Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
4s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 15:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://storage.googleapis.com/dgbttbthhrb3/dgbttbthhrb3/url.html#cl/18139_md/1919/3096/2026/159751/285156
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
https://storage.googleapis.com/dgbttbthhrb3/dgbttbthhrb3/url.html#cl/18139_md/1919/3096/2026/159751/285156
Resource
win10v2004-20231215-en
General
-
Target
https://storage.googleapis.com/dgbttbthhrb3/dgbttbthhrb3/url.html#cl/18139_md/1919/3096/2026/159751/285156
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2060 chrome.exe 2060 chrome.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe Token: SeShutdownPrivilege 2060 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe 2060 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2060 wrote to memory of 2848 2060 chrome.exe 28 PID 2060 wrote to memory of 2848 2060 chrome.exe 28 PID 2060 wrote to memory of 2848 2060 chrome.exe 28 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2804 2060 chrome.exe 30 PID 2060 wrote to memory of 2744 2060 chrome.exe 31 PID 2060 wrote to memory of 2744 2060 chrome.exe 31 PID 2060 wrote to memory of 2744 2060 chrome.exe 31 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32 PID 2060 wrote to memory of 2928 2060 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://storage.googleapis.com/dgbttbthhrb3/dgbttbthhrb3/url.html#cl/18139_md/1919/3096/2026/159751/2851561⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2060 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6809758,0x7fef6809768,0x7fef68097782⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1192 --field-trial-handle=1312,i,7961022893197077244,12001049162665169491,131072 /prefetch:22⤵PID:2804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1452 --field-trial-handle=1312,i,7961022893197077244,12001049162665169491,131072 /prefetch:82⤵PID:2744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1528 --field-trial-handle=1312,i,7961022893197077244,12001049162665169491,131072 /prefetch:82⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2068 --field-trial-handle=1312,i,7961022893197077244,12001049162665169491,131072 /prefetch:12⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2076 --field-trial-handle=1312,i,7961022893197077244,12001049162665169491,131072 /prefetch:12⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=3228 --field-trial-handle=1312,i,7961022893197077244,12001049162665169491,131072 /prefetch:22⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1360 --field-trial-handle=1312,i,7961022893197077244,12001049162665169491,131072 /prefetch:12⤵PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2108 --field-trial-handle=1312,i,7961022893197077244,12001049162665169491,131072 /prefetch:12⤵PID:1648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3424 --field-trial-handle=1312,i,7961022893197077244,12001049162665169491,131072 /prefetch:12⤵PID:2372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4300 --field-trial-handle=1312,i,7961022893197077244,12001049162665169491,131072 /prefetch:12⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4212 --field-trial-handle=1312,i,7961022893197077244,12001049162665169491,131072 /prefetch:82⤵PID:2904
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1108
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52217c406a0004d7d767a061daaf98f17
SHA1c78ec6396303720dddddf3d96aba4a649f7930e6
SHA2568aecc6138ebd9e7c2e57257b91aa239e60a677c236f2c99098c8e03920751b2e
SHA512bfd5dd29e5dcc6623e040fa645e7a4b11b7cbee32d5e2f6fc0607b52ba4946560d226a3d701133fe601f527c03a5fb9c682b3720026704c6c1b6c6f1908a182f
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD550c9829d11730f1e1305b17c8d9a11dc
SHA180ba60b2573a6d8b91a913e0874114fddc271f0e
SHA256c30813ceaf422420f95986458c34c8d2c8166c0188471108bfa26d017aa669c4
SHA512595ed1b9971fb631db77c5a2f54c728887427d37fd72b1ca151c4cc04b21c51bbce2ef92208e3add874b6e60c4bd7a34785565f01bf2670b42dc76d8fecee1a8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD51dd78c0f2a4cd2036c4d99a7934a1fd3
SHA17c78f3414b7b610732c1af7a91c3dd6a043bac6d
SHA256b3544009ef612e4d1f6a3e657eda1f6f386d3f479a2764df43c92facda0c1340
SHA512afbe5dfb2a216ac13bf0b82ec2d966ab7ddf85c4ee282be8624cbc8ca9733c6bd4647dd660605fa5f44cf392c34012a6d88a4eeb313cb49f31af042a4af01a75
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD53d4e28a7225a391ea5b39ab2925cf148
SHA144b17b81f71f719c1041e957f03758171ac7cc5b
SHA2566e759691b4be4910af29d1db889a6525773330517816e2e04a4399b569a21d57
SHA512160b97a7988ef6298dc585e711ea969784356af5c5e23442f835535718ac59b26cc1485c0051ff2a8a2a096a5b4738dae29c98da29d2d2e5d3a7fb7de6d2d0bf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD569d6c434fd28f09a1395051526df0960
SHA15a5b1afcf5e0d94ff75a3eba433ff0f5cd3caddb
SHA256721af80b9fab0df0367ebc6487b76c32c75522a916b0ac8f91c2f8364348efe9
SHA512f6687cd873ebb3c72fbda2486f68d2903ee95118846726c33d4b5756cb14a12b092ded1885447e74f4b94bb860909b2392b0b4481f30af1fd0245217ef0bf948
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5606a6666505cab9911f35f3224e3bf20
SHA18c42ab75720ebcc5e4003c710747f699c58bb81b
SHA2564a512e331bdce22eee9892b0113d6ec3895cae84131ee635699bf94f96d83484
SHA512933453335801e32c2e63e9c7b60b61067620032221906bf79ae2ca240e760befa8b28c576afac96e9139b083634e55361c0fee1681ccd25263d654c482e962d8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD57b20622570a8300ca1bae605e9900917
SHA194e6a5088f522b0a99805bc1f724af2cc0c45202
SHA25613a4335a779d7cc014701dd1d8fe821ef9f43ef47cb2817509fd13b1b3bf522b
SHA512aee60db34532a910130e15741af5c1113f3ed2c20bbebd2afdd05c4c82a951e420a95a19dcfaab21e355c550ffa065b56f01f3854a0cb111b73d9151f1d7616d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a7d00b69965d211a643e11c4137ce4d0
SHA1d7fca48057d89df8b34e0ac96b3e5ea8a0898de4
SHA2566ecf8a2bfa8912f66d16928552575bf329d317cc7f0879449f1b6b9ee448ba83
SHA5120a1a4fde0f1fa6b1a0807a3f306bd77f3c19b67627191f8d210077578b22590abea86c1c4b8c1cbb7e4ef1e500eb3df51361b4473e1c08818efafb564bcd85de
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD590a6265fe63c1626ad966b372434c60e
SHA1872b789483174c83f76d035addf7eb92952e0ce0
SHA25643c46f83189a4d7a6e4eb4c1319792bd85c5cbd7637188ed23ee150e61e4c86a
SHA5121c9d042b6a00186df821ecca7b8d480710ced4bac84537879df04fb79bda702bee8ab7f24c83b3e22274471491a3380bdaf77352124723e545e0db4a87fff3f2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT~RFf76b9dd.TMP
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06