Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
20/09/2023, 11:20
230920-nfmz8afh6y 1Analysis
-
max time kernel
63s -
max time network
105s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
20/09/2023, 11:20
Static task
static1
Behavioral task
behavioral1
Sample
LICENSE
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
LICENSE
Resource
win10v2004-20230915-en
General
-
Target
LICENSE
-
Size
14KB
-
MD5
9ac2e7cff1ddaf48b6eab6028f23ef88
-
SHA1
5405311284eab5ab51113f87c9bfac435c695bb9
-
SHA256
a45932c79317d15116eadbf1c9c6fc59117ec3c4621db3a876066defa723963b
-
SHA512
2ae61449ad3a80b866a6a2ca51086122f39faa6a7721a2ec26ce83caa556a98063109bf9ababdcbb7273ec520d42e983575c3bb8bee4c0032457b0af2a53a693
-
SSDEEP
384:jEUwi5rRL67cyV12rPd34FomzM2/R+qWG:j7FCExGFzeqt
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2660 chrome.exe 2660 chrome.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
description pid Process Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe Token: SeShutdownPrivilege 2660 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe 2660 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2660 wrote to memory of 1668 2660 chrome.exe 32 PID 2660 wrote to memory of 1668 2660 chrome.exe 32 PID 2660 wrote to memory of 1668 2660 chrome.exe 32 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2764 2660 chrome.exe 34 PID 2660 wrote to memory of 2812 2660 chrome.exe 35 PID 2660 wrote to memory of 2812 2660 chrome.exe 35 PID 2660 wrote to memory of 2812 2660 chrome.exe 35 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36 PID 2660 wrote to memory of 2520 2660 chrome.exe 36
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\LICENSE1⤵PID:2160
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7459758,0x7fef7459768,0x7fef74597782⤵PID:1668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1292,i,9960885126132189388,10064892778520928651,131072 /prefetch:22⤵PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1292,i,9960885126132189388,10064892778520928651,131072 /prefetch:82⤵PID:2812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 --field-trial-handle=1292,i,9960885126132189388,10064892778520928651,131072 /prefetch:82⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1548 --field-trial-handle=1292,i,9960885126132189388,10064892778520928651,131072 /prefetch:12⤵PID:1696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1292,i,9960885126132189388,10064892778520928651,131072 /prefetch:12⤵PID:948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1456 --field-trial-handle=1292,i,9960885126132189388,10064892778520928651,131072 /prefetch:22⤵PID:2696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1364 --field-trial-handle=1292,i,9960885126132189388,10064892778520928651,131072 /prefetch:12⤵PID:2332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3408 --field-trial-handle=1292,i,9960885126132189388,10064892778520928651,131072 /prefetch:82⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3528 --field-trial-handle=1292,i,9960885126132189388,10064892778520928651,131072 /prefetch:82⤵PID:1344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 --field-trial-handle=1292,i,9960885126132189388,10064892778520928651,131072 /prefetch:82⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3672 --field-trial-handle=1292,i,9960885126132189388,10064892778520928651,131072 /prefetch:12⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2156 --field-trial-handle=1292,i,9960885126132189388,10064892778520928651,131072 /prefetch:12⤵PID:2380
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\845bab10-baa9-4bc5-b70a-991e57c62945.tmp
Filesize5KB
MD5594b16e164c79c1f90b4ba54e0ecd84e
SHA17275e8d8686b8bbe1f3b1303b5d4d58aa0d64646
SHA256fc65f4555d8872d3a239a17c5f727a888323adbcb6c4cab7ea66d8f42b75e642
SHA51216e0eb91c391bc3b8fdb1c7b52b82e998379033bba531f5f56b032ac2a5c0b2a15a575521e9b9ff4446fc8445f4ed6281bc6e607daa2d067b6dab82ef83b873a
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
357B
MD57857fdf88e9102b56be978a359edfa7b
SHA17fa60ea73c46f46bcc237cd1580d52e4f6658547
SHA2562a9cd9a08f88bb5ef9d9af8ac4187acfb7e8c16654e4b7ef1a1c11cad651cee9
SHA512dc7cb61424827bf8ffebc52d93d1a48cedad32bc8159c8d80caf56c19c8c6f8429675a1cd6acd0419e06f00affb8251b49ac3aa62f8943601755141f4904a234
-
Filesize
682B
MD5b8d4832528a211891db8ae09287e2725
SHA13fececdcb0fce5ee65195c9dd2137911e768b98d
SHA25604644f2db4defb37534997a5718f347e55aa226ea1e23268659c3440b9c0d755
SHA5123aa7dfe8c5f005ed3bcfc7e6740605dddb88c5436a0e3943c787a2c6a86380cee4ab8ad5469da4cc23f92878923480839f1a3571cf22d5ccffc3dfa5790099f4
-
Filesize
4KB
MD5bf8ffedd135fcea5f0a7de46387b9b69
SHA19b0faf9aadca30f262feac950a3aa42cfdbb044b
SHA25632ce867d9f61f513170c0a1e6b8dbc2dc8096ff99e559c4482667167ef4c09ce
SHA51264cac348ee946961bc3f179fcf887d594b26c93e50bb648ded79f824d9c1e8aff2ce64d23a014ded17949e281694e8bdc4609a525007599ec399a6f0ba92bf46
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf