Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/01/2025, 04:44
Behavioral task
behavioral1
Sample
986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe
Resource
win7-20240903-en
General
-
Target
986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe
-
Size
227KB
-
MD5
cb2467ac4a120eb71d645447de9edb11
-
SHA1
9f51253c38be1f5b76a425d990ddc1f91052a14e
-
SHA256
986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e
-
SHA512
2a81afd3e9c0a7056d4c178bf51a3bd91af1a15f445b16f5b8405d1310e62f5908c1dde86232134e78ea4454d4fbc774d171d5de85bc1c7abfd5d748f9719393
-
SSDEEP
6144:+loZM+rIkd8g+EtXHkv/iD4m3eQzZqStAY5rWWDdcvb8e1m/i:ooZtL+EP8m3eQzZqStAY5rWWDoZ
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2156-1-0x0000000000920000-0x0000000000960000-memory.dmp family_umbral -
Umbral family
-
pid Process 1336 powershell.exe 2028 powershell.exe 2680 powershell.exe 2860 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe -
Deletes itself 1 IoCs
pid Process 2356 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 discord.com 10 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1560 PING.EXE 2356 cmd.exe -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2060 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1560 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 2860 powershell.exe 2028 powershell.exe 2680 powershell.exe 476 powershell.exe 1336 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe Token: SeIncreaseQuotaPrivilege 1284 wmic.exe Token: SeSecurityPrivilege 1284 wmic.exe Token: SeTakeOwnershipPrivilege 1284 wmic.exe Token: SeLoadDriverPrivilege 1284 wmic.exe Token: SeSystemProfilePrivilege 1284 wmic.exe Token: SeSystemtimePrivilege 1284 wmic.exe Token: SeProfSingleProcessPrivilege 1284 wmic.exe Token: SeIncBasePriorityPrivilege 1284 wmic.exe Token: SeCreatePagefilePrivilege 1284 wmic.exe Token: SeBackupPrivilege 1284 wmic.exe Token: SeRestorePrivilege 1284 wmic.exe Token: SeShutdownPrivilege 1284 wmic.exe Token: SeDebugPrivilege 1284 wmic.exe Token: SeSystemEnvironmentPrivilege 1284 wmic.exe Token: SeRemoteShutdownPrivilege 1284 wmic.exe Token: SeUndockPrivilege 1284 wmic.exe Token: SeManageVolumePrivilege 1284 wmic.exe Token: 33 1284 wmic.exe Token: 34 1284 wmic.exe Token: 35 1284 wmic.exe Token: SeIncreaseQuotaPrivilege 1284 wmic.exe Token: SeSecurityPrivilege 1284 wmic.exe Token: SeTakeOwnershipPrivilege 1284 wmic.exe Token: SeLoadDriverPrivilege 1284 wmic.exe Token: SeSystemProfilePrivilege 1284 wmic.exe Token: SeSystemtimePrivilege 1284 wmic.exe Token: SeProfSingleProcessPrivilege 1284 wmic.exe Token: SeIncBasePriorityPrivilege 1284 wmic.exe Token: SeCreatePagefilePrivilege 1284 wmic.exe Token: SeBackupPrivilege 1284 wmic.exe Token: SeRestorePrivilege 1284 wmic.exe Token: SeShutdownPrivilege 1284 wmic.exe Token: SeDebugPrivilege 1284 wmic.exe Token: SeSystemEnvironmentPrivilege 1284 wmic.exe Token: SeRemoteShutdownPrivilege 1284 wmic.exe Token: SeUndockPrivilege 1284 wmic.exe Token: SeManageVolumePrivilege 1284 wmic.exe Token: 33 1284 wmic.exe Token: 34 1284 wmic.exe Token: 35 1284 wmic.exe Token: SeDebugPrivilege 2860 powershell.exe Token: SeDebugPrivilege 2028 powershell.exe Token: SeDebugPrivilege 2680 powershell.exe Token: SeDebugPrivilege 476 powershell.exe Token: SeIncreaseQuotaPrivilege 580 wmic.exe Token: SeSecurityPrivilege 580 wmic.exe Token: SeTakeOwnershipPrivilege 580 wmic.exe Token: SeLoadDriverPrivilege 580 wmic.exe Token: SeSystemProfilePrivilege 580 wmic.exe Token: SeSystemtimePrivilege 580 wmic.exe Token: SeProfSingleProcessPrivilege 580 wmic.exe Token: SeIncBasePriorityPrivilege 580 wmic.exe Token: SeCreatePagefilePrivilege 580 wmic.exe Token: SeBackupPrivilege 580 wmic.exe Token: SeRestorePrivilege 580 wmic.exe Token: SeShutdownPrivilege 580 wmic.exe Token: SeDebugPrivilege 580 wmic.exe Token: SeSystemEnvironmentPrivilege 580 wmic.exe Token: SeRemoteShutdownPrivilege 580 wmic.exe Token: SeUndockPrivilege 580 wmic.exe Token: SeManageVolumePrivilege 580 wmic.exe Token: 33 580 wmic.exe Token: 34 580 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2156 wrote to memory of 1284 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 30 PID 2156 wrote to memory of 1284 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 30 PID 2156 wrote to memory of 1284 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 30 PID 2156 wrote to memory of 2832 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 33 PID 2156 wrote to memory of 2832 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 33 PID 2156 wrote to memory of 2832 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 33 PID 2156 wrote to memory of 2860 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 35 PID 2156 wrote to memory of 2860 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 35 PID 2156 wrote to memory of 2860 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 35 PID 2156 wrote to memory of 2028 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 37 PID 2156 wrote to memory of 2028 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 37 PID 2156 wrote to memory of 2028 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 37 PID 2156 wrote to memory of 2680 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 39 PID 2156 wrote to memory of 2680 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 39 PID 2156 wrote to memory of 2680 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 39 PID 2156 wrote to memory of 476 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 41 PID 2156 wrote to memory of 476 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 41 PID 2156 wrote to memory of 476 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 41 PID 2156 wrote to memory of 580 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 43 PID 2156 wrote to memory of 580 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 43 PID 2156 wrote to memory of 580 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 43 PID 2156 wrote to memory of 2664 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 45 PID 2156 wrote to memory of 2664 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 45 PID 2156 wrote to memory of 2664 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 45 PID 2156 wrote to memory of 272 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 47 PID 2156 wrote to memory of 272 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 47 PID 2156 wrote to memory of 272 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 47 PID 2156 wrote to memory of 1336 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 49 PID 2156 wrote to memory of 1336 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 49 PID 2156 wrote to memory of 1336 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 49 PID 2156 wrote to memory of 2060 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 51 PID 2156 wrote to memory of 2060 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 51 PID 2156 wrote to memory of 2060 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 51 PID 2156 wrote to memory of 2356 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 53 PID 2156 wrote to memory of 2356 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 53 PID 2156 wrote to memory of 2356 2156 986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe 53 PID 2356 wrote to memory of 1560 2356 cmd.exe 55 PID 2356 wrote to memory of 1560 2356 cmd.exe 55 PID 2356 wrote to memory of 1560 2356 cmd.exe 55 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2832 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe"C:\Users\Admin\AppData\Local\Temp\986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1284
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe"2⤵
- Views/modifies file attributes
PID:2832
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2860
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2028
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:476
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:580
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:2664
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:272
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1336
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2060
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\986ab78ceee3c3bec343c6b7a74cf14d2c128bf7fbfd45bddbe7ab317b2c074e.exe" && pause2⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1560
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD53aa36b62bb7429320ed91f500d1aa169
SHA1620f08c84f734e64857fbe2bc88bf772dfb35b72
SHA25630075ca94ea28298a7d7734736aff7aac5139372b79b0b63ff651e58acfad6da
SHA512bc007377629a354d6ce7ce14f65608071ea7fe5bb9dead2acbc186a008c0d2b649e1a382ada8d44c505ca85960cec8cfc47e0016211973141f6b4e1fe89ad84d