Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
5s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05/01/2024, 09:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.shareaholic.net
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://www.shareaholic.net
Resource
win10v2004-20231222-en
General
-
Target
http://www.shareaholic.net
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 356 chrome.exe 356 chrome.exe -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeShutdownPrivilege 356 chrome.exe Token: SeShutdownPrivilege 356 chrome.exe Token: SeShutdownPrivilege 356 chrome.exe Token: SeShutdownPrivilege 356 chrome.exe Token: SeShutdownPrivilege 356 chrome.exe Token: SeShutdownPrivilege 356 chrome.exe Token: SeShutdownPrivilege 356 chrome.exe Token: SeShutdownPrivilege 356 chrome.exe Token: SeShutdownPrivilege 356 chrome.exe Token: SeShutdownPrivilege 356 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe 356 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 356 wrote to memory of 2496 356 chrome.exe 16 PID 356 wrote to memory of 2496 356 chrome.exe 16 PID 356 wrote to memory of 2496 356 chrome.exe 16 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2668 356 chrome.exe 24 PID 356 wrote to memory of 2652 356 chrome.exe 23 PID 356 wrote to memory of 2652 356 chrome.exe 23 PID 356 wrote to memory of 2652 356 chrome.exe 23 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19 PID 356 wrote to memory of 2728 356 chrome.exe 19
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7759758,0x7fef7759768,0x7fef77597781⤵PID:2496
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.shareaholic.net1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:356 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1556 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:82⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2136 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:12⤵PID:2600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2128 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:12⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:82⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:22⤵PID:2668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1164 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:22⤵PID:1692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3436 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:82⤵PID:2228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3532 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:12⤵PID:1928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2488 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:12⤵PID:852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3768 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:12⤵PID:1720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3888 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:82⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD547d13bf6a5cac812f1d994caff5b4a1a
SHA1274a67ecf1c8660be076973d326c332bb74e47f1
SHA256da099d5b67b02a04fb394735f29ed3dd3c5997ab8100a5e0fb153271bef21916
SHA512f5e274c45cf9af9599f3c0ef1417c66184fcd6980925c12c1e458ce5e9db0bd9d47b892489b31196e55dc8518b85b44a3ba00760053151edda264efb846eea68
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\296ba0cc-0f56-4fef-a57b-c2c7b8bb613b.tmp
Filesize6KB
MD5ce63b66109b9d7b6c9a881df5653e4b6
SHA116b0049e6ef419bbe09c12919eb8078182c34b25
SHA256b10b12392ea66d2ed8b86d05861f3f627d8a1d1164aaf69c32c8f545116cec2e
SHA51206975442a786abb894c0586391e18d20a80b93e1b830902bb296ce0d657180fb9ab5bddd151fd0376f04ad210a12f2d3227062b4146e286b13a67d92c78c9eee
-
Filesize
1KB
MD5de8f155cdd923ca31de9ee3c85dba443
SHA1b945bfe0d564dc77e6d86010d7c866ac26338768
SHA2568a26270a34eccb4b898522863b00699ad9a2a58f461e790036a7bfc9e79a46c6
SHA512482da73bb6ec6c4127d7e490c04ecf22f74f5abc0778b05cd574a94449a662a3a0dd2febb71acc568fb1351413a2240075b083e76429d16a5144eb82a7d91f58
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
29KB
MD546e145626dadaa1fc0afe2cab6bfb5ec
SHA17348fc5b301e2ea630315c9cd17c115f25f47b60
SHA2564c7b6ffa71ec2c297854bdb1a511e6c40edd7937e41952c67feccfcbb5216631
SHA512bda9018032451539f4ce7349bb19ea886353403318ce694f6fce205b77a9c02dc35c6fa8d814e48f715337171df1f73524a7cf262a82d39bd16566ce71c219fd
-
Filesize
3KB
MD5c8267e38b24ec6ae1a3e8751e2ec2e12
SHA10696e83ca80c05991ce15c41768301a4b59f4fbf
SHA2566dc6280f90ce2cbaeaa7a6578cdf46090961aec6967bcb09fb65a67b34a4676d
SHA512cdd7c809f4a6108c36f2a4d8ba3551f5b1d2b6e0efa26d347bdf41ca3d38e0b86ce26c4ae6f798bc0e1b93553fe7aa336c31f7033c89c93a73add0e48b3196d9
-
Filesize
1KB
MD5f444b083612c5d2c6413175a036cbf30
SHA1fa19ed234f08ae4eb8e01d444cabce367ea51f7a
SHA256b177922c455cec5f5722dce9c753c89dacac37cbb5a2755989ea30cfec61f67c
SHA512bf4f80930b318b81895cab04eb04971d630f37c5a7b24999afa35628c0d1245f50c212502062f4140f20ffa25a1f065038fb2c21a1c22d4268b97003a7ba1bda
-
Filesize
2KB
MD54273acfd012fef420c4997601f9ab39a
SHA14304ea870fbd1e4b234f20a5beaad991db13b744
SHA25694190f5a220417a24808ca33dcd39b0790e9828b0d3c3427360aaea8532eb062
SHA512bb6ca45d7a0cdfec39ac57ff03794002284ec95daca67b7da0f5423b0e86e2bc9149e3a20db9a9ec6c55499e49aa2f3752bd7ad1869164c38154886be5832b6a
-
Filesize
1KB
MD55639e1d5859075b68870f54358c8c3cc
SHA1e397f86f7c9898a93a433555f8d35bd54d023cd3
SHA256f9b39da4e2f47a51dc58e3b509a0c1933521dee43435e17b281331f0d0fc66af
SHA512d857f1b92d1ebb06d58b1d8edf3c5c1cc0ae3c4ca10cbe6d02432e4c064763988083274eb631418d7f1150c776c25ec7a288ab30789a3817264ce49df196f13a
-
Filesize
2KB
MD551b4dedb58fc56507d1d07b34f394bf2
SHA1201022bb7bea0d589814da3c0cbb26c236b1c318
SHA25697490dc162c3dfd2c53f50bf0abdec6af4b86d93d3b939cd6e16b6ae0c0c3819
SHA5124b5879e51bcb94fa6c9854de2de33212e42f1be112866428c701cb8fd9ab31e8357f709d92668a747ce59acd764aec8bd1fef71081d54d2ae1a199aeba7055c5
-
Filesize
5KB
MD57cb23e0bf85cd4f078f7dc27ce997d92
SHA159b4c7ad8c9fbbad72400097229a8169743f9cc8
SHA25625479e09a9e352e0f6e95250b268e2fbe95f42300db00871c8e10503d27ca888
SHA512aa1995606a6dc1c51a3202766e7d1f8f78900e83503f57ba407b10e8dacb9e37fc60d41a73a1cebe4dea4af04d96a2a1d901d41a061fa002e0e662978eb6bd20
-
Filesize
5KB
MD56c7a614630cc71960cc6c1e34e001533
SHA1adaa6936358b2fbc721ad6cbb512d73ee9bb5f1d
SHA256852498b88148266aab118f0dfd81023c0fdda60e871149ba536bfeaa0cfad8ca
SHA512dc2725302675fd2bd2353e48f85c1a82c3f8d23a9f9c6b58c7dbf13ecef0af8bdbcd57bb24875b9db379ecc92c9190223812530a6825be9baf384d17dbeeb960
-
Filesize
5KB
MD5f6f9494fee9e2b6d04d2f76dd5f90f54
SHA10aef3adfced40326a21e3da81ff717aa84a22ac4
SHA2566fe1c823f5312abcd878f4c43045e004b06a0592258d12dfc68e5206747fabe8
SHA5124d22d71fb01b902667228200fd11bf621738b593a5e981e9b8fe9f93bf68029934e68c703dfc81edbb5f5fe6dbf0adfd3323a6b72bdeb8f6b40339896cb883c6
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06