Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
30/05/2023, 22:58
Static task
static1
Behavioral task
behavioral1
Sample
download_repair.js
Resource
win7-20230220-en
General
-
Target
download_repair.js
-
Size
44KB
-
MD5
47d57395412f503c13804d1e9eda9c89
-
SHA1
bd331b80dd3fc54a8edb18dd669296245bea685f
-
SHA256
b6196054e5440b149c2226dc09ccfaa8305298aa233ba0dc8f3f0b4c6f560f0b
-
SHA512
f6354eb96621cca4b1302d9312a50afbc4c0c86a3c467ae3d1c7f00359ab668617d4156da3f6b598a2f84ea0e0a31ef6d17a1359d5f6eba407ce58a3c3c174d5
-
SSDEEP
768:k5RHm86SJjyrLuzqBSrQwKdo+4noCKFA/ozVE+eV4KmnbK6KwIRqqIZJ8OhTSAF:k5RHm86ajyrLoqBrdo+4noNFA+VAebjL
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1992 chrome.exe 1992 chrome.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe Token: SeShutdownPrivilege 1992 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe 1992 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1540 1992 chrome.exe 28 PID 1992 wrote to memory of 1540 1992 chrome.exe 28 PID 1992 wrote to memory of 1540 1992 chrome.exe 28 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 1332 1992 chrome.exe 30 PID 1992 wrote to memory of 992 1992 chrome.exe 31 PID 1992 wrote to memory of 992 1992 chrome.exe 31 PID 1992 wrote to memory of 992 1992 chrome.exe 31 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32 PID 1992 wrote to memory of 896 1992 chrome.exe 32
Processes
-
C:\Windows\system32\wscript.exewscript.exe C:\Users\Admin\AppData\Local\Temp\download_repair.js1⤵PID:1376
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fefb049758,0x7fefb049768,0x7fefb0497782⤵PID:1540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:22⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1460 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:82⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1620 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:82⤵PID:896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2224 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:12⤵PID:1248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2192 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:12⤵PID:1492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1164 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:22⤵PID:2052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3648 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:12⤵PID:2128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3668 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:82⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4004 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:82⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3908 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:12⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1920 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:12⤵PID:2572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2796 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:12⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2332 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:82⤵PID:3024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3816 --field-trial-handle=1236,i,6603362809338397341,14054083806349683762,131072 /prefetch:82⤵PID:2208
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:840
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4501⤵PID:2200
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RF6d4ead.TMP
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
1018B
MD5cbe23f0f83134e502cd7f96f7a685c21
SHA1a6dfb251933d3c5560d7e8058dd7d089e294c921
SHA256d61ccc5f55561b47b55e202c8783c63ed585a4ff5511c173f7cc4dbf5766a171
SHA512bf6f9a09d83dd0ebd0c2519f9d907402b5d41416236c07587bbc5b21b4862642d8c490e797b2a9013825d7c1cb8bd421c81a4bfe7922a71b7061b300d05ee6d2
-
Filesize
527B
MD5b074b525962b10219a053904ccf32b65
SHA12c105717a111accc57b4ada36fea8814952662ea
SHA256a405d912f6514e0d38e35699ecadd3c80c529c61f0b719889ce345c17a019298
SHA51218b6d05b05726037e383c929fea30d6147c7deaa4fa1e86a0e85a8900fbd93d036e4f16e089f81b196d9314718e4225f1668608df061b435f61e16dcf7d70954
-
Filesize
4KB
MD501a9049218f7e3663dffbd63f2a038f2
SHA1f89c661e86c8f793726d45c037d0a68e33208e2c
SHA25695f3303ef25edb9c308fc870e4ec2a3c58ccf01698527e89d85599e9235abad2
SHA512447f4fa3d63ae95322db8f27afd99e356ad6883a22006c9b19bd893701c936d7c19d3ab563a790372e8c8ea0478e27056995b57b94844f133d63360ce73e04d7
-
Filesize
4KB
MD5b5b4d10cd4023892847c796a4da95e79
SHA1b114e4927a17e45e94d48e31bb9d90475b3b052e
SHA256fe88ebf883ef449c79f6c72d81b43530f592fa3bc18f86e6f303c8d9528bed9a
SHA51280de5ecc28461dbffbce946a099721adaa72eecb57b3a1650d3573b7bfb0c8bdf83685d7e731daa308cff46440a2efaa2eb75ee7d03388348036240f13420adf
-
Filesize
5KB
MD56a5654c10cd96e5db3176676e7e809a1
SHA17f3a48fd13a1488afd8555ab228a948570aa04ec
SHA256466396cd3039a0b5ce8cf8de3861c72d5164af51478edaa96e45c870a7edc760
SHA512208650dffb4c5f4f85b92c97437d8cbaa344765326ebfe37d74e62f10a54923cd5de42f1a2a9c0b04bdc3782aaacc79620758f62392889e3cc4867ba45e9ac3a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize129B
MD550d07871df869191a89cbe298c917e34
SHA1bcd954081f8db9a385c24621398e770011ccc3de
SHA2563da47e4337b5bc1832315c8f7a0e1cf32a3f6f283335da86580c77b2edfa25b9
SHA51209ce04288a87104a829e2528b23e50fbba905191dc5c5563fbe3ef8c60f974a62d12c1b668220efd96d85386358ef7f4345779e4c446bff6b4618f6f1edf98db
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt
Filesize56B
MD5ae1bccd6831ebfe5ad03b482ee266e4f
SHA101f4179f48f1af383b275d7ee338dd160b6f558a
SHA2561b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649
SHA512baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038
-
Filesize
16B
MD5206702161f94c5cd39fadd03f4014d98
SHA1bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA2561005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
SHA5120af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp
Filesize16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389