Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
9s -
max time network
7s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
02/02/2025, 20:45
General
-
Target
CrypticBootstrapper.exe
-
Size
229KB
-
MD5
756d710e520f1d3ec62b72cf4174718e
-
SHA1
956450b12e01a5edbecb995d2d284fc3f22f933d
-
SHA256
c2ca7672dcc37f2d7d1d0a9ebbdd714b54558b3159033a60314599060b69b23e
-
SHA512
2572e520eac2e4aca7898d944be108f6b6f3b0eb0ccdc895fa6d4071122832d1c5f72c63ee7c9f9b44e89d8b456af17ef4c5042e4f45ac91bd428ba24f781187
-
SSDEEP
6144:FloZM+rIkd8g+EtXHkv/iD4oJCllTwk7viTlwsJeImlC8e1mUGDi:HoZtL+EP8aCllTwk7viTlwsJ0C0O
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/2248-1-0x000001E8C4ED0000-0x000001E8C4F10000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 3856 powershell.exe 2464 powershell.exe 3516 powershell.exe 3616 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts CrypticBootstrapper.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 4 discord.com 6 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 3436 cmd.exe 792 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2136 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 792 PING.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 2248 CrypticBootstrapper.exe 3856 powershell.exe 3856 powershell.exe 2464 powershell.exe 2464 powershell.exe 3516 powershell.exe 3516 powershell.exe 2160 powershell.exe 2160 powershell.exe 3616 powershell.exe 3616 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2248 CrypticBootstrapper.exe Token: SeIncreaseQuotaPrivilege 3636 wmic.exe Token: SeSecurityPrivilege 3636 wmic.exe Token: SeTakeOwnershipPrivilege 3636 wmic.exe Token: SeLoadDriverPrivilege 3636 wmic.exe Token: SeSystemProfilePrivilege 3636 wmic.exe Token: SeSystemtimePrivilege 3636 wmic.exe Token: SeProfSingleProcessPrivilege 3636 wmic.exe Token: SeIncBasePriorityPrivilege 3636 wmic.exe Token: SeCreatePagefilePrivilege 3636 wmic.exe Token: SeBackupPrivilege 3636 wmic.exe Token: SeRestorePrivilege 3636 wmic.exe Token: SeShutdownPrivilege 3636 wmic.exe Token: SeDebugPrivilege 3636 wmic.exe Token: SeSystemEnvironmentPrivilege 3636 wmic.exe Token: SeRemoteShutdownPrivilege 3636 wmic.exe Token: SeUndockPrivilege 3636 wmic.exe Token: SeManageVolumePrivilege 3636 wmic.exe Token: 33 3636 wmic.exe Token: 34 3636 wmic.exe Token: 35 3636 wmic.exe Token: 36 3636 wmic.exe Token: SeIncreaseQuotaPrivilege 3636 wmic.exe Token: SeSecurityPrivilege 3636 wmic.exe Token: SeTakeOwnershipPrivilege 3636 wmic.exe Token: SeLoadDriverPrivilege 3636 wmic.exe Token: SeSystemProfilePrivilege 3636 wmic.exe Token: SeSystemtimePrivilege 3636 wmic.exe Token: SeProfSingleProcessPrivilege 3636 wmic.exe Token: SeIncBasePriorityPrivilege 3636 wmic.exe Token: SeCreatePagefilePrivilege 3636 wmic.exe Token: SeBackupPrivilege 3636 wmic.exe Token: SeRestorePrivilege 3636 wmic.exe Token: SeShutdownPrivilege 3636 wmic.exe Token: SeDebugPrivilege 3636 wmic.exe Token: SeSystemEnvironmentPrivilege 3636 wmic.exe Token: SeRemoteShutdownPrivilege 3636 wmic.exe Token: SeUndockPrivilege 3636 wmic.exe Token: SeManageVolumePrivilege 3636 wmic.exe Token: 33 3636 wmic.exe Token: 34 3636 wmic.exe Token: 35 3636 wmic.exe Token: 36 3636 wmic.exe Token: SeDebugPrivilege 3856 powershell.exe Token: SeDebugPrivilege 2464 powershell.exe Token: SeDebugPrivilege 3516 powershell.exe Token: SeDebugPrivilege 2160 powershell.exe Token: SeIncreaseQuotaPrivilege 4668 wmic.exe Token: SeSecurityPrivilege 4668 wmic.exe Token: SeTakeOwnershipPrivilege 4668 wmic.exe Token: SeLoadDriverPrivilege 4668 wmic.exe Token: SeSystemProfilePrivilege 4668 wmic.exe Token: SeSystemtimePrivilege 4668 wmic.exe Token: SeProfSingleProcessPrivilege 4668 wmic.exe Token: SeIncBasePriorityPrivilege 4668 wmic.exe Token: SeCreatePagefilePrivilege 4668 wmic.exe Token: SeBackupPrivilege 4668 wmic.exe Token: SeRestorePrivilege 4668 wmic.exe Token: SeShutdownPrivilege 4668 wmic.exe Token: SeDebugPrivilege 4668 wmic.exe Token: SeSystemEnvironmentPrivilege 4668 wmic.exe Token: SeRemoteShutdownPrivilege 4668 wmic.exe Token: SeUndockPrivilege 4668 wmic.exe Token: SeManageVolumePrivilege 4668 wmic.exe -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 2248 wrote to memory of 3636 2248 CrypticBootstrapper.exe 77 PID 2248 wrote to memory of 3636 2248 CrypticBootstrapper.exe 77 PID 2248 wrote to memory of 2848 2248 CrypticBootstrapper.exe 80 PID 2248 wrote to memory of 2848 2248 CrypticBootstrapper.exe 80 PID 2248 wrote to memory of 3856 2248 CrypticBootstrapper.exe 82 PID 2248 wrote to memory of 3856 2248 CrypticBootstrapper.exe 82 PID 2248 wrote to memory of 2464 2248 CrypticBootstrapper.exe 84 PID 2248 wrote to memory of 2464 2248 CrypticBootstrapper.exe 84 PID 2248 wrote to memory of 3516 2248 CrypticBootstrapper.exe 86 PID 2248 wrote to memory of 3516 2248 CrypticBootstrapper.exe 86 PID 2248 wrote to memory of 2160 2248 CrypticBootstrapper.exe 88 PID 2248 wrote to memory of 2160 2248 CrypticBootstrapper.exe 88 PID 2248 wrote to memory of 4668 2248 CrypticBootstrapper.exe 90 PID 2248 wrote to memory of 4668 2248 CrypticBootstrapper.exe 90 PID 2248 wrote to memory of 720 2248 CrypticBootstrapper.exe 92 PID 2248 wrote to memory of 720 2248 CrypticBootstrapper.exe 92 PID 2248 wrote to memory of 3828 2248 CrypticBootstrapper.exe 94 PID 2248 wrote to memory of 3828 2248 CrypticBootstrapper.exe 94 PID 2248 wrote to memory of 3616 2248 CrypticBootstrapper.exe 96 PID 2248 wrote to memory of 3616 2248 CrypticBootstrapper.exe 96 PID 2248 wrote to memory of 2136 2248 CrypticBootstrapper.exe 98 PID 2248 wrote to memory of 2136 2248 CrypticBootstrapper.exe 98 PID 2248 wrote to memory of 3436 2248 CrypticBootstrapper.exe 100 PID 2248 wrote to memory of 3436 2248 CrypticBootstrapper.exe 100 PID 3436 wrote to memory of 792 3436 cmd.exe 102 PID 3436 wrote to memory of 792 3436 cmd.exe 102 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 2848 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\CrypticBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\CrypticBootstrapper.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3636
-
-
C:\Windows\SYSTEM32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\CrypticBootstrapper.exe"2⤵
- Views/modifies file attributes
PID:2848
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CrypticBootstrapper.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3516
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2160
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4668
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:720
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:3828
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:3616
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2136
-
-
C:\Windows\SYSTEM32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\CrypticBootstrapper.exe" && pause2⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:792
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
Filesize
944B
MD57d760ca2472bcb9fe9310090d91318ce
SHA1cb316b8560b38ea16a17626e685d5a501cd31c4a
SHA2565c362b53c4a4578d8b57c51e1eac15f7f3b2447e43e0dad5102ecd003d5b41d4
SHA512141e8661d7348ebbc1f74f828df956a0c6e4cdb70f3b9d52623c9a30993bfd91da9ed7d8d284b84f173d3e6f47c876fb4a8295110895f44d97fd6cc4c5659c35
-
Filesize
948B
MD5fa21dd50b4e64421076f843031c8ccf7
SHA12c56e94f130c0d8d77116e939ffee4e37cf982bd
SHA256e4f21aca1e12aafa8de7af24b79a75526e902c7d4b3fea5bdb6e723976997be3
SHA512b8de2bfeb7af06c587dd1f424d410cf83471f31a55a3ea4c4481ce07ffd9bf66ddc1f7775ecd6ac65ac33baaec90ba5a208a9aefc84f31125a50dfb919982687
-
Filesize
1KB
MD57332074ae2b01262736b6fbd9e100dac
SHA122f992165065107cc9417fa4117240d84414a13c
SHA256baea84fda6c1f13090b8cbd91c920848946f10ce155ef31a1df4cd453ee7e4aa
SHA5124ae6f0e012c31ac1fc2ff4a8877ce2b4667c45b6e651de798318a39a2b6fd39a6f72dffa8b0b89b7a045a27d724d195656faa25a9fec79b22f37ddebb5d22da2
-
Filesize
1KB
MD5b95bea0e645f6de57d24b86919c5043d
SHA1a618ae57d56da493177bfd7510e1507dce6382a7
SHA2564d63dbe6465121136a77767bde1ddf6eeff1ce7c792272b9e6dd1732e6a49b1e
SHA51273b28e62b6ff9eb38f495b3bb1a64812d0800a949b88b32516e3386e70a8ad4127245aa0bf07345950b3b357fc7e54a563ab5f9543e49245b0ec81656f60f0fc
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82