Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2022, 02:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bitbucket.org/newsofter/toolsforpc/downloads/BDefender.zip
Resource
win10v2004-20220901-en
9 signatures
150 seconds
General
-
Target
https://bitbucket.org/newsofter/toolsforpc/downloads/BDefender.zip
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 4320 chrome.exe 4320 chrome.exe 1584 chrome.exe 1584 chrome.exe 3268 chrome.exe 3268 chrome.exe 4912 chrome.exe 4912 chrome.exe 1064 chrome.exe 1064 chrome.exe 3968 chrome.exe 3968 chrome.exe 4912 chrome.exe 4912 chrome.exe 3064 chrome.exe 3064 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeRestorePrivilege 4672 7zG.exe Token: 35 4672 7zG.exe Token: SeSecurityPrivilege 4672 7zG.exe Token: SeSecurityPrivilege 4672 7zG.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 4672 7zG.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe 1584 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1584 wrote to memory of 2104 1584 chrome.exe 85 PID 1584 wrote to memory of 2104 1584 chrome.exe 85 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 1680 1584 chrome.exe 88 PID 1584 wrote to memory of 4320 1584 chrome.exe 89 PID 1584 wrote to memory of 4320 1584 chrome.exe 89 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90 PID 1584 wrote to memory of 2440 1584 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://bitbucket.org/newsofter/toolsforpc/downloads/BDefender.zip1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf0ad4f50,0x7ffcf0ad4f60,0x7ffcf0ad4f702⤵PID:2104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1636 /prefetch:22⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=2032 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2364 /prefetch:82⤵PID:2440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:12⤵PID:4256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3084 /prefetch:12⤵PID:3796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4332 /prefetch:82⤵PID:4484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5524 /prefetch:82⤵PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5580 /prefetch:82⤵PID:2284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5600 /prefetch:82⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5436 /prefetch:82⤵PID:2548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:12⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4424 /prefetch:82⤵PID:456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1620,8529022660533016195,3133463319312907710,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1584 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3064
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:3508
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1352
-
C:\Program Files\7-Zip\7zG.exe"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap27359:80:7zEvent267221⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4672
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54.0MB
MD5e69053325095fb8ae425532cf31b85c7
SHA124546a7af8984db7c9027507da1acf7ee5c69fd0
SHA25672aab3a8b017c9c3f72ce07e71d77c157a9a8a521ace1a75d8ad93fa98ebd3b2
SHA512a8db72e26601c810535cd60c80bcd1469d52cf5837f8a297df3d8de39c1257731de1b899b1562ca810472747bd547fcbdd0dcd2c4cbdaf3a62d515bba7287ed8