Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
02/02/2025, 19:41
Behavioral task
behavioral1
Sample
sws.exe
Resource
win7-20240903-en
General
-
Target
sws.exe
-
Size
227KB
-
MD5
46fb05503b2ba89656a6b2f95e5572ad
-
SHA1
01dac03ded08fc26c42fd88c77090aa6f4cea70e
-
SHA256
c6e3deb37384306e5bc08d51469e978c001ee54cf0ad8baa59942eda2c849b6b
-
SHA512
7bf112ab9a4df51776c75bd933af3400ec909473389238e13797b61e055236cfacc02d06558061c03a542c3fda0d1575b19646029a2b09c9e45119bf699934a0
-
SSDEEP
6144:eloZM+rIkd8g+EtXHkv/iD43tny5nsAvpOXZkQlK8Zb8e1m8hEi:IoZtL+EP83tny5nsAvpOXZkQlr9
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1928-1-0x0000000000ED0000-0x0000000000F10000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2660 powershell.exe 2704 powershell.exe 2840 powershell.exe 2564 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts sws.exe -
Deletes itself 1 IoCs
pid Process 2716 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 9 discord.com 10 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2716 cmd.exe 1692 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2624 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1692 PING.EXE -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1928 sws.exe 2660 powershell.exe 2564 powershell.exe 2704 powershell.exe 2288 powershell.exe 2840 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1928 sws.exe Token: SeIncreaseQuotaPrivilege 2900 wmic.exe Token: SeSecurityPrivilege 2900 wmic.exe Token: SeTakeOwnershipPrivilege 2900 wmic.exe Token: SeLoadDriverPrivilege 2900 wmic.exe Token: SeSystemProfilePrivilege 2900 wmic.exe Token: SeSystemtimePrivilege 2900 wmic.exe Token: SeProfSingleProcessPrivilege 2900 wmic.exe Token: SeIncBasePriorityPrivilege 2900 wmic.exe Token: SeCreatePagefilePrivilege 2900 wmic.exe Token: SeBackupPrivilege 2900 wmic.exe Token: SeRestorePrivilege 2900 wmic.exe Token: SeShutdownPrivilege 2900 wmic.exe Token: SeDebugPrivilege 2900 wmic.exe Token: SeSystemEnvironmentPrivilege 2900 wmic.exe Token: SeRemoteShutdownPrivilege 2900 wmic.exe Token: SeUndockPrivilege 2900 wmic.exe Token: SeManageVolumePrivilege 2900 wmic.exe Token: 33 2900 wmic.exe Token: 34 2900 wmic.exe Token: 35 2900 wmic.exe Token: SeIncreaseQuotaPrivilege 2900 wmic.exe Token: SeSecurityPrivilege 2900 wmic.exe Token: SeTakeOwnershipPrivilege 2900 wmic.exe Token: SeLoadDriverPrivilege 2900 wmic.exe Token: SeSystemProfilePrivilege 2900 wmic.exe Token: SeSystemtimePrivilege 2900 wmic.exe Token: SeProfSingleProcessPrivilege 2900 wmic.exe Token: SeIncBasePriorityPrivilege 2900 wmic.exe Token: SeCreatePagefilePrivilege 2900 wmic.exe Token: SeBackupPrivilege 2900 wmic.exe Token: SeRestorePrivilege 2900 wmic.exe Token: SeShutdownPrivilege 2900 wmic.exe Token: SeDebugPrivilege 2900 wmic.exe Token: SeSystemEnvironmentPrivilege 2900 wmic.exe Token: SeRemoteShutdownPrivilege 2900 wmic.exe Token: SeUndockPrivilege 2900 wmic.exe Token: SeManageVolumePrivilege 2900 wmic.exe Token: 33 2900 wmic.exe Token: 34 2900 wmic.exe Token: 35 2900 wmic.exe Token: SeDebugPrivilege 2660 powershell.exe Token: SeDebugPrivilege 2564 powershell.exe Token: SeDebugPrivilege 2704 powershell.exe Token: SeDebugPrivilege 2288 powershell.exe Token: SeIncreaseQuotaPrivilege 1988 wmic.exe Token: SeSecurityPrivilege 1988 wmic.exe Token: SeTakeOwnershipPrivilege 1988 wmic.exe Token: SeLoadDriverPrivilege 1988 wmic.exe Token: SeSystemProfilePrivilege 1988 wmic.exe Token: SeSystemtimePrivilege 1988 wmic.exe Token: SeProfSingleProcessPrivilege 1988 wmic.exe Token: SeIncBasePriorityPrivilege 1988 wmic.exe Token: SeCreatePagefilePrivilege 1988 wmic.exe Token: SeBackupPrivilege 1988 wmic.exe Token: SeRestorePrivilege 1988 wmic.exe Token: SeShutdownPrivilege 1988 wmic.exe Token: SeDebugPrivilege 1988 wmic.exe Token: SeSystemEnvironmentPrivilege 1988 wmic.exe Token: SeRemoteShutdownPrivilege 1988 wmic.exe Token: SeUndockPrivilege 1988 wmic.exe Token: SeManageVolumePrivilege 1988 wmic.exe Token: 33 1988 wmic.exe Token: 34 1988 wmic.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1928 wrote to memory of 2900 1928 sws.exe 31 PID 1928 wrote to memory of 2900 1928 sws.exe 31 PID 1928 wrote to memory of 2900 1928 sws.exe 31 PID 1928 wrote to memory of 2920 1928 sws.exe 34 PID 1928 wrote to memory of 2920 1928 sws.exe 34 PID 1928 wrote to memory of 2920 1928 sws.exe 34 PID 1928 wrote to memory of 2660 1928 sws.exe 36 PID 1928 wrote to memory of 2660 1928 sws.exe 36 PID 1928 wrote to memory of 2660 1928 sws.exe 36 PID 1928 wrote to memory of 2564 1928 sws.exe 38 PID 1928 wrote to memory of 2564 1928 sws.exe 38 PID 1928 wrote to memory of 2564 1928 sws.exe 38 PID 1928 wrote to memory of 2704 1928 sws.exe 40 PID 1928 wrote to memory of 2704 1928 sws.exe 40 PID 1928 wrote to memory of 2704 1928 sws.exe 40 PID 1928 wrote to memory of 2288 1928 sws.exe 42 PID 1928 wrote to memory of 2288 1928 sws.exe 42 PID 1928 wrote to memory of 2288 1928 sws.exe 42 PID 1928 wrote to memory of 1988 1928 sws.exe 44 PID 1928 wrote to memory of 1988 1928 sws.exe 44 PID 1928 wrote to memory of 1988 1928 sws.exe 44 PID 1928 wrote to memory of 1488 1928 sws.exe 46 PID 1928 wrote to memory of 1488 1928 sws.exe 46 PID 1928 wrote to memory of 1488 1928 sws.exe 46 PID 1928 wrote to memory of 1244 1928 sws.exe 48 PID 1928 wrote to memory of 1244 1928 sws.exe 48 PID 1928 wrote to memory of 1244 1928 sws.exe 48 PID 1928 wrote to memory of 2840 1928 sws.exe 50 PID 1928 wrote to memory of 2840 1928 sws.exe 50 PID 1928 wrote to memory of 2840 1928 sws.exe 50 PID 1928 wrote to memory of 2624 1928 sws.exe 52 PID 1928 wrote to memory of 2624 1928 sws.exe 52 PID 1928 wrote to memory of 2624 1928 sws.exe 52 PID 1928 wrote to memory of 2716 1928 sws.exe 54 PID 1928 wrote to memory of 2716 1928 sws.exe 54 PID 1928 wrote to memory of 2716 1928 sws.exe 54 PID 2716 wrote to memory of 1692 2716 cmd.exe 56 PID 2716 wrote to memory of 1692 2716 cmd.exe 56 PID 2716 wrote to memory of 1692 2716 cmd.exe 56 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2920 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\sws.exe"C:\Users\Admin\AppData\Local\Temp\sws.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2900
-
-
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\sws.exe"2⤵
- Views/modifies file attributes
PID:2920
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sws.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2660
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2564
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2288
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1988
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:1488
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:1244
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2840
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2624
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\sws.exe" && pause2⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:1692
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5d3fd7c458b25634b9baea08616bc53fa
SHA17e80060f257f273a390e669c49b11fc3ccf90621
SHA25612dd7a42c2757d3659fc4a76187390f624d91d48fcb9bdc56af1af307cc1457e
SHA5128cfd542b4a924527bf0d0fd40dab3716130c9914520e55062f1b0baaf5b02e356b3775bacc075facb1822d7775a5ca2956adc2574765375b8177a741bba5213c