.exe 396 2.exe 4800 powershell.exe 4800 powershell.exe 4864 powershell.exe 4864 powershell.exe 1872 powershell.exe 1872 powershell.exe 752 powershell.exe 752 powershell.exe 2564 wmic.exe 2564 wmic.exe 2564 wmic.exe 2564 wmic.exe 3780 wmic.exe 3780 wmic.exe 3780 wmic.exe 3780 wmic.exe 3684 wmic.exe 3684 wmic.exe 3684 wmic.exe 3684 wmic.exe 3620 powershell.exe 3620 powershell.exe 4760 wmic.exe 4760 wmic.exe 4760 wmic.exe 4760 wmic.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 396 2.exe Token: SeIncreaseQuotaPrivilege 32 wmic.exe Token: SeSecurityPrivilege 32 wmic.exe Token: SeTakeOwnershipPrivilege 32 wmic.exe Token: SeLoadDriverPrivilege 32 wmic.exe Token: SeSystemProfilePrivilege 32 wmic.exe Token: SeSystemtimePrivilege 32 wmic.exe Token: SeProfSingleProcessPrivilege 32 wmic.exe Token: SeIncBasePriorityPrivilege 32 wmic.exe Token: SeCreatePagefilePrivilege 32 wmic.exe Token: SeBackupPrivilege 32 wmic.exe Token: SeRestorePrivilege 32 wmic.exe Token: SeShutdownPrivilege 32 wmic.exe Token: SeDebugPrivilege 32 wmic.exe Token: SeSystemEnvironmentPrivilege 32 wmic.exe Token: SeRemoteShutdownPrivilege 32 wmic.exe Token: SeUndockPrivilege 32 wmic.exe Token: SeManageVolumePrivilege 32 wmic.exe Token: 33 32 wmic.exe Token: 34 32 wmic.exe Token: 35 32 wmic.exe Token: 36 32 wmic.exe Token: SeIncreaseQuotaPrivilege 32 wmic.exe Token: SeSecurityPrivilege 32 wmic.exe Token: SeTakeOwnershipPrivilege 32 wmic.exe Token: SeLoadDriverPrivilege 32 wmic.exe Token: SeSystemProfilePrivilege 32 wmic.exe Token: SeSystemtimePrivilege 32 wmic.exe Token: SeProfSingleProcessPrivilege 32 wmic.exe Token: SeIncBasePriorityPrivilege 32 wmic.exe Token: SeCreatePagefilePrivilege 32 wmic.exe Token: SeBackupPrivilege 32 wmic.exe Token: SeRestorePrivilege 32 wmic.exe Token: SeShutdownPrivilege 32 wmic.exe Token: SeDebugPrivilege 32 wmic.exe Token: SeSystemEnvironmentPrivilege 32 wmic.exe Token: SeRemoteShutdownPrivilege 32 wmic.exe Token: SeUndockPrivilege 32 wmic.exe Token: SeManageVolumePrivilege 32 wmic.exe Token: 33 32 wmic.exe Token: 34 32 wmic.exe Token: 35 32 wmic.exe Token: 36 32 wmic.exe Token: SeDebugPrivilege 4800 powershell.exe Token: SeIncreaseQuotaPrivilege 4800 powershell.exe Token: SeSecurityPrivilege 4800 powershell.exe Token: SeTakeOwnershipPrivilege 4800 powershell.exe Token: SeLoadDriverPrivilege 4800 powershell.exe Token: SeSystemProfilePrivilege 4800 powershell.exe Token: SeSystemtimePrivilege 4800 powershell.exe Token: SeProfSingleProcessPrivilege 4800 powershell.exe Token: SeIncBasePriorityPrivilege 4800 powershell.exe Token: SeCreatePagefilePrivilege 4800 powershell.exe Token: SeBackupPrivilege 4800 powershell.exe Token: SeRestorePrivilege 4800 powershell.exe Token: SeShutdownPrivilege 4800 powershell.exe Token: SeDebugPrivilege 4800 powershell.exe Token: SeSystemEnvironmentPrivilege 4800 powershell.exe Token: SeRemoteShutdownPrivilege 4800 powershell.exe Token: SeUndockPrivilege 4800 powershell.exe Token: SeManageVolumePrivilege 4800 powershell.exe Token: 33 4800 powershell.exe Token: 34 4800 powershell.exe Token: 35 4800 powershell.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 396 wrote to memory of 32 396 2.exe 82 PID 396 wrote to memory of 32 396 2.exe 82 PID 396 wrote to memory of 4800 396 2.exe 86 PID 396 wrote to memory of 4800 396 2.exe 86 PID 396 wrote to memory of 4864 396 2.exe 89 PID 396 wrote to memory of 4864 396 2.exe 89 PID 396 wrote to memory of 1872 396 2.exe 91 PID 396 wrote to memory of 1872 396 2.exe 91 PID 396 wrote to memory of 752 396 2.exe 93 PID 396 wrote to memory of 752 396 2.exe 93 PID 396 wrote to memory of 2564 396 2.exe 97 PID 396 wrote to memory of 2564 396 2.exe 97 PID 396 wrote to memory of 3780 396 2.exe 99 PID 396 wrote to memory of 3780 396 2.exe 99 PID 396 wrote to memory of 3684 396 2.exe 101 PID 396 wrote to memory of 3684 396 2.exe 101 PID 396 wrote to memory of 3620 396 2.exe 104 PID 396 wrote to memory of 3620 396 2.exe 104 PID 396 wrote to memory of 4760 396 2.exe 106 PID 396 wrote to memory of 4760 396 2.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:32
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1872
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
PID:752
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2564
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3780
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3684
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3620
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
- Suspicious behavior: EnumeratesProcesses
PID:4760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD53eb3833f769dd890afc295b977eab4b4
SHA1e857649b037939602c72ad003e5d3698695f436f
SHA256c485a6e2fd17c342fca60060f47d6a5655a65a412e35e001bb5bf88d96e6e485
SHA512c24bbc8f278478d43756807b8c584d4e3fb2289db468bc92986a489f74a8da386a667a758360a397e77e018e363be8912ac260072fa3e31117ad0599ac749e72
-
Filesize
1KB
MD560b3262c3163ee3d466199160b9ed07d
SHA1994ece4ea4e61de0be2fdd580f87e3415f9e1ff6
SHA256e3b30f16d41f94cba2b8a75f35c91ae7418465abfbfe5477ec0551d1952b2fdb
SHA512081d2015cb94477eb0fbc38f44b6d9b4a3204fb3ad0b7d0e146a88ab4ab9a0d475207f1adae03f4a81ccc5beb7568dc8be1249f69e32fe56efd9ee2f6ee3b1af
-
Filesize
948B
MD5c14d98cc8b2f9eacc1a1b704a0007f5b
SHA129f742fddb1bb3354fe09be677627947ed852fec
SHA2563e45b1d3376ee79767c98c41d9c6a5b8172aa1f4856ad94910af7dd15e016d9b
SHA512f0c63aa31173b2c0dd4f5dec590acab558597ed93593115c0582e31cb1fbb5ee8cf042e7f147125dfa32e96f20f54762ec6a64fe811682033df2d38e38ee671e
-
Filesize
1KB
MD58e1fdd1b66d2fee9f6a052524d4ddca5
SHA10a9d0994559d1be2eecd8b0d6960540ca627bdb6
SHA2564cc7c1b79d1b48582d4dc27ca8c31457b9bf2441deb7914399bb9e6863f18b13
SHA5125a5494b878b08e8515811ab7a3d68780dac7423f5562477d98249a8bedf7ec98567b7cd5d4c6967d6bc63f2d6d9b7da9a65e0eb29d4b955026b469b5b598d1f3
-
Filesize
1KB
MD571942225419386ac509d153f679d4a68
SHA1b2e1b1cba65e2a0b1b231a5a8b085e5b5294bbb3
SHA256bc4f5ba67c4a53622f5618f2998a6c5c422daeea4a697f393d2a6667c4ab878b
SHA5124195908338bee9870b0bbf29351b218a6e73da4d86073e148e128a0fa0269698ff1af0e1c4bc6b9ac3d2b2c4da23ead5acc6d0eb5c26a6095bf31b4491042912
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82