Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-es -
resource tags
arch:x64arch:x86image:win10v2004-20231215-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
18/01/2024, 02:54
Static task
static1
Behavioral task
behavioral1
Sample
WorldBox.exe
Resource
win10v2004-20231215-es
General
-
Target
WorldBox.exe
-
Size
635KB
-
MD5
420de223ce8a914c7b5b9d226acbf661
-
SHA1
c1cdff862b1044979c3e4b0c69c5aa8c2cb774af
-
SHA256
b96a8b35b8ae4190f14fbf2bb2de9b6dd3508fa0eca024edf20fd27bca57637e
-
SHA512
1ac9ccb498d532c2b79922233a26d8bae495a20be67f7b34a6bc1d5a961f25f1c52e1cc02376407f3e222bf58e3e0757c08d567da5709535d2382fac95b2cf4a
-
SSDEEP
6144:O/7oYfSHQPWTUg4L+B7DrLqEYredxxxvi9IzElPxxxxxxbqJfiqtZYlu:k7qTUb8/r+rwxxxvfzE1xxxxxxwfJ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133500202367556075" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1264 chrome.exe 1264 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe Token: SeShutdownPrivilege 1264 chrome.exe Token: SeCreatePagefilePrivilege 1264 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe 1264 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1264 wrote to memory of 4992 1264 chrome.exe 103 PID 1264 wrote to memory of 4992 1264 chrome.exe 103 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4468 1264 chrome.exe 105 PID 1264 wrote to memory of 4164 1264 chrome.exe 109 PID 1264 wrote to memory of 4164 1264 chrome.exe 109 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106 PID 1264 wrote to memory of 2132 1264 chrome.exe 106
Processes
-
C:\Users\Admin\AppData\Local\Temp\WorldBox.exe"C:\Users\Admin\AppData\Local\Temp\WorldBox.exe"1⤵PID:4720
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2736
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffb1cbd9758,0x7ffb1cbd9768,0x7ffb1cbd97782⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:22⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:82⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2932 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:12⤵PID:2664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:12⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:82⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4604 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:12⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4768 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:82⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4940 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:82⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:82⤵PID:3120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:82⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5244 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:82⤵PID:624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:82⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1904,i,4677063222235873663,4613584069138852475,131072 /prefetch:82⤵PID:3620
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
371B
MD5be72174a007e459dac5c34f58329c266
SHA173731a9465ec5b2ccd5a826c1094bd61b3062574
SHA256260e46af115ff1a1083c04c34446e1cc6997a55b0f0e4d39f53ad1ac207c644d
SHA512d9f24d615ca16bf8a233342f0b78b36704b006ece081368afd8b0dd6fc24e5118325b3c5c0851f08928b3b32f9eb30fb98ecb9d2e5587e4a7ba69806bfac08dc
-
Filesize
6KB
MD5575453e770d24efe321c74a8d8776ad1
SHA17454916d6bdec79b198cbd211888fc67d96e84bb
SHA25624e5dc2174a8ef719645216c31c7c0152d96a142525e07648ad5bc9fb0c40450
SHA51285d016bd8db30f33c8599e470972d04a1c4af8e71ed3649cbc9001c95e4f56789cabb0762a4b64d0eab105878acd07d33fcf95d6c0f29c9d03dcfb588567b6b2
-
Filesize
6KB
MD537f44b3a509ef6d9fe3817c02914560b
SHA128dd1e4c86d4eabfd388aa401449177217aa6ab5
SHA256559b603345a59a2dd7c04e94affa7b46f86ac08beb323ec36e8695c85b980737
SHA51250a6ffc2acb0aaf94891d8cf26deb78890ca25ec15d6c4c43650259e994e4810467f0c0cf4aea651661168c0b98975c0e8f3c30a073d7e7d8073665baf74cff6
-
Filesize
15KB
MD577544bfbebedca16d16356d67f4015a3
SHA1bd2c0588b92e524b560d6e074692b629e5ce6dfb
SHA2568961153e0d197b7bcd5950627ce1f5effbe80653bb3c1fedf966c57e3e9f189b
SHA512277f4008829c55eb60c9615ce7d0bc3c9e92206625ff6c653c97035f6cf2a00cd7b61d27a80021feab7d161ca8137f2060926e52cfc2a78cf54554b7f5c6a429
-
Filesize
229KB
MD5cec10b3aefbf69e349ed62f1414b2dad
SHA193aab77b294c16de836263422ac88abfc3d40376
SHA256b2bd4014917d83056405aceb85e2e10edd24b859fe8b21eef877cb1b280eee37
SHA51233f54a6541f6759cb2c90302bd4169bffbbe58a7b738d1d2e8bb7d11f19e571ab50822dcc5e3586d9d61ec236ed5540a535a1c02cdc41090062d928108e00422
-
Filesize
115KB
MD561c47acb7c812fc1fb8814d65b864198
SHA1770e53c8c8cfdda98a81fdec24a7f24443218c04
SHA2564efa9cffea82be5ae3bf1099edb435a1b2fde6bfb8c501250dc500e1ace52689
SHA512f9e4423312ebe18e20df9e25835405c4a58ed64183ae61c2575cc11648834c97b4eaabeba47dcf4784607fbc447ef52a1e42898871673d736db2ce998f316c19
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd