Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
88s -
max time network
204s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
17/04/2023, 14:28
Static task
static1
Behavioral task
behavioral1
Sample
challenge.zip
Resource
win7-20230220-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
challenge.zip
Resource
win10v2004-20230220-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
challenge.zip
-
Size
4KB
-
MD5
412daa0ddc7457caa3557363a94107c3
-
SHA1
01daea35cdb58f695c380e87c94279ef4e950a8b
-
SHA256
f8dc67d665f67ff9827cdec9ee669920370056893fbccbe8c9fc8c20f755e6e6
-
SHA512
53c9b405453db9fc998dbc259af605315f03c8af2e5fe82d1a381861dbb736e7e7d07c0234fc4363f13c6a2c9d365549669e0b009396e3cbf637c900b9371225
-
SSDEEP
96:USQWG0L+bi7xsGOSBKWKmF2oGHq16KVNLllhExGY1EduxZx6CXrDMxeaVco:US44f9Bz2DHq16yNh6GYyUkCX32eaVco
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1712 chrome.exe 1712 chrome.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: 33 1676 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1676 AUDIODG.EXE Token: 33 1676 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1676 AUDIODG.EXE Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe Token: SeShutdownPrivilege 1712 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe 1712 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1712 wrote to memory of 532 1712 chrome.exe 31 PID 1712 wrote to memory of 532 1712 chrome.exe 31 PID 1712 wrote to memory of 532 1712 chrome.exe 31 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1556 1712 chrome.exe 34 PID 1712 wrote to memory of 1308 1712 chrome.exe 33 PID 1712 wrote to memory of 1308 1712 chrome.exe 33 PID 1712 wrote to memory of 1308 1712 chrome.exe 33 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35 PID 1712 wrote to memory of 1496 1712 chrome.exe 35
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\challenge.zip1⤵PID:1344
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:1276
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x54c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1676
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1712 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5c99758,0x7fef5c99768,0x7fef5c997782⤵PID:532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1460 --field-trial-handle=1300,i,17264715008898500110,12133245900325559981,131072 /prefetch:82⤵PID:1308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1188 --field-trial-handle=1300,i,17264715008898500110,12133245900325559981,131072 /prefetch:22⤵PID:1556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1300,i,17264715008898500110,12133245900325559981,131072 /prefetch:82⤵PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2044 --field-trial-handle=1300,i,17264715008898500110,12133245900325559981,131072 /prefetch:12⤵PID:1276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2148 --field-trial-handle=1300,i,17264715008898500110,12133245900325559981,131072 /prefetch:12⤵PID:1388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1592 --field-trial-handle=1300,i,17264715008898500110,12133245900325559981,131072 /prefetch:22⤵PID:2220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1448 --field-trial-handle=1300,i,17264715008898500110,12133245900325559981,131072 /prefetch:12⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3788 --field-trial-handle=1300,i,17264715008898500110,12133245900325559981,131072 /prefetch:82⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3852 --field-trial-handle=1300,i,17264715008898500110,12133245900325559981,131072 /prefetch:82⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1636
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD5aa6024451e5539805b7a4ab1d04947a4
SHA17e564f7587c60bdaa6570c92b032567ab98013a3
SHA2566fe442ec64912d6cccbef2c6876b3ac66e06c83f2a9f21ea350b06be56f4156e
SHA5125791ca0bf6bf115f343190faff79eeb982079a717a21bbbdfc7fdf91629dbbd0d7a1264d6394f66f4b18b18dd8ec21a089cf362fd7f2b4c09553fb256141c300
-
Filesize
4KB
MD5b165be3c6c855c5d2215c2acdebe81af
SHA1738637a9d7788f418615b0a68b8966e8dee7891a
SHA2568cd6d7388019663848f8569094cacabbca41d2e6ce0f895ca1f8f34fa50d6d35
SHA512ca97341dcf435b35efb1f7ebd7d2090a7c13755d2a0cab484b1a19f5bb0385259a1b38d5165e5cf9a385eb3af22fb79da10916e0adc3628c6bc13dce6811c2f0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp
Filesize16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389