Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
23s -
max time network
132s -
platform
windows7_x64 -
resource
win7-20230831-en -
resource tags
arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system -
submitted
12/10/2023, 17:49
Static task
static1
Behavioral task
behavioral1
Sample
My_photo_video_2023_№7567456.html
Resource
win7-20230831-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
My_photo_video_2023_№7567456.html
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
My_photo_video_2023_№7567456.html
-
Size
2KB
-
MD5
bd7b63ead8e40cb68ae5e1b6cc41039c
-
SHA1
c1e1e81bdc45e1633a46cca278bd12fa4f5e13ac
-
SHA256
d642a27ef042746cb37b6576fcaa6284a93efda96d77c5f87617fc5f53b46b88
-
SHA512
f79ea9c973321750b7508d4d76c8da2f640fdc45a191f04c30b35fb72342a7cd15aa6a01302fcc72448610a96becaa65d3dcd8d5b3df43ddce0778b7f84d3965
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1668 chrome.exe 1668 chrome.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe Token: SeShutdownPrivilege 1668 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe 1668 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1668 wrote to memory of 2416 1668 chrome.exe 28 PID 1668 wrote to memory of 2416 1668 chrome.exe 28 PID 1668 wrote to memory of 2416 1668 chrome.exe 28 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2008 1668 chrome.exe 30 PID 1668 wrote to memory of 2560 1668 chrome.exe 31 PID 1668 wrote to memory of 2560 1668 chrome.exe 31 PID 1668 wrote to memory of 2560 1668 chrome.exe 31 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32 PID 1668 wrote to memory of 864 1668 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\My_photo_video_2023_№7567456.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef80f9758,0x7fef80f9768,0x7fef80f97782⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1096 --field-trial-handle=1248,i,4291098369543670806,8261321687589188317,131072 /prefetch:22⤵PID:2008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1248,i,4291098369543670806,8261321687589188317,131072 /prefetch:82⤵PID:2560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1248,i,4291098369543670806,8261321687589188317,131072 /prefetch:82⤵PID:864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2284 --field-trial-handle=1248,i,4291098369543670806,8261321687589188317,131072 /prefetch:12⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2292 --field-trial-handle=1248,i,4291098369543670806,8261321687589188317,131072 /prefetch:12⤵PID:584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1460 --field-trial-handle=1248,i,4291098369543670806,8261321687589188317,131072 /prefetch:22⤵PID:2788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3516 --field-trial-handle=1248,i,4291098369543670806,8261321687589188317,131072 /prefetch:82⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD5d7cc638b9aa8dbd7789e13d06cb3942d
SHA1d457ec15c677146338ca6f7758df7d9d28850e5b
SHA25649ed7725691061e2d69611672e966c3be79b76725dff0e1ed828b3ed3bef37c9
SHA5121b871b880b57fe5f046a2d0188617676b368ccd55a3e07bfbd21b68ea3d4b89de6570e5afc0c699ca9cfb38e69244f4f640c692a5dffdae9cec15e6bd9a8f070
-
Filesize
4KB
MD514d6f4b3dd6cf2d842eb92b56d1355f7
SHA1c36aca0c0263a07c3433162a3f3478118654c4ae
SHA2560da1ba9dba225e894d0100c1e5f5af22303157d3e503e023db7a649fc924e090
SHA512b7bdbd121882113d666b075784b05f93099dd55ebe4d930909de548b5f206f33587d2aeeaedb78e70c15fa284b014f451b12a2ad8f2d5778d6b477237d6ba367
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf