Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
55s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
08/03/2023, 12:11
Static task
static1
Behavioral task
behavioral1
Sample
Payment for br-automation.com.html
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Payment for br-automation.com.html
Resource
win10v2004-20230220-en
General
-
Target
Payment for br-automation.com.html
-
Size
2KB
-
MD5
55e1f5ce2ddf04f3a8eb95f181c57715
-
SHA1
cf8ddba31fe49668bd37ab0b76fb2380c29cfd4f
-
SHA256
d37c4258d4139407c78d684aed33fe7bd0dd49e8bb51dcb671da224a3d8cc12e
-
SHA512
bc04df747960468cb58aa5846c29b52001f1a4e10a52fc847d222eaf7543fbfa9c3030df135ea45fb4fcf01e1fbe3edf04b2c445952f1ae089e1bd6658e8caf7
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1948 chrome.exe 1948 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe Token: SeShutdownPrivilege 1948 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe 1948 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1968 1948 chrome.exe 28 PID 1948 wrote to memory of 1968 1948 chrome.exe 28 PID 1948 wrote to memory of 1968 1948 chrome.exe 28 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1628 1948 chrome.exe 30 PID 1948 wrote to memory of 1156 1948 chrome.exe 32 PID 1948 wrote to memory of 1156 1948 chrome.exe 32 PID 1948 wrote to memory of 1156 1948 chrome.exe 32 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31 PID 1948 wrote to memory of 340 1948 chrome.exe 31
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" "C:\Users\Admin\AppData\Local\Temp\Payment for br-automation.com.html"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7ae9758,0x7fef7ae9768,0x7fef7ae97782⤵PID:1968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1224 --field-trial-handle=1192,i,6085182585455261522,17271289197305388826,131072 /prefetch:22⤵PID:1628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1192,i,6085182585455261522,17271289197305388826,131072 /prefetch:82⤵PID:340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1192,i,6085182585455261522,17271289197305388826,131072 /prefetch:82⤵PID:1156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2172 --field-trial-handle=1192,i,6085182585455261522,17271289197305388826,131072 /prefetch:12⤵PID:988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2184 --field-trial-handle=1192,i,6085182585455261522,17271289197305388826,131072 /prefetch:12⤵PID:828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1528 --field-trial-handle=1192,i,6085182585455261522,17271289197305388826,131072 /prefetch:22⤵PID:2064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3720 --field-trial-handle=1192,i,6085182585455261522,17271289197305388826,131072 /prefetch:82⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:788
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5e71c8443ae0bc2e282c73faead0a6dd3
SHA10c110c1b01e68edfacaeae64781a37b1995fa94b
SHA25695b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72
SHA512b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize342B
MD579a8709afe71aa37e3c1ab5cf920aee2
SHA15adf605cd69e6cd16496b705cfa247958b28f706
SHA256694cde77932b9814aa24bc663ff1585296f8b987df3a959ff047650b9a6be8b0
SHA512ec63fae241997d5ddabfe11458fe84fd53a0f8257a8bfb2967b88709d895e2822dc6945b6461835b7eb4cbf9614f8c2d5c7fe3a23d55277050ab7ad4f00c8eae
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF6d762a.TMP
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD5f6e3af1748dbdfe85338a645efbec34c
SHA17441802500779d89f3c49f172ac704ec7203cbc7
SHA25628fd2e7f5b1729791a12351c828d105f3ac29b30566fc9a887dd58c04a9d31a1
SHA51259f6c5dd117770d7a33e8a435a9a53bc0350a2913bad0d82f3e6eda31f730db1628cd3c36793945c5b8688b23f8b88a55fc5064eb693594cbde5be9d02c87570
-
Filesize
4KB
MD5aa5cc29cf05f2fa36a54ee119f157ddd
SHA1a96893e644319f6c5fa1b4875a4e265c82898604
SHA256d67d7442546e03513042d2bb205ed1fd2bc815dcd5249b48ba78e83cd52ea81b
SHA5129cab7d6e17c23f70404beed815821b5abcda01eff12ed22170fcaf36eb21044e5d04d0eb7aec19424bffd784ed8eedad2e728895a96aaf8ebaeb8ef05e14f585
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
161KB
MD5be2bec6e8c5653136d3e72fe53c98aa3
SHA1a8182d6db17c14671c3d5766c72e58d87c0810de
SHA2561919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd
SHA5120d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff