Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
21/01/2025, 06:17
Behavioral task
behavioral1
Sample
8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe
Resource
win7-20240903-en
General
-
Target
8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe
-
Size
231KB
-
MD5
729cf3dc131a564c3384ec6a3cf387ce
-
SHA1
3401e42954a2c5de84d2c32ab97e69db54144bd1
-
SHA256
8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27
-
SHA512
9bdf9ac4ace3dbef33adaff6db5e5a157f1f7967613c88b26e51e5c7032b20018007bbc6726812482e2dcf8c8ef8f0a62eb779efe4cf0e893f215faab70bf351
-
SSDEEP
6144:RloZM+rIkd8g+EtXHkv/iD4+Qz/jpaC93op7mGz2tb8e1moJboi:joZtL+EP8+Qz/jpaC93op7mGz6zbR
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1980-1-0x0000000000FD0000-0x0000000001010000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2676 powershell.exe 2952 powershell.exe 2572 powershell.exe 1944 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe -
Deletes itself 1 IoCs
pid Process 2964 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 discord.com 10 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2964 cmd.exe 3016 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2068 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 3016 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 2676 powershell.exe 2572 powershell.exe 1944 powershell.exe 1100 powershell.exe 2952 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe Token: SeIncreaseQuotaPrivilege 2276 wmic.exe Token: SeSecurityPrivilege 2276 wmic.exe Token: SeTakeOwnershipPrivilege 2276 wmic.exe Token: SeLoadDriverPrivilege 2276 wmic.exe Token: SeSystemProfilePrivilege 2276 wmic.exe Token: SeSystemtimePrivilege 2276 wmic.exe Token: SeProfSingleProcessPrivilege 2276 wmic.exe Token: SeIncBasePriorityPrivilege 2276 wmic.exe Token: SeCreatePagefilePrivilege 2276 wmic.exe Token: SeBackupPrivilege 2276 wmic.exe Token: SeRestorePrivilege 2276 wmic.exe Token: SeShutdownPrivilege 2276 wmic.exe Token: SeDebugPrivilege 2276 wmic.exe Token: SeSystemEnvironmentPrivilege 2276 wmic.exe Token: SeRemoteShutdownPrivilege 2276 wmic.exe Token: SeUndockPrivilege 2276 wmic.exe Token: SeManageVolumePrivilege 2276 wmic.exe Token: 33 2276 wmic.exe Token: 34 2276 wmic.exe Token: 35 2276 wmic.exe Token: SeIncreaseQuotaPrivilege 2276 wmic.exe Token: SeSecurityPrivilege 2276 wmic.exe Token: SeTakeOwnershipPrivilege 2276 wmic.exe Token: SeLoadDriverPrivilege 2276 wmic.exe Token: SeSystemProfilePrivilege 2276 wmic.exe Token: SeSystemtimePrivilege 2276 wmic.exe Token: SeProfSingleProcessPrivilege 2276 wmic.exe Token: SeIncBasePriorityPrivilege 2276 wmic.exe Token: SeCreatePagefilePrivilege 2276 wmic.exe Token: SeBackupPrivilege 2276 wmic.exe Token: SeRestorePrivilege 2276 wmic.exe Token: SeShutdownPrivilege 2276 wmic.exe Token: SeDebugPrivilege 2276 wmic.exe Token: SeSystemEnvironmentPrivilege 2276 wmic.exe Token: SeRemoteShutdownPrivilege 2276 wmic.exe Token: SeUndockPrivilege 2276 wmic.exe Token: SeManageVolumePrivilege 2276 wmic.exe Token: 33 2276 wmic.exe Token: 34 2276 wmic.exe Token: 35 2276 wmic.exe Token: SeDebugPrivilege 2676 powershell.exe Token: SeDebugPrivilege 2572 powershell.exe Token: SeDebugPrivilege 1944 powershell.exe Token: SeDebugPrivilege 1100 powershell.exe Token: SeIncreaseQuotaPrivilege 1784 wmic.exe Token: SeSecurityPrivilege 1784 wmic.exe Token: SeTakeOwnershipPrivilege 1784 wmic.exe Token: SeLoadDriverPrivilege 1784 wmic.exe Token: SeSystemProfilePrivilege 1784 wmic.exe Token: SeSystemtimePrivilege 1784 wmic.exe Token: SeProfSingleProcessPrivilege 1784 wmic.exe Token: SeIncBasePriorityPrivilege 1784 wmic.exe Token: SeCreatePagefilePrivilege 1784 wmic.exe Token: SeBackupPrivilege 1784 wmic.exe Token: SeRestorePrivilege 1784 wmic.exe Token: SeShutdownPrivilege 1784 wmic.exe Token: SeDebugPrivilege 1784 wmic.exe Token: SeSystemEnvironmentPrivilege 1784 wmic.exe Token: SeRemoteShutdownPrivilege 1784 wmic.exe Token: SeUndockPrivilege 1784 wmic.exe Token: SeManageVolumePrivilege 1784 wmic.exe Token: 33 1784 wmic.exe Token: 34 1784 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1980 wrote to memory of 2276 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 31 PID 1980 wrote to memory of 2276 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 31 PID 1980 wrote to memory of 2276 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 31 PID 1980 wrote to memory of 2864 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 34 PID 1980 wrote to memory of 2864 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 34 PID 1980 wrote to memory of 2864 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 34 PID 1980 wrote to memory of 2676 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 36 PID 1980 wrote to memory of 2676 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 36 PID 1980 wrote to memory of 2676 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 36 PID 1980 wrote to memory of 2572 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 38 PID 1980 wrote to memory of 2572 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 38 PID 1980 wrote to memory of 2572 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 38 PID 1980 wrote to memory of 1944 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 40 PID 1980 wrote to memory of 1944 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 40 PID 1980 wrote to memory of 1944 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 40 PID 1980 wrote to memory of 1100 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 42 PID 1980 wrote to memory of 1100 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 42 PID 1980 wrote to memory of 1100 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 42 PID 1980 wrote to memory of 1784 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 44 PID 1980 wrote to memory of 1784 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 44 PID 1980 wrote to memory of 1784 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 44 PID 1980 wrote to memory of 2648 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 46 PID 1980 wrote to memory of 2648 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 46 PID 1980 wrote to memory of 2648 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 46 PID 1980 wrote to memory of 348 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 48 PID 1980 wrote to memory of 348 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 48 PID 1980 wrote to memory of 348 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 48 PID 1980 wrote to memory of 2952 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 50 PID 1980 wrote to memory of 2952 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 50 PID 1980 wrote to memory of 2952 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 50 PID 1980 wrote to memory of 2068 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 52 PID 1980 wrote to memory of 2068 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 52 PID 1980 wrote to memory of 2068 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 52 PID 1980 wrote to memory of 2964 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 54 PID 1980 wrote to memory of 2964 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 54 PID 1980 wrote to memory of 2964 1980 8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe 54 PID 2964 wrote to memory of 3016 2964 cmd.exe 56 PID 2964 wrote to memory of 3016 2964 cmd.exe 56 PID 2964 wrote to memory of 3016 2964 cmd.exe 56 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2864 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe"C:\Users\Admin\AppData\Local\Temp\8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2276
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe"2⤵
- Views/modifies file attributes
PID:2864
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2572
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1944
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1100
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:2648
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:348
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2952
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2068
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\8d2343458799f4942026ffb7dfd107c11a056977226f0c3905c9a55b882f2a27.exe" && pause2⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3016
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5f8aa8e26e86f881a042e4e2abc597069
SHA11633b42183d7ea14b171fbc27f4ac776bcebe3f5
SHA256bd224e45eaeacede857c87faa91278d35f29a15635252880125c6b790345aaba
SHA5129590b525352d98f9c98d2a3f65985b89eae058f5899a77344364e299433f30474ccde266f261c25793224333f167a567d45359bacf37e3afc88ddf23709761d9