Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/01/2023, 11:34
Static task
static1
Behavioral task
behavioral1
Sample
VM Accord, ORDER TKHA-A88160011B.pdf.exe
Resource
win7-20220812-en
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
VM Accord, ORDER TKHA-A88160011B.pdf.exe
Resource
win10v2004-20220812-en
14 signatures
150 seconds
General
-
Target
VM Accord, ORDER TKHA-A88160011B.pdf.exe
-
Size
656KB
-
MD5
b28145a63f56be1abd2d877f24bfa33d
-
SHA1
4b9d8c09a697fb754c28dbba40ef87f92c6099e5
-
SHA256
62cc02ce19d0d375eeef7a8df7bd6022c83e64ad8492828dc388f16337755db8
-
SHA512
6b92546ba5f14d474cdcce8524c5a6edd60d21c148bac270783ef0f3a6522b54bc12f2ebec15f418ae798911432423c0cd0056271756aec550425ef98d36c6a1
-
SSDEEP
12288:7Yi7P+FnCNFFJCztddLCywGt9udV9g1GWtag2ZMNHpWeh3ih9HfA:chlCNUztdxC2eraAguEBYT4
Score
6/10
Malware Config
Signatures
-
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1916 set thread context of 2312 1916 VM Accord, ORDER TKHA-A88160011B.pdf.exe 42 -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1488 chrome.exe 1420 chrome.exe 1420 chrome.exe 2636 chrome.exe 2708 chrome.exe 1420 chrome.exe 1420 chrome.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2312 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe 1420 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1420 wrote to memory of 1552 1420 chrome.exe 29 PID 1420 wrote to memory of 1552 1420 chrome.exe 29 PID 1420 wrote to memory of 1552 1420 chrome.exe 29 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 568 1420 chrome.exe 30 PID 1420 wrote to memory of 1488 1420 chrome.exe 31 PID 1420 wrote to memory of 1488 1420 chrome.exe 31 PID 1420 wrote to memory of 1488 1420 chrome.exe 31 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 PID 1420 wrote to memory of 1744 1420 chrome.exe 32 -
outlook_office_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe -
outlook_win_path 1 IoCs
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\VM Accord, ORDER TKHA-A88160011B.pdf.exe"C:\Users\Admin\AppData\Local\Temp\VM Accord, ORDER TKHA-A88160011B.pdf.exe"1⤵
- Suspicious use of SetThreadContext
PID:1916 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Accesses Microsoft Outlook profiles
- Suspicious use of AdjustPrivilegeToken
- outlook_office_path
- outlook_win_path
PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef67d4f50,0x7fef67d4f60,0x7fef67d4f702⤵PID:1552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1072 /prefetch:22⤵PID:568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1464 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1756 /prefetch:82⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:12⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2064 /prefetch:12⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2972 /prefetch:82⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3340 /prefetch:22⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:12⤵PID:1468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3548 /prefetch:82⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3652 /prefetch:82⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3564 /prefetch:82⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3544 /prefetch:82⤵PID:2208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 /prefetch:82⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3296 /prefetch:82⤵PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3172 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2636
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3824 /prefetch:82⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2584 /prefetch:82⤵PID:2792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1064,1587446737736052351,3612272697020461537,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3728 /prefetch:82⤵PID:2840
-