Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
13/03/2023, 20:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.quest.com/community/rapid-recovery/f/forum/26886/using-invoke-restmethod-from-a-remote-machine
Resource
win10-20230220-en
Behavioral task
behavioral2
Sample
https://www.quest.com/community/rapid-recovery/f/forum/26886/using-invoke-restmethod-from-a-remote-machine
Resource
win7-20230220-en
General
-
Target
https://www.quest.com/community/rapid-recovery/f/forum/26886/using-invoke-restmethod-from-a-remote-machine
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 832 chrome.exe 832 chrome.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe Token: SeShutdownPrivilege 832 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe 832 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 832 wrote to memory of 1708 832 chrome.exe 28 PID 832 wrote to memory of 1708 832 chrome.exe 28 PID 832 wrote to memory of 1708 832 chrome.exe 28 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 608 832 chrome.exe 30 PID 832 wrote to memory of 828 832 chrome.exe 31 PID 832 wrote to memory of 828 832 chrome.exe 31 PID 832 wrote to memory of 828 832 chrome.exe 31 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32 PID 832 wrote to memory of 1388 832 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.quest.com/community/rapid-recovery/f/forum/26886/using-invoke-restmethod-from-a-remote-machine1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6aa9758,0x7fef6aa9768,0x7fef6aa97782⤵PID:1708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1360,i,7899741130210340719,5112567783237046388,131072 /prefetch:22⤵PID:608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1528 --field-trial-handle=1360,i,7899741130210340719,5112567783237046388,131072 /prefetch:82⤵PID:828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1676 --field-trial-handle=1360,i,7899741130210340719,5112567783237046388,131072 /prefetch:82⤵PID:1388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2324 --field-trial-handle=1360,i,7899741130210340719,5112567783237046388,131072 /prefetch:12⤵PID:1408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2340 --field-trial-handle=1360,i,7899741130210340719,5112567783237046388,131072 /prefetch:12⤵PID:1832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1548 --field-trial-handle=1360,i,7899741130210340719,5112567783237046388,131072 /prefetch:22⤵PID:2136
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1720
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
4KB
MD567892bcdadb920288f09ac49eb81d7be
SHA1c45633cdaeac437e32236676c138d2b8d7665b6c
SHA2562a1330fc2d228d912c8e37d174b32277689ffda124989023daea3f217e6a12ad
SHA51255c7cb7003011e25cf09ae179e2f79cb28cf46b70df1c41545a79576d9c4f6c576749780920ba249a97a61bfe7480999ea5026bd6d31bfc0810dfa0ae2c736a5
-
Filesize
4KB
MD525f73a587894ab0344f6b59c33be8627
SHA151349a3a5c45e5ed795dd5c97d885868add5d81e
SHA2565f9f531e5ae2fddec7776c9fa18a1988521605d59540932f1bec8c5a91c0458b
SHA512e9582d6dccffe4937139915bad372086b3df624f182eb0bddcabdc0362f0fc8723929bd987a82934dc11f863d2e3c33b8d7cdb60479320eeee2b8e51f4422ccc
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
61KB
MD5fc4666cbca561e864e7fdf883a9e6661
SHA12f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5
SHA25610f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b
SHA512c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d
-
Filesize
161KB
MD573b4b714b42fc9a6aaefd0ae59adb009
SHA1efdaffd5b0ad21913d22001d91bf6c19ecb4ac41
SHA256c0cf8cc04c34b5b80a2d86ad0eafb2dd71436f070c86b0321fba0201879625fd
SHA51273af3c51b15f89237552b1718bef21fd80788fa416bab2cb2e7fb3a60d56249a716eda0d2dd68ab643752272640e7eaaaf57ce64bcb38373ddc3d035fb8d57cd