Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
10/11/2023, 01:09
231110-bht54agg8z 103/11/2023, 03:08
231103-dm79madb45 103/11/2023, 03:04
231103-dklb3sba9z 131/10/2023, 06:20
231031-g3r45aba52 131/10/2023, 06:18
231031-g2xyzsba48 527/10/2023, 07:43
231027-jke3ysef52 127/10/2023, 07:39
231027-jhdgcaef43 527/10/2023, 07:39
231027-jg4l5sch9w 127/10/2023, 07:32
231027-jcxyssef33 127/10/2023, 07:30
231027-jcahhach8v 1Analysis
-
max time kernel
43s -
max time network
99s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
27/10/2023, 07:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ewueagles.myfreshworks.com/invite/07db0b77-b4d9-4f99-bc12-da3b3bee4d69
Resource
win7-20231023-en
windows7-x64
6 signatures
150 seconds
General
-
Target
https://ewueagles.myfreshworks.com/invite/07db0b77-b4d9-4f99-bc12-da3b3bee4d69
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2420 chrome.exe 2420 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe Token: SeShutdownPrivilege 2420 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe 2420 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2420 wrote to memory of 2572 2420 chrome.exe 28 PID 2420 wrote to memory of 2572 2420 chrome.exe 28 PID 2420 wrote to memory of 2572 2420 chrome.exe 28 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2752 2420 chrome.exe 30 PID 2420 wrote to memory of 2648 2420 chrome.exe 31 PID 2420 wrote to memory of 2648 2420 chrome.exe 31 PID 2420 wrote to memory of 2648 2420 chrome.exe 31 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32 PID 2420 wrote to memory of 1732 2420 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ewueagles.myfreshworks.com/invite/07db0b77-b4d9-4f99-bc12-da3b3bee4d691⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2420 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7259758,0x7fef7259768,0x7fef72597782⤵PID:2572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1108 --field-trial-handle=1292,i,2743793322460449602,15061660444611835313,131072 /prefetch:22⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1292,i,2743793322460449602,15061660444611835313,131072 /prefetch:82⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1292,i,2743793322460449602,15061660444611835313,131072 /prefetch:82⤵PID:1732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2284 --field-trial-handle=1292,i,2743793322460449602,15061660444611835313,131072 /prefetch:12⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2292 --field-trial-handle=1292,i,2743793322460449602,15061660444611835313,131072 /prefetch:12⤵PID:2524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1120 --field-trial-handle=1292,i,2743793322460449602,15061660444611835313,131072 /prefetch:22⤵PID:2224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3500 --field-trial-handle=1292,i,2743793322460449602,15061660444611835313,131072 /prefetch:82⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50cfd7b1096032ff1711069158c962d4c
SHA1f5c7f15e2b684ad0f4c8763b34f406263aa7148a
SHA256cc3c10d6a38de39d1bef4a7b642ddc88ba6b82faa6927cd9a540abac7a51b067
SHA512bf6c151cb11be9603b10c4d97244860be329f5b347007de27ca69166ece57cdfa58600a8b99011521d544109795420400d9ee8f8255ff559afd9f6c4e982288b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\788735a6-5a31-4b75-ab6f-a7abcb5c7c06.tmp
Filesize4KB
MD54ed0bedac892be23c5e2c6b8b40edafd
SHA18fdef5629e054e6eec8f1ecc9af38836ab9ec23b
SHA2565ab1f1e182c8c44859c460691e7f50c43260853ba227b8a76a8e872650c9fd0e
SHA5121a2f8b25ee06c7c254c639a5a653b514ae12f15489a190a032e00b7fe92dea918163b42d6eef1672e0c16fc6af47b9c77e2845a5012a7440a2032bb63e9c0e9a
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD53e156679b7de04d27d06fbb8e6a3c9ed
SHA1b50aff4821fa78d7a645ba717b6434251422fc31
SHA2561fc9f25906662ec09c4a38690df2b27e525e4eba15b11a948e33aa76b5d66761
SHA51206cd29db82bd5f22857bb041ff60b32deae3802683d659d62c30f3ee04cacc6599529417294d442de43a57d73e730f5ef80bee6e82ae5b592851925681b4152c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
61KB
MD5f3441b8572aae8801c04f3060b550443
SHA14ef0a35436125d6821831ef36c28ffaf196cda15
SHA2566720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf
SHA5125ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9
-
Filesize
163KB
MD59441737383d21192400eca82fda910ec
SHA1725e0d606a4fc9ba44aa8ffde65bed15e65367e4
SHA256bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5
SHA5127608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf