Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
374s -
max time network
674s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
08/10/2023, 05:04
Static task
static1
Behavioral task
behavioral1
Sample
perfil.jpg
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
perfil.jpg
Resource
win10v2004-20230915-en
General
-
Target
perfil.jpg
-
Size
25KB
-
MD5
beac4445d6bc979180dcc6d8e3fb2ec3
-
SHA1
f86a82c9dcd27135a9fed8d360dd357a5da3483f
-
SHA256
e8e9a39e3a87b6d069a2cb949878b0e50806430673ef273d59dd7a450a41523e
-
SHA512
9586184bdcfb10e7bf2835614bb866ade80838653075616ec197cb00e96c8f4543e9a5aa9f21ec637e03214c692873dad54c1380c433e6b0769230baa6a67ed7
-
SSDEEP
384:JM4DV072v7/eYZIzd8rCOnfIIusEsseCxnJ2CrYbNK:JMOw2v7/RznA6dmgCrt
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe Token: SeShutdownPrivilege 2536 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 2420 rundll32.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe 2536 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2536 wrote to memory of 2564 2536 chrome.exe 31 PID 2536 wrote to memory of 2564 2536 chrome.exe 31 PID 2536 wrote to memory of 2564 2536 chrome.exe 31 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2376 2536 chrome.exe 33 PID 2536 wrote to memory of 2732 2536 chrome.exe 34 PID 2536 wrote to memory of 2732 2536 chrome.exe 34 PID 2536 wrote to memory of 2732 2536 chrome.exe 34 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35 PID 2536 wrote to memory of 1196 2536 chrome.exe 35
Processes
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe "C:\Program Files\Windows Photo Viewer\PhotoViewer.dll", ImageView_Fullscreen C:\Users\Admin\AppData\Local\Temp\perfil.jpg1⤵
- Suspicious use of FindShellTrayWindow
PID:2420
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7249758,0x7fef7249768,0x7fef72497782⤵PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1188,i,9171419879814382661,9554906987963455126,131072 /prefetch:22⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1188,i,9171419879814382661,9554906987963455126,131072 /prefetch:82⤵PID:2732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1188,i,9171419879814382661,9554906987963455126,131072 /prefetch:82⤵PID:1196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2372 --field-trial-handle=1188,i,9171419879814382661,9554906987963455126,131072 /prefetch:12⤵PID:620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1188,i,9171419879814382661,9554906987963455126,131072 /prefetch:12⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1456 --field-trial-handle=1188,i,9171419879814382661,9554906987963455126,131072 /prefetch:22⤵PID:1488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2872 --field-trial-handle=1188,i,9171419879814382661,9554906987963455126,131072 /prefetch:12⤵PID:1148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3628 --field-trial-handle=1188,i,9171419879814382661,9554906987963455126,131072 /prefetch:82⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3516 --field-trial-handle=1188,i,9171419879814382661,9554906987963455126,131072 /prefetch:82⤵PID:1984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3656 --field-trial-handle=1188,i,9171419879814382661,9554906987963455126,131072 /prefetch:82⤵PID:2244
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
983B
MD5edaf8365cc835840e4ff636201e79b3b
SHA13162078a874c2c8f984fa14862caba0f097af850
SHA256599762d893427e214078730f4c5296d10b6f7e652333f5e00f2984b697a4ee62
SHA5127b72ad5cebf75f4beb627eee3aa9d32c6b2dee6d50f5403e6ca84c01aed87a1e33983ccb8699ff996010fa7a0f8c5106d1d65cfa54983bb97d54604a0bf6559f
-
Filesize
1KB
MD5bb7a5c1e81d8cda8d1cefc9896f80108
SHA186ce4d585e71c4f6bdb42e6c22642d5fd1ad7dba
SHA256b9f450b078fe30f657c958e8684e87e8cf583309fb7ae38a1c41548fb29b402c
SHA5126257db3cee7669d21db2b00049008b31bef11864c812827146c32ebb338f3d336fc9f5ae28aac1dc69a5e115b995aeb54e6dc3324ba6e1766137fe512dea2485
-
Filesize
4KB
MD59a8a2b425f22f71fb7f668133080571e
SHA1799489afb8fae4c514024da19fa2eb4b6e28a908
SHA256c1332b8ee2723049fff7b3caf61112744be9b10a075ede6e4d4e88f021c6c833
SHA5120dbb9c31906614353432321143cfe50ad280bf37397e220949521565192c25148e48c0721d90f2496032d42f206ef57a8e0dcf6c81fbc373ce9a69ff343d0712
-
Filesize
4KB
MD52d473b969eaf17c7a41765097ef7108a
SHA1c5a1c1bfefd6336707fae267f5af926a828ef06b
SHA2560346e1acf8bf4eaed529b8386b7a5bf2d114d593597a2972710f808df4d6ec9d
SHA51234ffbae0e30b83f66e2286071c97e7ad2c3e9d8d504d20a290ecc717b88e6cdc584a0fb044de9aab4440b569baaff524873af0e8982320c8a420817c65185a4d
-
Filesize
4KB
MD5df6822936bc0fcaefab909958c56c84f
SHA138bb27d43a0b237320d2965fb1b36327a084dff6
SHA2568742a710718ff8a0c0c29ec1b1165c2ad3eee84f30f4eb4678b0f2cce6907847
SHA5127ce9400000ce344da86b861714e6aeb60868dfc22efdf96566369cdc5667d5c91c586729a4d29f58ffe3c9eaaae6ef4ec6a71230dcdb8888ab54956ee06ec174
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
199KB
MD526c1a318218a9061ec2f8db753013613
SHA13e32c6ddc947b444ab4cfae1ca9ed2bac9f0cbca
SHA2565771ce53ad0c58225db2f741d37523d610fff90688e2d88f66a353e98adf3682
SHA5127dc4e1f1195148c134f8a1609b9395e6103dbadf42e41cffee0f4ba9211a9e413e950a06b14c005c819ee118b955d59c133196dbf955fb233c3d5d331c833730
-
Filesize
199KB
MD575a63fdcc85abe32fc93ddc4ef56e4f2
SHA11de7b342098205883b7c37d27873cce5de0e2af0
SHA2568c9262f429a879c50271390b5652f1645c18e6b2b4d16b59b6ef664c0112500d
SHA512695347316500715d57a0792516fbaa7fb730175383d8536fbb1341e09de069b7effd1b33254c8cc46500be5ada47948152177f05b210e0f8c866f82485ca048d
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf