Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
52s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
28/01/2024, 11:56
Behavioral task
behavioral1
Sample
RunWithAffinity.exe
Resource
win7-20231215-en
General
-
Target
RunWithAffinity.exe
-
Size
780KB
-
MD5
f90ef05cb27f8752beaf3880860298e7
-
SHA1
704aa6a28df00e0020bf77be72bf4847e5e51379
-
SHA256
c3404b4784d91d6a662b513ce9221ae87b8e0601a41dc75ab8a4c150d8102e47
-
SHA512
bd32eefb34e48bce3ec50f12575373ab6075dda4b29a2d57700847e757a3fe39f0307e69232e17ec5d2b3dc8b6b0fdfee9e4cc01f0e31df6d980aeb184596ad7
-
SSDEEP
12288:zBRAheUVwlPE9d0xu5UMToSOr4cKm7vDe4Yup1hRumH+gjY04xg9:zXAhvV0PFPfrtKmflXp1hRAHxg9
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/1240-0-0x0000000000400000-0x000000000057A000-memory.dmp upx behavioral1/memory/1240-1-0x0000000000400000-0x000000000057A000-memory.dmp upx -
AutoIT Executable 1 IoCs
AutoIT scripts compiled to PE executables.
resource yara_rule behavioral1/memory/1240-1-0x0000000000400000-0x000000000057A000-memory.dmp autoit_exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString RunWithAffinity.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 RunWithAffinity.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2672 chrome.exe 2672 chrome.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1240 RunWithAffinity.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe Token: SeShutdownPrivilege 2672 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1240 RunWithAffinity.exe 1240 RunWithAffinity.exe 1240 RunWithAffinity.exe 1240 RunWithAffinity.exe 1240 RunWithAffinity.exe 1240 RunWithAffinity.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1240 RunWithAffinity.exe 1240 RunWithAffinity.exe 1240 RunWithAffinity.exe 1240 RunWithAffinity.exe 1240 RunWithAffinity.exe 1240 RunWithAffinity.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe 2672 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2672 wrote to memory of 2384 2672 chrome.exe 29 PID 2672 wrote to memory of 2384 2672 chrome.exe 29 PID 2672 wrote to memory of 2384 2672 chrome.exe 29 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2604 2672 chrome.exe 31 PID 2672 wrote to memory of 2596 2672 chrome.exe 32 PID 2672 wrote to memory of 2596 2672 chrome.exe 32 PID 2672 wrote to memory of 2596 2672 chrome.exe 32 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33 PID 2672 wrote to memory of 2624 2672 chrome.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\RunWithAffinity.exe"C:\Users\Admin\AppData\Local\Temp\RunWithAffinity.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1240
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7279758,0x7fef7279768,0x7fef72797782⤵PID:2384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1148 --field-trial-handle=1164,i,4177042395035385929,6982918266015286086,131072 /prefetch:22⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1164,i,4177042395035385929,6982918266015286086,131072 /prefetch:82⤵PID:2596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1528 --field-trial-handle=1164,i,4177042395035385929,6982918266015286086,131072 /prefetch:82⤵PID:2624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1164,i,4177042395035385929,6982918266015286086,131072 /prefetch:12⤵PID:1952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2280 --field-trial-handle=1164,i,4177042395035385929,6982918266015286086,131072 /prefetch:12⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2836 --field-trial-handle=1164,i,4177042395035385929,6982918266015286086,131072 /prefetch:22⤵PID:632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3240 --field-trial-handle=1164,i,4177042395035385929,6982918266015286086,131072 /prefetch:12⤵PID:2008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3476 --field-trial-handle=1164,i,4177042395035385929,6982918266015286086,131072 /prefetch:82⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3460 --field-trial-handle=1164,i,4177042395035385929,6982918266015286086,131072 /prefetch:82⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD5a458584cc0eeb90e0b13e73277a90d1f
SHA1dc98dccaee80d58d3ecbf9db1c17dfe2d15feb02
SHA256a23e7ec7995457cd14efa7d8cb73b342ef9382919c50920dad4f33087f36e710
SHA512ea156893ff77be404087cf14053936a835f686375428ad7149b92575056db940eee8e1b5af07d8c6cd73fd6672fd28f7ceeb16b05a51204c3843ff612475898c
-
Filesize
4KB
MD58b2f16d5922b1669dc1d4a6c007eecfb
SHA1bb8655ea075b755a6afae79e249796d0b3341bcd
SHA256cb30ef4ef8cb9e6aad9661e1411266fc8a35d5f0949fb8a82b706d08a7357001
SHA512440b3aef4c1f012aa90c68da9b3a2807db1d86c0c20670994579b63e77ca35806e3a2501c8cb04ac7f87153a76dc6811ed6ca7773608f91f0378a1f2a16da8fb
-
Filesize
4KB
MD53a9fad264b1b1e68037ac0df6f3d6e92
SHA181382288e9e2c3c772ad3010aea2e7c4dc3c9b64
SHA2561e53521a3f0c106f43416302626c93cd73d6eff7f192e9bd36e95641e72c63a0
SHA51239c4c9acb2887434dce5fe1823e6bc521d938dc6f9b83af7db4db45d46f660d5cc03616399d32a2b5ccba5e85af4ec7a6c2c2a5baa344dfc94bb547cc1371258
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2