Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
47s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 02:35
Static task
static1
Behavioral task
behavioral1
Sample
Pokemon Red (UE) [S][!].gb
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
Pokemon Red (UE) [S][!].gb
Resource
win10v2004-20221111-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
Pokemon Red (UE) [S][!].gb
-
Size
1024KB
-
MD5
3d45c1ee9abd5738df46d2bdda8b57dc
-
SHA1
ea9bcae617fdf159b045185467ae58b2e4a48b9a
-
SHA256
5ca7ba01642a3b27b0cc0b5349b52792795b62d3ed977e98a09390659af96b7b
-
SHA512
b7dbe2563a96d78a9a5d5d434c7d02d4653ae0b81383c6bb4053e130b2d168fcb1b4225a56ff0fa7dd0047b37230e697f55bd0cac55a91eef4f3df1f2cbc06fc
-
SSDEEP
24576:5lZTSp5oytcA5/17Es8ZJQ0evUgnmPMDH:DZTSboytckFyJQlvUKmPMDH
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings rundll32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache rundll32.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1996 chrome.exe 336 chrome.exe 336 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 2124 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2124 AUDIODG.EXE Token: 33 2124 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2124 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe 336 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2024 wrote to memory of 1356 2024 cmd.exe 28 PID 2024 wrote to memory of 1356 2024 cmd.exe 28 PID 2024 wrote to memory of 1356 2024 cmd.exe 28 PID 336 wrote to memory of 1448 336 chrome.exe 30 PID 336 wrote to memory of 1448 336 chrome.exe 30 PID 336 wrote to memory of 1448 336 chrome.exe 30 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1556 336 chrome.exe 31 PID 336 wrote to memory of 1996 336 chrome.exe 32 PID 336 wrote to memory of 1996 336 chrome.exe 32 PID 336 wrote to memory of 1996 336 chrome.exe 32 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33 PID 336 wrote to memory of 1916 336 chrome.exe 33
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\Pokemon Red (UE) [S][!].gb"1⤵
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Pokemon Red (UE) [S][!].gb2⤵
- Modifies registry class
PID:1356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb6f4f50,0x7fefb6f4f60,0x7fefb6f4f702⤵PID:1448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,5881485793518537279,7441807596859897508,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1048 /prefetch:22⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1044,5881485793518537279,7441807596859897508,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1044,5881485793518537279,7441807596859897508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1856 /prefetch:82⤵PID:1916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,5881485793518537279,7441807596859897508,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:12⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,5881485793518537279,7441807596859897508,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2056 /prefetch:12⤵PID:1712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,5881485793518537279,7441807596859897508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:82⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1044,5881485793518537279,7441807596859897508,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3292 /prefetch:22⤵PID:1904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1044,5881485793518537279,7441807596859897508,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:12⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,5881485793518537279,7441807596859897508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3684 /prefetch:82⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1044,5881485793518537279,7441807596859897508,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3772 /prefetch:82⤵PID:2204
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:676
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4f41⤵
- Suspicious use of AdjustPrivilegeToken
PID:2124