Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    299s
  • max time network
    291s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    23/01/2024, 09:27

General

  • Target

    https://r20.rs6.net/tn.jsp?f=001FUXmGedS_xPfk-w6WpzsexR_ZxYdVBgZESgN1EZ7t7LmQIRydzCgkrALXmZKDucpRFKtjo_35rvYy5YYl1W7JcAG9C3IpBFS5Ie_2zuuKPWbIlZ0EuC4aAlZm90mce8E4NaiV-NbL3MDE89h1tvPmeGpcAUNPPgrNh20ZfwbAxTX6ZIkAE4jOuQQsmvEspsUQXm_ueXfGctKobT11HCDqsKDTdKn8hXOnxjARMVdHDHCzOi8cCTD_w==&c=kvrbIzCDhB9g5lrayUcpAOBx8MYfTy12eD9c_HVxhRyMoBAHdOd3-g==&ch=akXoIAWDONtj0lCQZ-I0y7Zr2t8G25M8-fG_rNj8exit0NQ_OoOnMw==

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://r20.rs6.net/tn.jsp?f=001FUXmGedS_xPfk-w6WpzsexR_ZxYdVBgZESgN1EZ7t7LmQIRydzCgkrALXmZKDucpRFKtjo_35rvYy5YYl1W7JcAG9C3IpBFS5Ie_2zuuKPWbIlZ0EuC4aAlZm90mce8E4NaiV-NbL3MDE89h1tvPmeGpcAUNPPgrNh20ZfwbAxTX6ZIkAE4jOuQQsmvEspsUQXm_ueXfGctKobT11HCDqsKDTdKn8hXOnxjARMVdHDHCzOi8cCTD_w==&c=kvrbIzCDhB9g5lrayUcpAOBx8MYfTy12eD9c_HVxhRyMoBAHdOd3-g==&ch=akXoIAWDONtj0lCQZ-I0y7Zr2t8G25M8-fG_rNj8exit0NQ_OoOnMw==
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6fd9758,0x7fef6fd9768,0x7fef6fd9778
      2⤵
        PID:2432
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:2
        2⤵
          PID:2436
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1540 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:8
          2⤵
            PID:2188
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:8
            2⤵
              PID:2676
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2240 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:1
              2⤵
                PID:2652
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2232 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:1
                2⤵
                  PID:2632
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2564 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:2
                  2⤵
                    PID:744
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3224 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:1
                    2⤵
                      PID:2084
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3584 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:8
                      2⤵
                        PID:2800
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2740 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:1
                        2⤵
                          PID:816
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3484 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:1
                          2⤵
                            PID:2488
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3896 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:1
                            2⤵
                              PID:2332
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2724 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:1
                              2⤵
                                PID:2164
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4028 --field-trial-handle=1376,i,11541771542950553268,9724539989400993253,131072 /prefetch:1
                                2⤵
                                  PID:532
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                1⤵
                                  PID:524

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  21236f1ccd88432bee5b881771742bdd

                                  SHA1

                                  db444613caead6b66f07c49c9bad834eb4a12894

                                  SHA256

                                  09a66fa9b861282776da86ae09bfa9866e051ea73e58d11d28647b5ceb79ba3e

                                  SHA512

                                  362cdf635457e52de85a0ae2347392fb33fe1923884ec321c3bb27777e89bdbb387933f34eb421a43ebc022d69382f0116f7420faba084cd9b678e16e68ff632

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  7dbf31cdec62c3efa12398639ad15f92

                                  SHA1

                                  e1a1d14e54bfa0e20a4c43ff2b92fdce25912fe7

                                  SHA256

                                  8cb1f40440b5a112ceb6ad8d68476789b29ea2e33a79562e3b29a3111d13b719

                                  SHA512

                                  43d55d974ef65270adf642f485c7cab0e91982a71c414aa9491d53ffe75f1a3ef6be06b429302e55714ad466f6d3384cf4e66d8faf97e1e45fa7d9deb7cd9f35

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  8dcd65bf251b1aea550278f0674abe6f

                                  SHA1

                                  8154b5dc2e0c44a880b2d28469cf9f5c7491ea59

                                  SHA256

                                  ac127a710f5fe8c7c6f6f5603187846c175ef63d175336ab8d744e1e5661b877

                                  SHA512

                                  c71bca00c387dcacb863fe8fd958b36c0e1e73039e9d640c89bbc8c1064b9518a2a5a04a18820affb45fbd1a38974f1ca4d65aef7305f479839b24e95370596c

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  915ae1a964c6896c90c6941cd9d46e53

                                  SHA1

                                  df1faa641354fb7bb0d9ce936db97c8be9575762

                                  SHA256

                                  89a0ccebc47c0973e969b9e685bc1635606b1349fbf4ad5a2189d7af60e692b8

                                  SHA512

                                  6f1da71fb9999b1044ddd0160500f5231a1c051d588fb1a747535764408931bc366823134fe93ceeec350ed646548cbac241500409809658e6886e322014fcb9

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  4bab64126d3dda91fba21784015cda5d

                                  SHA1

                                  25fe8f90a7077f34f5e977632eb6e04e6440ab7a

                                  SHA256

                                  65332fcc38d537df3b31249d57507d1590d135bf0d2dcd691182f934b968bed2

                                  SHA512

                                  a5fd9f5f9ee54f8bde52b8fc24488b7828c48e7653be82a0dddf7458142d32d7426dee1bb1ab15a47930103da4470b16474edf5d62de515e0f4a8e19f3010fcb

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  c58950b60be85c81a23363a37d24fbdb

                                  SHA1

                                  3085f793d1a1b00023c5833f979fcd9c1d1a77c6

                                  SHA256

                                  5d736d85452a7a2f708653e9cfdc47ab35cc8fa7a4e3b363f25ee4a9476be896

                                  SHA512

                                  a2a13e8cff78817c51f9fffd465749c49c4b3a2ac977885e40fd0e20246246915ce9860b6c193f11478f53e7fbfa19276a006f052b187bcc475b41934e397101

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  4b6cf0824c6c11096882706bf4aaa584

                                  SHA1

                                  77ab3e4e6e8a5fdef25e7dd7033ffe53005f47a7

                                  SHA256

                                  c5774167dab3679163f237dbec5a3e703687166afb6aed1f3589075140f0fc71

                                  SHA512

                                  773e93b8677157d844d6c9447377e3119ad989116d659e5819f81eb914df30b99264cddd0505cdfdbfa898f51ec316ca1ce1626656fbd7fdd2f14b93a001c395

                                • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                  Filesize

                                  344B

                                  MD5

                                  3325994b718e95ad287e638fe5e4c10b

                                  SHA1

                                  32c1382ad8862d2ffd746f7ef1cb74fdd736ba16

                                  SHA256

                                  c6c1a9513dfda0cddcb2430e1b10ccdef385ef76e202956d822ea110967d061c

                                  SHA512

                                  b18e31ec603d98005de1e1ec4636d3a582835f8b297ed6e0e7db6695acc6a3747a6c04fafa255b03a1733f77c1a2a358f1584718390f942b6ad796d8c1455f49

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026

                                  Filesize

                                  201KB

                                  MD5

                                  c445ab4315d0633d446998c80764cc36

                                  SHA1

                                  47d3dee9845cc6e29b6771dd6560793b8b93000e

                                  SHA256

                                  5635695eeb70b51c449aea7a5bd3c9699c3c28c64498fb7fcb8173aad45d7242

                                  SHA512

                                  83a32ffdddf3ee56e89f232c8d05a4b00265895b0e41d13700f90fa389f0bf3f112c291c24c3819751803322b11e2ff866971d835d601672b36818c4e099bff1

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                  Filesize

                                  264KB

                                  MD5

                                  f50f89a0a91564d0b8a211f8921aa7de

                                  SHA1

                                  112403a17dd69d5b9018b8cede023cb3b54eab7d

                                  SHA256

                                  b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                  SHA512

                                  bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  4bc84955540294b45af85e389da998ce

                                  SHA1

                                  ab659d83ebaff3a33082d6f1e8c000df6efb4465

                                  SHA256

                                  f55a3c78ae145a01dae69167fe015aa8bea4cb635dd7a5021fd6139913d9c036

                                  SHA512

                                  76e083c356b865fe311a5e54dfd250e541e5046812da2c1411bc74b8429d42aae1e9535d294c08fb97372db9458491c39c0307534c9a6d2a8608e34e65852714

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  2cb2ecc54d234cad4f62e8b41cde48a2

                                  SHA1

                                  7f0294a491eff632683dcc3f3eb0be56da152364

                                  SHA256

                                  efb3ab6252f69d9396f17a86a9343b7f2b85fbda5bf29066a3c34828b6832595

                                  SHA512

                                  369fc7670ef1515f06900295095b7acbffdccc27a17376df2802aaa45ddce2fff8ee77df4c935b8ab269118d1850a4d572a555091f1f94d0237ca97bf1acf873

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  12fdfecc1ac15c4d155795f7c056f5b7

                                  SHA1

                                  d8fde2a14b4ca79be7045a816cc4b5869a209289

                                  SHA256

                                  ef63eeab9551270cb39377cf051573426c889c5ea4f43ef3264ff730ea987121

                                  SHA512

                                  b8eca993a0c55d3d26893798e12adccbe77c06084de2695f7478a953ebf0465f50c2c00b4b9dac6637f59e3ed53d2ad0146e467d77a70a86750d6e568ea78281

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                  Filesize

                                  16B

                                  MD5

                                  18e723571b00fb1694a3bad6c78e4054

                                  SHA1

                                  afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                  SHA256

                                  8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                  SHA512

                                  43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                • C:\Users\Admin\AppData\Local\Temp\Cab4DF3.tmp

                                  Filesize

                                  65KB

                                  MD5

                                  ac05d27423a85adc1622c714f2cb6184

                                  SHA1

                                  b0fe2b1abddb97837ea0195be70ab2ff14d43198

                                  SHA256

                                  c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                                  SHA512

                                  6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                                • C:\Users\Admin\AppData\Local\Temp\Tar4E15.tmp

                                  Filesize

                                  171KB

                                  MD5

                                  9c0c641c06238516f27941aa1166d427

                                  SHA1

                                  64cd549fb8cf014fcd9312aa7a5b023847b6c977

                                  SHA256

                                  4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                                  SHA512

                                  936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06