Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
6s -
max time network
8s -
platform
windows11-21h2_x64 -
resource
win11-20241023-en -
resource tags
arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system -
submitted
08/01/2025, 23:08
Behavioral task
behavioral1
Sample
2.exe
Resource
win10ltsc2021-20241211-en
General
-
Target
2.exe
-
Size
228KB
-
MD5
22c66a144f89f219d9f7bef81578dd48
-
SHA1
ad7235aadd9583fd423a5f36a5c65a6213d23fff
-
SHA256
9c1f1a7105e258fc4b5df94ba02bd41ddbe55bc82c88cd718fa5b2fac5969f00
-
SHA512
78316d05a92f3c4d9be0f18d1bbc86529961917d83cb00de36a396e96b2357564e354e9cfdc364f08d7e96bdd8602296e6df6eb0d2ea21029c7a45e116edb7a0
-
SSDEEP
6144:uloZMmrIkd8g+EtXHkv/iD4k5MTaL7j8e1myi:4oZ1L+EP8+LPW
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral2/memory/4496-1-0x000002685C200000-0x000002685C240000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3220 powershell.exe 3480 powershell.exe 3420 powershell.exe 4124 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 2.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 1 discord.com 5 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 1888 wmic.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4496 2.exe 3220 powershell.exe 3220 powershell.exe 3480 powershell.exe 3480 powershell.exe 3420 powershell.exe 3420 powershell.exe 2424 powershell.exe 2424 powershell.exe 4124 powershell.exe 4124 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4496 2.exe Token: SeIncreaseQuotaPrivilege 3392 wmic.exe Token: SeSecurityPrivilege 3392 wmic.exe Token: SeTakeOwnershipPrivilege 3392 wmic.exe Token: SeLoadDriverPrivilege 3392 wmic.exe Token: SeSystemProfilePrivilege 3392 wmic.exe Token: SeSystemtimePrivilege 3392 wmic.exe Token: SeProfSingleProcessPrivilege 3392 wmic.exe Token: SeIncBasePriorityPrivilege 3392 wmic.exe Token: SeCreatePagefilePrivilege 3392 wmic.exe Token: SeBackupPrivilege 3392 wmic.exe Token: SeRestorePrivilege 3392 wmic.exe Token: SeShutdownPrivilege 3392 wmic.exe Token: SeDebugPrivilege 3392 wmic.exe Token: SeSystemEnvironmentPrivilege 3392 wmic.exe Token: SeRemoteShutdownPrivilege 3392 wmic.exe Token: SeUndockPrivilege 3392 wmic.exe Token: SeManageVolumePrivilege 3392 wmic.exe Token: 33 3392 wmic.exe Token: 34 3392 wmic.exe Token: 35 3392 wmic.exe Token: 36 3392 wmic.exe Token: SeIncreaseQuotaPrivilege 3392 wmic.exe Token: SeSecurityPrivilege 3392 wmic.exe Token: SeTakeOwnershipPrivilege 3392 wmic.exe Token: SeLoadDriverPrivilege 3392 wmic.exe Token: SeSystemProfilePrivilege 3392 wmic.exe Token: SeSystemtimePrivilege 3392 wmic.exe Token: SeProfSingleProcessPrivilege 3392 wmic.exe Token: SeIncBasePriorityPrivilege 3392 wmic.exe Token: SeCreatePagefilePrivilege 3392 wmic.exe Token: SeBackupPrivilege 3392 wmic.exe Token: SeRestorePrivilege 3392 wmic.exe Token: SeShutdownPrivilege 3392 wmic.exe Token: SeDebugPrivilege 3392 wmic.exe Token: SeSystemEnvironmentPrivilege 3392 wmic.exe Token: SeRemoteShutdownPrivilege 3392 wmic.exe Token: SeUndockPrivilege 3392 wmic.exe Token: SeManageVolumePrivilege 3392 wmic.exe Token: 33 3392 wmic.exe Token: 34 3392 wmic.exe Token: 35 3392 wmic.exe Token: 36 3392 wmic.exe Token: SeDebugPrivilege 3220 powershell.exe Token: SeDebugPrivilege 3480 powershell.exe Token: SeDebugPrivilege 3420 powershell.exe Token: SeDebugPrivilege 2424 powershell.exe Token: SeIncreaseQuotaPrivilege 1184 wmic.exe Token: SeSecurityPrivilege 1184 wmic.exe Token: SeTakeOwnershipPrivilege 1184 wmic.exe Token: SeLoadDriverPrivilege 1184 wmic.exe Token: SeSystemProfilePrivilege 1184 wmic.exe Token: SeSystemtimePrivilege 1184 wmic.exe Token: SeProfSingleProcessPrivilege 1184 wmic.exe Token: SeIncBasePriorityPrivilege 1184 wmic.exe Token: SeCreatePagefilePrivilege 1184 wmic.exe Token: SeBackupPrivilege 1184 wmic.exe Token: SeRestorePrivilege 1184 wmic.exe Token: SeShutdownPrivilege 1184 wmic.exe Token: SeDebugPrivilege 1184 wmic.exe Token: SeSystemEnvironmentPrivilege 1184 wmic.exe Token: SeRemoteShutdownPrivilege 1184 wmic.exe Token: SeUndockPrivilege 1184 wmic.exe Token: SeManageVolumePrivilege 1184 wmic.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4496 wrote to memory of 3392 4496 2.exe 77 PID 4496 wrote to memory of 3392 4496 2.exe 77 PID 4496 wrote to memory of 3220 4496 2.exe 80 PID 4496 wrote to memory of 3220 4496 2.exe 80 PID 4496 wrote to memory of 3480 4496 2.exe 82 PID 4496 wrote to memory of 3480 4496 2.exe 82 PID 4496 wrote to memory of 3420 4496 2.exe 84 PID 4496 wrote to memory of 3420 4496 2.exe 84 PID 4496 wrote to memory of 2424 4496 2.exe 86 PID 4496 wrote to memory of 2424 4496 2.exe 86 PID 4496 wrote to memory of 1184 4496 2.exe 88 PID 4496 wrote to memory of 1184 4496 2.exe 88 PID 4496 wrote to memory of 2252 4496 2.exe 90 PID 4496 wrote to memory of 2252 4496 2.exe 90 PID 4496 wrote to memory of 1584 4496 2.exe 92 PID 4496 wrote to memory of 1584 4496 2.exe 92 PID 4496 wrote to memory of 4124 4496 2.exe 94 PID 4496 wrote to memory of 4124 4496 2.exe 94 PID 4496 wrote to memory of 1888 4496 2.exe 96 PID 4496 wrote to memory of 1888 4496 2.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\2.exe"C:\Users\Admin\AppData\Local\Temp\2.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4496 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3392
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\2.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3220
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3480
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3420
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1184
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:2252
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1584
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4124
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:1888
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD51a9fa92a4f2e2ec9e244d43a6a4f8fb9
SHA19910190edfaccece1dfcc1d92e357772f5dae8f7
SHA2560ee052d5333fd5fd86bc84856fec98e045f077a7ac8051651bf7c521b9706888
SHA5125d2361476fa22200e6f83883efe7dcb8c3fe7dae8d56e04e28a36e9ae1270c327b6aa161d92b239593da7661289d002c574446ecfd6bd19928209aae25e3ef64
-
Filesize
948B
MD56bddc96a32b9ed8fc70b141ccf4a39b2
SHA10f33c0699da40a5eadcec646791cf21cdb0dd7c6
SHA256cb3853abe77eb0da8a1caccb49e97a573b6f35570722eb759116a645d724c132
SHA512e41f1597b4129b759e4199db195df1c24e47cc47dc9850fab2d48e44bc3d37dc3658fbfbb62332a0b93c552587d7fab09de1634f605faa2209b8470c2a6eaca6
-
Filesize
1KB
MD57332074ae2b01262736b6fbd9e100dac
SHA122f992165065107cc9417fa4117240d84414a13c
SHA256baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa
SHA5124ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2
-
Filesize
1KB
MD553ef9acfc26aff9844788c061b9a82a4
SHA1694630c1928e41ce2404c5fcc47f46edf736c799
SHA2568e4d63bc44923666849081897470e38ef342d019d6f9db09bda31733723d2285
SHA5121748fd690c383716f4fb8117b25ed9b5d39ba951c80296490f01b34a51f04a2712ccb9ad827063351276e6d5c304b6e015a8a8240a4bb4baa2b3086e7e28f9d1
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82