Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

22/12/2022, 16:55

221222-ve6jhaeg75 8

Analysis

  • max time kernel
    262s
  • max time network
    271s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    22/12/2022, 16:55

General

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of FindShellTrayWindow 52 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of SetWindowsHookEx 11 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" https://www.feetcare.co.il/.mon/[email protected]
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:900
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:900 CREDAT:275457 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:2044
      • C:\Windows\SysWOW64\msdt.exe
        -modal 459030 -skip TRUE -path C:\Windows\diagnostics\system\networking -af C:\Users\Admin\AppData\Local\Temp\NDF1076.tmp -ep NetworkDiagnosticsWeb
        3⤵
        • Suspicious use of FindShellTrayWindow
        PID:1856
  • C:\Windows\SysWOW64\sdiagnhost.exe
    C:\Windows\SysWOW64\sdiagnhost.exe -Embedding
    1⤵
      PID:820
    • C:\Windows\SysWOW64\sdiagnhost.exe
      C:\Windows\SysWOW64\sdiagnhost.exe -Embedding
      1⤵
        PID:1240
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Enumerates system info in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1436
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef70c4f50,0x7fef70c4f60,0x7fef70c4f70
          2⤵
            PID:896
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1104 /prefetch:2
            2⤵
              PID:1692
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1328 /prefetch:8
              2⤵
              • Suspicious behavior: EnumeratesProcesses
              PID:1776
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1792 /prefetch:8
              2⤵
                PID:1412
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2028 /prefetch:1
                2⤵
                  PID:960
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:1
                  2⤵
                    PID:1460
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
                    2⤵
                      PID:1324
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=1104 /prefetch:2
                      2⤵
                        PID:2232
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1000 /prefetch:1
                        2⤵
                          PID:2276
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3540 /prefetch:8
                          2⤵
                            PID:2340
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3648 /prefetch:8
                            2⤵
                              PID:2376
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3672 /prefetch:8
                              2⤵
                                PID:2412
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3556 /prefetch:8
                                2⤵
                                  PID:2420
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3960 /prefetch:8
                                  2⤵
                                    PID:2512
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3972 /prefetch:8
                                    2⤵
                                      PID:2520
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3984 /prefetch:8
                                      2⤵
                                        PID:2528
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1816 /prefetch:1
                                        2⤵
                                          PID:2724
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=540 /prefetch:1
                                          2⤵
                                            PID:2820
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2428 /prefetch:8
                                            2⤵
                                              PID:2928
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4156 /prefetch:8
                                              2⤵
                                                PID:2972
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3148 /prefetch:8
                                                2⤵
                                                  PID:3044
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1096,13720166320401217494,18032923150441161705,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:8
                                                  2⤵
                                                  • Suspicious behavior: EnumeratesProcesses
                                                  PID:2160

                                              Network

                                              MITRE ATT&CK Enterprise v6

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                                Filesize

                                                340B

                                                MD5

                                                53eaa70d4c1b94060c20df57cbf27fee

                                                SHA1

                                                9d460df79c94306bf99816428cdd8d81b7c85196

                                                SHA256

                                                1b937ef4024075320d862254ac754ecd9636a5a18c035120498baa4a434f6dc6

                                                SHA512

                                                54d1ba5a2cbac9dd7046eae10bc01dd5123e97acb2cbbbaf8fcee172e8b41ec0ed9bd444e5db09f898db36e66901e549547532e71d25938dbc9aa3152b49f60b

                                              • C:\Users\Admin\AppData\Local\Temp\NDF1076.tmp

                                                Filesize

                                                3KB

                                                MD5

                                                477616a4900a80b42d228423aea759d5

                                                SHA1

                                                b29df8ccd2962c74223611ecc3de93512a86ef73

                                                SHA256

                                                936fda8fda3f27fb1a47798cc0f58736b97a6f5d4f1652ec4590106b8b481b60

                                                SHA512

                                                ff04cfcd9e5971e03beb4661c8ad0ba398a73423cd097c74835f9dc599559995610e7eafa8cd5109c22567d44e3fa6aee7e80872632de683cb00aed4465356fd

                                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Z97KW0BE.txt

                                                Filesize

                                                606B

                                                MD5

                                                b916aa1bee0398aa570bbfe8c815aef7

                                                SHA1

                                                a78ce4292cc67363e13edfd05b109957b5a7d882

                                                SHA256

                                                62d6f28c5c98f2b8f2d674f2c0f706df0552c7668f90ee25770699c55adc3784

                                                SHA512

                                                9fd959edd401d36da915f8c38b0e6458917b67602cc7fe2a7c1c157df44375077f14a20bc8976fde1ff84c06b7e7e17b22b4938cb3b1e528b8d8e7ec5932b45f

                                              • C:\Windows\TEMP\SDIAG_6f746b85-eca6-4453-9588-e3b9e1843794\NetworkDiagnosticsTroubleshoot.ps1

                                                Filesize

                                                23KB

                                                MD5

                                                1d192ce36953dbb7dc7ee0d04c57ad8d

                                                SHA1

                                                7008e759cb47bf74a4ea4cd911de158ef00ace84

                                                SHA256

                                                935a231924ae5d4a017b0c99d4a5f3904ef280cea4b3f727d365283e26e8a756

                                                SHA512

                                                e864ac74e9425a6c7f1be2bbc87df9423408e16429cb61fa1de8875356226293aa07558b2fafdd5d0597254474204f5ba181f4e96c2bc754f1f414748f80a129

                                              • C:\Windows\TEMP\SDIAG_6f746b85-eca6-4453-9588-e3b9e1843794\StartDPSService.ps1

                                                Filesize

                                                567B

                                                MD5

                                                a660422059d953c6d681b53a6977100e

                                                SHA1

                                                0c95dd05514d062354c0eecc9ae8d437123305bb

                                                SHA256

                                                d19677234127c38a52aec23686775a8eb3f4e3a406f4a11804d97602d6c31813

                                                SHA512

                                                26f8cf9ac95ff649ecc2ed349bc6c7c3a04b188594d5c3289af8f2768ab59672bc95ffefcc83ed3ffa44edd0afeb16a4c2490e633a89fce7965843674d94b523

                                              • C:\Windows\TEMP\SDIAG_6f746b85-eca6-4453-9588-e3b9e1843794\UtilityFunctions.ps1

                                                Filesize

                                                52KB

                                                MD5

                                                2f7c3db0c268cf1cf506fe6e8aecb8a0

                                                SHA1

                                                fb35af6b329d60b0ec92e24230eafc8e12b0a9f9

                                                SHA256

                                                886a625f71e0c35e5722423ed3aa0f5bff8d120356578ab81a64de2ab73d47f3

                                                SHA512

                                                322f2b1404a59ee86c492b58d56b8a6ed6ebc9b844a8c38b7bb0b0675234a3d5cfc9f1d08c38c218070e60ce949aa5322de7a2f87f952e8e653d0ca34ff0de45

                                              • C:\Windows\TEMP\SDIAG_6f746b85-eca6-4453-9588-e3b9e1843794\UtilitySetConstants.ps1

                                                Filesize

                                                2KB

                                                MD5

                                                0c75ae5e75c3e181d13768909c8240ba

                                                SHA1

                                                288403fc4bedaacebccf4f74d3073f082ef70eb9

                                                SHA256

                                                de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f

                                                SHA512

                                                8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b

                                              • C:\Windows\TEMP\SDIAG_6f746b85-eca6-4453-9588-e3b9e1843794\en-US\LocalizationData.psd1

                                                Filesize

                                                5KB

                                                MD5

                                                dc9be0fdf9a4e01693cfb7d8a0d49054

                                                SHA1

                                                74730fd9c9bd4537fd9a353fe4eafce9fcc105e6

                                                SHA256

                                                944186cd57d6adc23a9c28fc271ed92dd56efd6f3bb7c9826f7208ea1a1db440

                                                SHA512

                                                92ad96fa6b221882a481b36ff2b7114539eb65be46ee9e3139e45b72da80aac49174155483cba6254b10fff31f0119f07cbc529b1b69c45234c7bb61766aad66

                                              • C:\Windows\TEMP\SDIAG_cf1c3ec6-4891-495d-9075-7777f8f3ea5e\NetworkDiagnosticsTroubleshoot.ps1

                                                Filesize

                                                23KB

                                                MD5

                                                1d192ce36953dbb7dc7ee0d04c57ad8d

                                                SHA1

                                                7008e759cb47bf74a4ea4cd911de158ef00ace84

                                                SHA256

                                                935a231924ae5d4a017b0c99d4a5f3904ef280cea4b3f727d365283e26e8a756

                                                SHA512

                                                e864ac74e9425a6c7f1be2bbc87df9423408e16429cb61fa1de8875356226293aa07558b2fafdd5d0597254474204f5ba181f4e96c2bc754f1f414748f80a129

                                              • C:\Windows\TEMP\SDIAG_cf1c3ec6-4891-495d-9075-7777f8f3ea5e\UtilityFunctions.ps1

                                                Filesize

                                                52KB

                                                MD5

                                                2f7c3db0c268cf1cf506fe6e8aecb8a0

                                                SHA1

                                                fb35af6b329d60b0ec92e24230eafc8e12b0a9f9

                                                SHA256

                                                886a625f71e0c35e5722423ed3aa0f5bff8d120356578ab81a64de2ab73d47f3

                                                SHA512

                                                322f2b1404a59ee86c492b58d56b8a6ed6ebc9b844a8c38b7bb0b0675234a3d5cfc9f1d08c38c218070e60ce949aa5322de7a2f87f952e8e653d0ca34ff0de45

                                              • C:\Windows\TEMP\SDIAG_cf1c3ec6-4891-495d-9075-7777f8f3ea5e\UtilitySetConstants.ps1

                                                Filesize

                                                2KB

                                                MD5

                                                0c75ae5e75c3e181d13768909c8240ba

                                                SHA1

                                                288403fc4bedaacebccf4f74d3073f082ef70eb9

                                                SHA256

                                                de5c231c645d3ae1e13694284997721509f5de64ee5c96c966cdfda9e294db3f

                                                SHA512

                                                8fc944515f41a837c61a6c4e5181ca273607a89e48fbf86cf8eb8db837aed095aa04fc3043029c3b5cb3710d59abfd86f086ac198200f634bfb1a5dd0823406b

                                              • C:\Windows\TEMP\SDIAG_cf1c3ec6-4891-495d-9075-7777f8f3ea5e\en-US\LocalizationData.psd1

                                                Filesize

                                                5KB

                                                MD5

                                                dc9be0fdf9a4e01693cfb7d8a0d49054

                                                SHA1

                                                74730fd9c9bd4537fd9a353fe4eafce9fcc105e6

                                                SHA256

                                                944186cd57d6adc23a9c28fc271ed92dd56efd6f3bb7c9826f7208ea1a1db440

                                                SHA512

                                                92ad96fa6b221882a481b36ff2b7114539eb65be46ee9e3139e45b72da80aac49174155483cba6254b10fff31f0119f07cbc529b1b69c45234c7bb61766aad66

                                              • memory/820-73-0x00000000701E0000-0x000000007078B000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/820-59-0x00000000701E0000-0x000000007078B000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/1240-71-0x00000000701E0000-0x000000007078B000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/1240-72-0x00000000701E0000-0x000000007078B000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/1240-74-0x00000000701E0000-0x000000007078B000-memory.dmp

                                                Filesize

                                                5.7MB

                                              • memory/1856-57-0x0000000070861000-0x0000000070863000-memory.dmp

                                                Filesize

                                                8KB

                                              • memory/1856-55-0x0000000075C61000-0x0000000075C63000-memory.dmp

                                                Filesize

                                                8KB