Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10192f0f1221...a0.exe
windows7-x64
10192f0f1221...a0.exe
windows10-2004-x64
10193e069cb0...e1.exe
windows7-x64
10193e069cb0...e1.exe
windows10-2004-x64
10196a171e0e...b9.exe
windows7-x64
10196a171e0e...b9.exe
windows10-2004-x64
10197a511efa...32.exe
windows7-x64
8197a511efa...32.exe
windows10-2004-x64
819ec0ef7b7...c4.exe
windows7-x64
1019ec0ef7b7...c4.exe
windows10-2004-x64
101a4ae15ef3...a3.exe
windows7-x64
101a4ae15ef3...a3.exe
windows10-2004-x64
101a76abc85d...f9.exe
windows7-x64
61a76abc85d...f9.exe
windows10-2004-x64
61a9cd1714a...bf.exe
windows7-x64
101a9cd1714a...bf.exe
windows10-2004-x64
101b06c73e9c...af.exe
windows7-x64
101b06c73e9c...af.exe
windows10-2004-x64
101b0acebe24...06.exe
windows7-x64
101b0acebe24...06.exe
windows10-2004-x64
101b64ed84e0...ca.exe
windows7-x64
101b64ed84e0...ca.exe
windows10-2004-x64
101b7c2cbdf7...fc.exe
windows7-x64
101b7c2cbdf7...fc.exe
windows10-2004-x64
101bb302f6b2...b3.exe
windows7-x64
101bb302f6b2...b3.exe
windows10-2004-x64
101bbf7d818b...fd.exe
windows7-x64
101bbf7d818b...fd.exe
windows10-2004-x64
101be2b92cea...ae.exe
windows7-x64
101be2b92cea...ae.exe
windows10-2004-x64
101c2345047a...a0.exe
windows7-x64
101c2345047a...a0.exe
windows10-2004-x64
10Analysis
-
max time kernel
16s -
max time network
24s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22/03/2025, 06:17
Behavioral task
behavioral1
Sample
192f0f1221e376146e725a4d23ee69a0.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral2
Sample
192f0f1221e376146e725a4d23ee69a0.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral4
Sample
193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
196a171e0e93d86ea0a2e62e57df3214202969dfdc4a3d635f228fe0a53565b9.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral6
Sample
196a171e0e93d86ea0a2e62e57df3214202969dfdc4a3d635f228fe0a53565b9.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
197a511efac9c171f1a50077e9ae4a32.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral8
Sample
197a511efac9c171f1a50077e9ae4a32.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
19ec0ef7b7ce9c5d9d5a2c9ee955a5c4.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral10
Sample
19ec0ef7b7ce9c5d9d5a2c9ee955a5c4.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
1a4ae15ef300f51f70607edc1e8e62a3.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral12
Sample
1a4ae15ef300f51f70607edc1e8e62a3.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
1a76abc85db21c92e847aa3562aab0b09c56bdce383b54b6957b78314d4429f9.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral14
Sample
1a76abc85db21c92e847aa3562aab0b09c56bdce383b54b6957b78314d4429f9.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
1a9cd1714a3e518cfd51f84f1be819bf.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral16
Sample
1a9cd1714a3e518cfd51f84f1be819bf.exe
Resource
win10v2004-20250313-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
1b06c73e9c03f55f8fe3c26f374a889e7095d080c3448d4d040db1ebf46f6aaf.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral18
Sample
1b06c73e9c03f55f8fe3c26f374a889e7095d080c3448d4d040db1ebf46f6aaf.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral20
Sample
1b0acebe24bf7a0fa1e25e0e9174184ad9827298b7ff75384049deed6e74c306.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Resource
win7-20241010-en
windows7-x64
Behavioral task
behavioral22
Sample
1b64ed84e05604e07552ae57fe9f150e3ca6c2da17c4b4e3bef01d5d023d1bca.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
1b7c2cbdf74b50ca0c081bd3404b8054bd85c6e0ab7b65f5863d2dd3d2fc9cfc.exe
Resource
win7-20240903-en
windows7-x64
Behavioral task
behavioral24
Sample
1b7c2cbdf74b50ca0c081bd3404b8054bd85c6e0ab7b65f5863d2dd3d2fc9cfc.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
1bb302f6b26022b9f405c4a06c165b236837688e94ea312a231c8f780e63d2b3.exe
Resource
win7-20250207-en
windows7-x64
Behavioral task
behavioral26
Sample
1bb302f6b26022b9f405c4a06c165b236837688e94ea312a231c8f780e63d2b3.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
1bbf7d818b40f8fa0da224e39f27829bb7d8a8bdbec66fa62cfba39cd0d6d3fd.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral28
Sample
1bbf7d818b40f8fa0da224e39f27829bb7d8a8bdbec66fa62cfba39cd0d6d3fd.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
1be2b92ceabc55905ef2d5a4d28e28f80931887ca1b7aa2557775e09402d36ae.exe
Resource
win7-20241023-en
windows7-x64
Behavioral task
behavioral30
Sample
1be2b92ceabc55905ef2d5a4d28e28f80931887ca1b7aa2557775e09402d36ae.exe
Resource
win10v2004-20250314-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
1c2345047abfb5daed017769f13254053b7c8cfe14027982065835c6a4bc9aa0.exe
Resource
win7-20250207-en
windows7-x64
General
-
Target
193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe
-
Size
229KB
-
MD5
dfaf5dade27d5e1c2d8db9f7ec2a41dc
-
SHA1
725ea0f0b95e8d4e1357845b5f85ec36e87f799f
-
SHA256
193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1
-
SHA512
bba10375b69ca847c2f0a6249fb52b46ddd441cb3406e70118b99b6ad7fcae4dc49bbad9406e14f057359e732574d5bdc0cf1de324fefa23696ac65d6962edfe
-
SSDEEP
6144:9loZMprIkd8g+EtXHkv/iD4iXptbhS6FgAxDeebVfBb8e1m3oi:foZCL+EP8iXptbhS6FgAxDeebVxa
Malware Config
Signatures
-
Detect Umbral payload 1 IoCs
resource yara_rule behavioral3/memory/108-1-0x0000000001020000-0x0000000001060000-memory.dmp family_umbral -
Umbral family
-
Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2424 powershell.exe 2888 powershell.exe 2588 powershell.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 8 discord.com 9 discord.com -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 6 ip-api.com -
Detects videocard installed 1 TTPs 1 IoCs
Uses WMIC.exe to determine videocard installed.
pid Process 2676 wmic.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2424 powershell.exe 2888 powershell.exe 2588 powershell.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe Token: SeDebugPrivilege 2424 powershell.exe Token: SeDebugPrivilege 2888 powershell.exe Token: SeIncreaseQuotaPrivilege 2704 wmic.exe Token: SeSecurityPrivilege 2704 wmic.exe Token: SeTakeOwnershipPrivilege 2704 wmic.exe Token: SeLoadDriverPrivilege 2704 wmic.exe Token: SeSystemProfilePrivilege 2704 wmic.exe Token: SeSystemtimePrivilege 2704 wmic.exe Token: SeProfSingleProcessPrivilege 2704 wmic.exe Token: SeIncBasePriorityPrivilege 2704 wmic.exe Token: SeCreatePagefilePrivilege 2704 wmic.exe Token: SeBackupPrivilege 2704 wmic.exe Token: SeRestorePrivilege 2704 wmic.exe Token: SeShutdownPrivilege 2704 wmic.exe Token: SeDebugPrivilege 2704 wmic.exe Token: SeSystemEnvironmentPrivilege 2704 wmic.exe Token: SeRemoteShutdownPrivilege 2704 wmic.exe Token: SeUndockPrivilege 2704 wmic.exe Token: SeManageVolumePrivilege 2704 wmic.exe Token: 33 2704 wmic.exe Token: 34 2704 wmic.exe Token: 35 2704 wmic.exe Token: SeIncreaseQuotaPrivilege 2704 wmic.exe Token: SeSecurityPrivilege 2704 wmic.exe Token: SeTakeOwnershipPrivilege 2704 wmic.exe Token: SeLoadDriverPrivilege 2704 wmic.exe Token: SeSystemProfilePrivilege 2704 wmic.exe Token: SeSystemtimePrivilege 2704 wmic.exe Token: SeProfSingleProcessPrivilege 2704 wmic.exe Token: SeIncBasePriorityPrivilege 2704 wmic.exe Token: SeCreatePagefilePrivilege 2704 wmic.exe Token: SeBackupPrivilege 2704 wmic.exe Token: SeRestorePrivilege 2704 wmic.exe Token: SeShutdownPrivilege 2704 wmic.exe Token: SeDebugPrivilege 2704 wmic.exe Token: SeSystemEnvironmentPrivilege 2704 wmic.exe Token: SeRemoteShutdownPrivilege 2704 wmic.exe Token: SeUndockPrivilege 2704 wmic.exe Token: SeManageVolumePrivilege 2704 wmic.exe Token: 33 2704 wmic.exe Token: 34 2704 wmic.exe Token: 35 2704 wmic.exe Token: SeIncreaseQuotaPrivilege 1644 wmic.exe Token: SeSecurityPrivilege 1644 wmic.exe Token: SeTakeOwnershipPrivilege 1644 wmic.exe Token: SeLoadDriverPrivilege 1644 wmic.exe Token: SeSystemProfilePrivilege 1644 wmic.exe Token: SeSystemtimePrivilege 1644 wmic.exe Token: SeProfSingleProcessPrivilege 1644 wmic.exe Token: SeIncBasePriorityPrivilege 1644 wmic.exe Token: SeCreatePagefilePrivilege 1644 wmic.exe Token: SeBackupPrivilege 1644 wmic.exe Token: SeRestorePrivilege 1644 wmic.exe Token: SeShutdownPrivilege 1644 wmic.exe Token: SeDebugPrivilege 1644 wmic.exe Token: SeSystemEnvironmentPrivilege 1644 wmic.exe Token: SeRemoteShutdownPrivilege 1644 wmic.exe Token: SeUndockPrivilege 1644 wmic.exe Token: SeManageVolumePrivilege 1644 wmic.exe Token: 33 1644 wmic.exe Token: 34 1644 wmic.exe Token: 35 1644 wmic.exe Token: SeIncreaseQuotaPrivilege 1644 wmic.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 108 wrote to memory of 2424 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 29 PID 108 wrote to memory of 2424 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 29 PID 108 wrote to memory of 2424 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 29 PID 108 wrote to memory of 2888 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 31 PID 108 wrote to memory of 2888 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 31 PID 108 wrote to memory of 2888 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 31 PID 108 wrote to memory of 2704 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 33 PID 108 wrote to memory of 2704 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 33 PID 108 wrote to memory of 2704 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 33 PID 108 wrote to memory of 1644 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 36 PID 108 wrote to memory of 1644 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 36 PID 108 wrote to memory of 1644 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 36 PID 108 wrote to memory of 3000 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 38 PID 108 wrote to memory of 3000 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 38 PID 108 wrote to memory of 3000 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 38 PID 108 wrote to memory of 2588 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 40 PID 108 wrote to memory of 2588 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 40 PID 108 wrote to memory of 2588 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 40 PID 108 wrote to memory of 2676 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 42 PID 108 wrote to memory of 2676 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 42 PID 108 wrote to memory of 2676 108 193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe"C:\Users\Admin\AppData\Local\Temp\193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:108 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\193e069cb0734f2f4107d4c1fbb7f3b22d8783932eaa405bb7a0e52cb86fcfe1.exe'2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2424
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 22⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2888
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" os get Caption2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2704
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" computersystem get totalphysicalmemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic.exe" csproduct get uuid2⤵PID:3000
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
PID:2588
-
-
C:\Windows\System32\Wbem\wmic.exe"wmic" path win32_VideoController get name2⤵
- Detects videocard installed
PID:2676
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize7KB
MD5e96770687ffc3c0dce62ec3838e9e016
SHA1da5d6fd725ecf9f958a67ab6259e75983814b24d
SHA256ff70c9dc86025288062a5a7a71929ebae088b7c4c00206a45d5a2bf6489dc903
SHA51205d157644c26f408901fec012a89e911dde0d0987dbb432061a2f6b1480504ffd4403482b320312513eb3d87ce04632ef9a0db746e4807f1d5cb707b984d3408