Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/02/2025, 13:34
Behavioral task
behavioral1
Sample
Umbral1.exe
Resource
win7-20240903-en
General
-
Target
Umbral1.exe
-
Size
221KB
-
MD5
fe655b03add462121d67240f461e8787
-
SHA1
73907706fdf7922ba19a27f4b1fd315f7c107efe
-
SHA256
dccdba44701fbf3031e6a2ad016cb702c7941ca2abbc754ba60b1d0ca5396e82
-
SHA512
c00653793e37dee5b4bdc5cbd0194038928e03dfb8a3e8910c54d8c20133e163c59c36fb6989c180c3fb9e39e9a37d3544292f55fd92367749e7fa143c4c8b7b
-
SSDEEP
6144:KloZMUrIkd8g+EtXHkv/iD439sJNlK8euYi:0oZrL+EP8Na
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral1/memory/1840-1-0x0000000000A00000-0x0000000000A3E000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2856 powershell.exe 2580 powershell.exe 1712 powershell.exe 1032 powershell.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\hosts Umbral1.exe -
Deletes itself 1 IoCs
pid Process 2152 cmd.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 8 discord.com 9 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2152 cmd.exe 2068 PING.EXE -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 3032 wmic.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2068 PING.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2856 powershell.exe 2580 powershell.exe 1712 powershell.exe 1744 powershell.exe 1032 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1840 Umbral1.exe Token: SeDebugPrivilege 2856 powershell.exe Token: SeDebugPrivilege 2580 powershell.exe Token: SeDebugPrivilege 1712 powershell.exe Token: SeDebugPrivilege 1744 powershell.exe Token: SeIncreaseQuotaPrivilege 2788 wmic.exe Token: SeSecurityPrivilege 2788 wmic.exe Token: SeTakeOwnershipPrivilege 2788 wmic.exe Token: SeLoadDriverPrivilege 2788 wmic.exe Token: SeSystemProfilePrivilege 2788 wmic.exe Token: SeSystemtimePrivilege 2788 wmic.exe Token: SeProfSingleProcessPrivilege 2788 wmic.exe Token: SeIncBasePriorityPrivilege 2788 wmic.exe Token: SeCreatePagefilePrivilege 2788 wmic.exe Token: SeBackupPrivilege 2788 wmic.exe Token: SeRestorePrivilege 2788 wmic.exe Token: SeShutdownPrivilege 2788 wmic.exe Token: SeDebugPrivilege 2788 wmic.exe Token: SeSystemEnvironmentPrivilege 2788 wmic.exe Token: SeRemoteShutdownPrivilege 2788 wmic.exe Token: SeUndockPrivilege 2788 wmic.exe Token: SeManageVolumePrivilege 2788 wmic.exe Token: 33 2788 wmic.exe Token: 34 2788 wmic.exe Token: 35 2788 wmic.exe Token: SeIncreaseQuotaPrivilege 2788 wmic.exe Token: SeSecurityPrivilege 2788 wmic.exe Token: SeTakeOwnershipPrivilege 2788 wmic.exe Token: SeLoadDriverPrivilege 2788 wmic.exe Token: SeSystemProfilePrivilege 2788 wmic.exe Token: SeSystemtimePrivilege 2788 wmic.exe Token: SeProfSingleProcessPrivilege 2788 wmic.exe Token: SeIncBasePriorityPrivilege 2788 wmic.exe Token: SeCreatePagefilePrivilege 2788 wmic.exe Token: SeBackupPrivilege 2788 wmic.exe Token: SeRestorePrivilege 2788 wmic.exe Token: SeShutdownPrivilege 2788 wmic.exe Token: SeDebugPrivilege 2788 wmic.exe Token: SeSystemEnvironmentPrivilege 2788 wmic.exe Token: SeRemoteShutdownPrivilege 2788 wmic.exe Token: SeUndockPrivilege 2788 wmic.exe Token: SeManageVolumePrivilege 2788 wmic.exe Token: 33 2788 wmic.exe Token: 34 2788 wmic.exe Token: 35 2788 wmic.exe Token: SeIncreaseQuotaPrivilege 668 wmic.exe Token: SeSecurityPrivilege 668 wmic.exe Token: SeTakeOwnershipPrivilege 668 wmic.exe Token: SeLoadDriverPrivilege 668 wmic.exe Token: SeSystemProfilePrivilege 668 wmic.exe Token: SeSystemtimePrivilege 668 wmic.exe Token: SeProfSingleProcessPrivilege 668 wmic.exe Token: SeIncBasePriorityPrivilege 668 wmic.exe Token: SeCreatePagefilePrivilege 668 wmic.exe Token: SeBackupPrivilege 668 wmic.exe Token: SeRestorePrivilege 668 wmic.exe Token: SeShutdownPrivilege 668 wmic.exe Token: SeDebugPrivilege 668 wmic.exe Token: SeSystemEnvironmentPrivilege 668 wmic.exe Token: SeRemoteShutdownPrivilege 668 wmic.exe Token: SeUndockPrivilege 668 wmic.exe Token: SeManageVolumePrivilege 668 wmic.exe Token: 33 668 wmic.exe Token: 34 668 wmic.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 1840 wrote to memory of 3020 1840 Umbral1.exe 31 PID 1840 wrote to memory of 3020 1840 Umbral1.exe 31 PID 1840 wrote to memory of 3020 1840 Umbral1.exe 31 PID 1840 wrote to memory of 2856 1840 Umbral1.exe 33 PID 1840 wrote to memory of 2856 1840 Umbral1.exe 33 PID 1840 wrote to memory of 2856 1840 Umbral1.exe 33 PID 1840 wrote to memory of 2580 1840 Umbral1.exe 35 PID 1840 wrote to memory of 2580 1840 Umbral1.exe 35 PID 1840 wrote to memory of 2580 1840 Umbral1.exe 35 PID 1840 wrote to memory of 1712 1840 Umbral1.exe 37 PID 1840 wrote to memory of 1712 1840 Umbral1.exe 37 PID 1840 wrote to memory of 1712 1840 Umbral1.exe 37 PID 1840 wrote to memory of 1744 1840 Umbral1.exe 39 PID 1840 wrote to memory of 1744 1840 Umbral1.exe 39 PID 1840 wrote to memory of 1744 1840 Umbral1.exe 39 PID 1840 wrote to memory of 2788 1840 Umbral1.exe 41 PID 1840 wrote to memory of 2788 1840 Umbral1.exe 41 PID 1840 wrote to memory of 2788 1840 Umbral1.exe 41 PID 1840 wrote to memory of 668 1840 Umbral1.exe 44 PID 1840 wrote to memory of 668 1840 Umbral1.exe 44 PID 1840 wrote to memory of 668 1840 Umbral1.exe 44 PID 1840 wrote to memory of 2036 1840 Umbral1.exe 46 PID 1840 wrote to memory of 2036 1840 Umbral1.exe 46 PID 1840 wrote to memory of 2036 1840 Umbral1.exe 46 PID 1840 wrote to memory of 1032 1840 Umbral1.exe 48 PID 1840 wrote to memory of 1032 1840 Umbral1.exe 48 PID 1840 wrote to memory of 1032 1840 Umbral1.exe 48 PID 1840 wrote to memory of 3032 1840 Umbral1.exe 50 PID 1840 wrote to memory of 3032 1840 Umbral1.exe 50 PID 1840 wrote to memory of 3032 1840 Umbral1.exe 50 PID 1840 wrote to memory of 2152 1840 Umbral1.exe 52 PID 1840 wrote to memory of 2152 1840 Umbral1.exe 52 PID 1840 wrote to memory of 2152 1840 Umbral1.exe 52 PID 2152 wrote to memory of 2068 2152 cmd.exe 54 PID 2152 wrote to memory of 2068 2152 cmd.exe 54 PID 2152 wrote to memory of 2068 2152 cmd.exe 54 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3020 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Umbral1.exe"C:\Users\Admin\AppData\Local\Temp\Umbral1.exe"1⤵
- Drops file in Drivers directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\system32\attrib.exe"attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral1.exe"2⤵
- Views/modifies file attributes
PID:3020
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral1.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2856
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2580
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1712
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1744
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2788
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:668
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:2036
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:1032
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:3032
-
-
C:\Windows\system32\cmd.exe"cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral1.exe" && pause2⤵
- Deletes itself
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2152 -
C:\Windows\system32\PING.EXEping localhost3⤵
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2068
-
-
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD573ab1933589ad0eaf6cb3524ace09dd3
SHA199032347a8e3ffe1903eeb7f34a8750639b5882f
SHA256c5012a205d58f082ce759c1ba6f66ac5518ca9da2605eeeced2552739af027ab
SHA5125794f028f50d09ee336d11d313195cfc629b750596d3ec14777c294ebd25e6fa55e9a1a5ba192a286227a8588136e7f093a3f06d0691b0de2f99e9e55c5442f2