Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
03/02/2025, 17:26
General
-
Target
CrypticBootstrapper.exe
-
Size
235KB
-
MD5
6ead93b6a9556b1fb06864131b2f5593
-
SHA1
fa1b1a247aa197036c94667e9f3c0ed8d79a22bc
-
SHA256
2c00e70fba3fc1ba12f7651d73a23c1294c684c507742c754f9460ecdcdf5fc6
-
SHA512
8a388cdcb275afd74b1f7320f8d0882847ae88a949924603022e7e7c6dd855f8004166119f7f3a9aff54ff83ce0264dd25d17338071e4137e6a25a5ce2764202
-
SSDEEP
6144:rloZMLrIkd8g+EtXHkv/iD4HbmedLocDXabtIExfHb8e1mILKpi:poZ0L+EP8HbmedLocDXabtIExrfKw
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/4092-1-0x00000207F4DE0000-0x00000207F4E20000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2776 powershell.exe 3824 powershell.exe 2552 powershell.exe 4304 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts CrypticBootstrapper.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 24 discord.com 25 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 3024 wmic.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
pid Process 4092 CrypticBootstrapper.exe 2776 powershell.exe 2776 powershell.exe 3824 powershell.exe 3824 powershell.exe 2552 powershell.exe 2552 powershell.exe 1084 powershell.exe 1084 powershell.exe 4304 powershell.exe 4304 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4092 CrypticBootstrapper.exe Token: SeIncreaseQuotaPrivilege 4316 wmic.exe Token: SeSecurityPrivilege 4316 wmic.exe Token: SeTakeOwnershipPrivilege 4316 wmic.exe Token: SeLoadDriverPrivilege 4316 wmic.exe Token: SeSystemProfilePrivilege 4316 wmic.exe Token: SeSystemtimePrivilege 4316 wmic.exe Token: SeProfSingleProcessPrivilege 4316 wmic.exe Token: SeIncBasePriorityPrivilege 4316 wmic.exe Token: SeCreatePagefilePrivilege 4316 wmic.exe Token: SeBackupPrivilege 4316 wmic.exe Token: SeRestorePrivilege 4316 wmic.exe Token: SeShutdownPrivilege 4316 wmic.exe Token: SeDebugPrivilege 4316 wmic.exe Token: SeSystemEnvironmentPrivilege 4316 wmic.exe Token: SeRemoteShutdownPrivilege 4316 wmic.exe Token: SeUndockPrivilege 4316 wmic.exe Token: SeManageVolumePrivilege 4316 wmic.exe Token: 33 4316 wmic.exe Token: 34 4316 wmic.exe Token: 35 4316 wmic.exe Token: 36 4316 wmic.exe Token: SeIncreaseQuotaPrivilege 4316 wmic.exe Token: SeSecurityPrivilege 4316 wmic.exe Token: SeTakeOwnershipPrivilege 4316 wmic.exe Token: SeLoadDriverPrivilege 4316 wmic.exe Token: SeSystemProfilePrivilege 4316 wmic.exe Token: SeSystemtimePrivilege 4316 wmic.exe Token: SeProfSingleProcessPrivilege 4316 wmic.exe Token: SeIncBasePriorityPrivilege 4316 wmic.exe Token: SeCreatePagefilePrivilege 4316 wmic.exe Token: SeBackupPrivilege 4316 wmic.exe Token: SeRestorePrivilege 4316 wmic.exe Token: SeShutdownPrivilege 4316 wmic.exe Token: SeDebugPrivilege 4316 wmic.exe Token: SeSystemEnvironmentPrivilege 4316 wmic.exe Token: SeRemoteShutdownPrivilege 4316 wmic.exe Token: SeUndockPrivilege 4316 wmic.exe Token: SeManageVolumePrivilege 4316 wmic.exe Token: 33 4316 wmic.exe Token: 34 4316 wmic.exe Token: 35 4316 wmic.exe Token: 36 4316 wmic.exe Token: SeDebugPrivilege 2776 powershell.exe Token: SeDebugPrivilege 3824 powershell.exe Token: SeDebugPrivilege 2552 powershell.exe Token: SeDebugPrivilege 1084 powershell.exe Token: SeIncreaseQuotaPrivilege 3004 wmic.exe Token: SeSecurityPrivilege 3004 wmic.exe Token: SeTakeOwnershipPrivilege 3004 wmic.exe Token: SeLoadDriverPrivilege 3004 wmic.exe Token: SeSystemProfilePrivilege 3004 wmic.exe Token: SeSystemtimePrivilege 3004 wmic.exe Token: SeProfSingleProcessPrivilege 3004 wmic.exe Token: SeIncBasePriorityPrivilege 3004 wmic.exe Token: SeCreatePagefilePrivilege 3004 wmic.exe Token: SeBackupPrivilege 3004 wmic.exe Token: SeRestorePrivilege 3004 wmic.exe Token: SeShutdownPrivilege 3004 wmic.exe Token: SeDebugPrivilege 3004 wmic.exe Token: SeSystemEnvironmentPrivilege 3004 wmic.exe Token: SeRemoteShutdownPrivilege 3004 wmic.exe Token: SeUndockPrivilege 3004 wmic.exe Token: SeManageVolumePrivilege 3004 wmic.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 4092 wrote to memory of 4316 4092 CrypticBootstrapper.exe 85 PID 4092 wrote to memory of 4316 4092 CrypticBootstrapper.exe 85 PID 4092 wrote to memory of 2776 4092 CrypticBootstrapper.exe 89 PID 4092 wrote to memory of 2776 4092 CrypticBootstrapper.exe 89 PID 4092 wrote to memory of 3824 4092 CrypticBootstrapper.exe 92 PID 4092 wrote to memory of 3824 4092 CrypticBootstrapper.exe 92 PID 4092 wrote to memory of 2552 4092 CrypticBootstrapper.exe 94 PID 4092 wrote to memory of 2552 4092 CrypticBootstrapper.exe 94 PID 4092 wrote to memory of 1084 4092 CrypticBootstrapper.exe 96 PID 4092 wrote to memory of 1084 4092 CrypticBootstrapper.exe 96 PID 4092 wrote to memory of 3004 4092 CrypticBootstrapper.exe 98 PID 4092 wrote to memory of 3004 4092 CrypticBootstrapper.exe 98 PID 4092 wrote to memory of 1612 4092 CrypticBootstrapper.exe 100 PID 4092 wrote to memory of 1612 4092 CrypticBootstrapper.exe 100 PID 4092 wrote to memory of 400 4092 CrypticBootstrapper.exe 102 PID 4092 wrote to memory of 400 4092 CrypticBootstrapper.exe 102 PID 4092 wrote to memory of 4304 4092 CrypticBootstrapper.exe 104 PID 4092 wrote to memory of 4304 4092 CrypticBootstrapper.exe 104 PID 4092 wrote to memory of 3024 4092 CrypticBootstrapper.exe 106 PID 4092 wrote to memory of 3024 4092 CrypticBootstrapper.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\CrypticBootstrapper.exe"C:\Users\Admin\AppData\Local\Temp\CrypticBootstrapper.exe"1⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4092 -
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4316
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\CrypticBootstrapper.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3824
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2552
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1084
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3004
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵PID:1612
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:400
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:4304
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:3024
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d85ba6ff808d9e5444a4b369f5bc2730
SHA131aa9d96590fff6981b315e0b391b575e4c0804a
SHA25684739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
SHA5128c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
-
Filesize
944B
MD577d622bb1a5b250869a3238b9bc1402b
SHA1d47f4003c2554b9dfc4c16f22460b331886b191b
SHA256f97ff12a8abf4bf88bb6497bd2ac2da12628c8847a8ba5a9026bdbb76507cdfb
SHA512d6789b5499f23c9035375a102271e17a8a82e57d6f5312fa24242e08a83efdeb8becb7622f55c4cf1b89c7d864b445df11f4d994cf7e2f87a900535bcca12fd9
-
Filesize
948B
MD5c65738617888921a153bd9b1ef516ee7
SHA15245e71ea3c181d76320c857b639272ac9e079b1
SHA2564640ba4001fd16a593315299cbdd4988dc2c7075820687f1018aac40aca95c26
SHA5122e2a0ebd93f9d8dd07a7599054bce232683e9add9a35e77b584618040bcfd84a42545352519ec4736cc379002210b6f3ed2d905591c6925c0981b0392b495bfa
-
Filesize
1KB
MD5d3235ed022a42ec4338123ab87144afa
SHA15058608bc0deb720a585a2304a8f7cf63a50a315
SHA25610663f5a1cb0afe5578f61ebaae2aafb363544e47b48521f9c23be9e6e431b27
SHA512236761b7c68feca8bd62cba90cff0b25fac5613837aaa5d29ae823ace8b06a2057553cf7e72b11ccc59b6c289e471ca1bbac1a880aef5e2868875371a17c1abf
-
Filesize
1KB
MD52984662ba3f86d7fcf26758b5b76754d
SHA1bc2a43ffd898222ee84406313f3834f226928379
SHA256f0815f797b0c1829745dd65985f28d459688f91ceb2f3d76fed2d4309589bcde
SHA512a06251a7a14559ebf5627a3c6b03fda9ded1d4ee44991283c824ccf5011cdf67665696d2d9b23507cbb3e3b9943b9e9f79ef28d3657eb61fb99920225417ab11
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82