Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
01/01/2024, 20:41
240101-zgwvasacdl 131/12/2023, 01:27
231231-bt7wbsfhh4 130/12/2023, 18:44
231230-xdklrabbcl 129/12/2023, 19:32
231229-x89t5abgfm 119/12/2023, 06:04
231219-gs1cragfh3 119/12/2023, 05:54
231219-gl8esagfe4 1Analysis
-
max time kernel
214s -
max time network
248s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
19/12/2023, 06:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin
Resource
win7-20231215-en
windows7-x64
9 signatures
300 seconds
Behavioral task
behavioral2
Sample
http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2220 3060 chrome.exe 28 PID 3060 wrote to memory of 2220 3060 chrome.exe 28 PID 3060 wrote to memory of 2220 3060 chrome.exe 28 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2116 3060 chrome.exe 31 PID 3060 wrote to memory of 2956 3060 chrome.exe 30 PID 3060 wrote to memory of 2956 3060 chrome.exe 30 PID 3060 wrote to memory of 2956 3060 chrome.exe 30 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 PID 3060 wrote to memory of 2588 3060 chrome.exe 32 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.coopsantodomingo.com/wp-content/uploads/2023/MDTlmmACMtoTgAwcewt233.bin1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6e79758,0x7fef6e79768,0x7fef6e797782⤵PID:2220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1296,i,6365022688565447026,6680338437116427326,131072 /prefetch:82⤵PID:2956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1296,i,6365022688565447026,6680338437116427326,131072 /prefetch:22⤵PID:2116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1296,i,6365022688565447026,6680338437116427326,131072 /prefetch:82⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2152 --field-trial-handle=1296,i,6365022688565447026,6680338437116427326,131072 /prefetch:12⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2156 --field-trial-handle=1296,i,6365022688565447026,6680338437116427326,131072 /prefetch:12⤵PID:1988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1180 --field-trial-handle=1296,i,6365022688565447026,6680338437116427326,131072 /prefetch:22⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1444 --field-trial-handle=1296,i,6365022688565447026,6680338437116427326,131072 /prefetch:82⤵PID:736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1448 --field-trial-handle=1296,i,6365022688565447026,6680338437116427326,131072 /prefetch:82⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3416 --field-trial-handle=1296,i,6365022688565447026,6680338437116427326,131072 /prefetch:12⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2820 --field-trial-handle=1296,i,6365022688565447026,6680338437116427326,131072 /prefetch:12⤵PID:1168
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD5c7fa3a4275de26f5e1a7267acd040fd7
SHA1de8f8e4fce578b0312b5aad0169cbea26b1c3e31
SHA256396b532b401455ce3e91695e1f89e9a8c77a30945d6467dbcd9f8a2ef4d9b817
SHA5127ebe844bfb5a9b61237214b72ccba46569abab78b759604be02b25c07c830188e264eaaddc8ee8bb8e60405be4ce937358b605cbf8901e26c4302a4557281284
-
Filesize
4KB
MD5869c136c4e6f9be70f6891b77a512d61
SHA1d83ab3d0697f98232143841c98c03a1698b550fc
SHA2565cb5abe9f1ae6fb3f37f1d26052fe67286913e57364a9cb6b825ad45f4f5c86d
SHA512a1179b906a9da2557433d6f4cd204b7ebe0614388341471fd41cfe17c89061cacdb70a7b6a6531d0097d9527e9407f41fc92b562bc3a0372348d73e9433a2102
-
Filesize
4KB
MD586b7f1b180f2b1bc2604417037b65a59
SHA18ff6d665aa80a20023bf23b876b425566c7be654
SHA256685bd277f0e9c85f71a6ae3c29defe3841acb060bc7a906ff28bc33259614711
SHA512962638c5caffc1c1495fe3257a6222ed658e3a6a9cb44a74f04401470f9d2c98eff94849d7ac2374afa706debc48fd437d5dbefe20dbd356f47425ee1e3192b2
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
240KB
MD5faa2c3d1b2487aad5a70f2d8e755cb3d
SHA1f858420103305f3ffa8cd3447aa69e253c7f364b
SHA2564c53d4b424851b03ee9178d45fbb79047cc71d183ce0b6c878d5eb896fe32834
SHA512a91ef4314e58b738f666812cf0355d029c591986b26aa9907b9bce2b8b00aef0ff5d8f212af8474e22ce6141673efcb33f7363f3d6f27f2bb15c866405077ea8