Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

10/05/2023, 16:51

230510-vdaenshb79 7

10/05/2023, 16:48

230510-vbkgvshb73 7

10/05/2023, 16:45

230510-t9wr4sag9w 7

10/05/2023, 16:45

230510-t9ll5sag9v 7

Analysis

  • max time kernel
    50s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    10/05/2023, 16:48

General

  • Target

    6928d305e0f42deda0cd03a35d378aa4a8fd0524983d27e699e8c6a93becb054.exe

  • Size

    277KB

  • MD5

    adeaee20a2a55c73b0e8871a1ec4e4b1

  • SHA1

    1fd6e2b2e04d17ef2b990b9338aa48ddf6e547ae

  • SHA256

    6928d305e0f42deda0cd03a35d378aa4a8fd0524983d27e699e8c6a93becb054

  • SHA512

    7db1a7c485b7020bb3ef284e88895afaed70b373c813f6eaa2fe7d98acbb94e23c20d5984e997794a07d52c7b4d05a83bdd5c55d95e8b233b5c5d8ea4ec7f710

  • SSDEEP

    6144:HXzKdNY49u8rVEV0IGvWz8mvP6ru01net5Gy:Ya4Az0IGvWXr012

Score
7/10
upx

Malware Config

Signatures

  • UPX packed file 1 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 54 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6928d305e0f42deda0cd03a35d378aa4a8fd0524983d27e699e8c6a93becb054.exe
    "C:\Users\Admin\AppData\Local\Temp\6928d305e0f42deda0cd03a35d378aa4a8fd0524983d27e699e8c6a93becb054.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1620
    • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
      2⤵
      • Executes dropped EXE
      PID:1468
    • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe
      "C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe"
      2⤵
      • Executes dropped EXE
      PID:268
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:576
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb999758,0x7fefb999768,0x7fefb999778
      2⤵
        PID:1432
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1232 --field-trial-handle=1284,i,5695037212950017170,5510390585206298146,131072 /prefetch:2
        2⤵
          PID:340
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1484 --field-trial-handle=1284,i,5695037212950017170,5510390585206298146,131072 /prefetch:8
          2⤵
            PID:1960
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1664 --field-trial-handle=1284,i,5695037212950017170,5510390585206298146,131072 /prefetch:8
            2⤵
              PID:1984
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2248 --field-trial-handle=1284,i,5695037212950017170,5510390585206298146,131072 /prefetch:1
              2⤵
                PID:1744
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2236 --field-trial-handle=1284,i,5695037212950017170,5510390585206298146,131072 /prefetch:1
                2⤵
                  PID:276
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1308 --field-trial-handle=1284,i,5695037212950017170,5510390585206298146,131072 /prefetch:2
                  2⤵
                    PID:2192
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1588 --field-trial-handle=1284,i,5695037212950017170,5510390585206298146,131072 /prefetch:1
                    2⤵
                      PID:2280
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3920 --field-trial-handle=1284,i,5695037212950017170,5510390585206298146,131072 /prefetch:8
                      2⤵
                        PID:2344
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4064 --field-trial-handle=1284,i,5695037212950017170,5510390585206298146,131072 /prefetch:8
                        2⤵
                          PID:2368
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3940 --field-trial-handle=1284,i,5695037212950017170,5510390585206298146,131072 /prefetch:1
                          2⤵
                            PID:2500
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 --field-trial-handle=1284,i,5695037212950017170,5510390585206298146,131072 /prefetch:8
                            2⤵
                              PID:2888
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:772

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RF6dfc79.TMP

                              Filesize

                              16B

                              MD5

                              46295cac801e5d4857d09837238a6394

                              SHA1

                              44e0fa1b517dbf802b18faf0785eeea6ac51594b

                              SHA256

                              0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                              SHA512

                              8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              3d4096f32495fa28e230bd45e9c50bf0

                              SHA1

                              62927006ee6bbc5898944e3e5e517dab1f1727a9

                              SHA256

                              ca7f9a7cfbeff8301322fcabed2668e026f57b53a395853f4aa6bdd39f48d6ff

                              SHA512

                              a51f6e4108c0753d3add7fd7396cfd14b9f45de092882d5ae958b7d0f38cf6f61fe4c95c78c944679c34cbd5e2f06407f90b5ea1c1382a6dc1fd249d45ba3e7b

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              4KB

                              MD5

                              cdf6a300e796e2003285570a226fb29b

                              SHA1

                              3f1e32cda4e3c53ff36e37be0f1cd4fd1c953fa6

                              SHA256

                              16c6bc731f9a547744585e20318f43160edad982bf86677d14a63e099a647989

                              SHA512

                              d6b690065baa9810a489e5bdc6042df5eb61567d5ba2a5075c2951c847a66f6e742bc1fd554fe297e32273043e9de3cef30973f178e97902c0716023285c9017

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

                              Filesize

                              16B

                              MD5

                              6752a1d65b201c13b62ea44016eb221f

                              SHA1

                              58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                              SHA256

                              0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                              SHA512

                              9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                            • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

                              Filesize

                              87KB

                              MD5

                              368332fca74f48697d842c5f4698ae1d

                              SHA1

                              0275153a1e62bd0eca0b02168895517ed66aac56

                              SHA256

                              3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

                              SHA512

                              fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

                            • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

                              Filesize

                              87KB

                              MD5

                              368332fca74f48697d842c5f4698ae1d

                              SHA1

                              0275153a1e62bd0eca0b02168895517ed66aac56

                              SHA256

                              3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

                              SHA512

                              fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

                            • C:\Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

                              Filesize

                              87KB

                              MD5

                              368332fca74f48697d842c5f4698ae1d

                              SHA1

                              0275153a1e62bd0eca0b02168895517ed66aac56

                              SHA256

                              3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

                              SHA512

                              fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

                            • \Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

                              Filesize

                              87KB

                              MD5

                              368332fca74f48697d842c5f4698ae1d

                              SHA1

                              0275153a1e62bd0eca0b02168895517ed66aac56

                              SHA256

                              3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

                              SHA512

                              fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

                            • \Users\Admin\AppData\Local\Temp\ITS\wincsecb\264\Production\ITS SB App Switch.exe

                              Filesize

                              87KB

                              MD5

                              368332fca74f48697d842c5f4698ae1d

                              SHA1

                              0275153a1e62bd0eca0b02168895517ed66aac56

                              SHA256

                              3a4a5b128c3a042010824fd33b719466b0d9320aa051ca3d5f1690124766ad59

                              SHA512

                              fd9f1d1a4337e00fef5e9ea10a7fdf553e98df2cf2fdf818b68689a89de3c1d324de389e0c9ef863fef08a3dff8150db173b2203e9e92efaea67865e8d2805b5

                            • memory/1620-65-0x0000000000E00000-0x0000000000EA0000-memory.dmp

                              Filesize

                              640KB