Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
02/02/2024, 23:00
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://vadria.net
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://vadria.net
Resource
win10v2004-20231215-en
General
-
Target
http://vadria.net
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1140 chrome.exe 1140 chrome.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe Token: SeShutdownPrivilege 1140 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe 1140 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1140 wrote to memory of 2324 1140 chrome.exe 28 PID 1140 wrote to memory of 2324 1140 chrome.exe 28 PID 1140 wrote to memory of 2324 1140 chrome.exe 28 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2776 1140 chrome.exe 30 PID 1140 wrote to memory of 2640 1140 chrome.exe 31 PID 1140 wrote to memory of 2640 1140 chrome.exe 31 PID 1140 wrote to memory of 2640 1140 chrome.exe 31 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32 PID 1140 wrote to memory of 2864 1140 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://vadria.net1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef72a9758,0x7fef72a9768,0x7fef72a97782⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1156 --field-trial-handle=1296,i,17490953962148500503,607818700315745507,131072 /prefetch:22⤵PID:2776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1388 --field-trial-handle=1296,i,17490953962148500503,607818700315745507,131072 /prefetch:82⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1296,i,17490953962148500503,607818700315745507,131072 /prefetch:82⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2184 --field-trial-handle=1296,i,17490953962148500503,607818700315745507,131072 /prefetch:12⤵PID:3016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2192 --field-trial-handle=1296,i,17490953962148500503,607818700315745507,131072 /prefetch:12⤵PID:1836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1500 --field-trial-handle=1296,i,17490953962148500503,607818700315745507,131072 /prefetch:22⤵PID:760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3252 --field-trial-handle=1296,i,17490953962148500503,607818700315745507,131072 /prefetch:12⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3672 --field-trial-handle=1296,i,17490953962148500503,607818700315745507,131072 /prefetch:82⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD555540a230bdab55187a841cfe1aa1545
SHA1363e4734f757bdeb89868efe94907774a327695e
SHA256d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb
SHA512c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416
Filesize230B
MD500822cd0c67918c1411821bd811a63a5
SHA1d114a5af32441e093467d4ae27af9da3d34d81ff
SHA2567b604bc55b375ed52e5ffb9792015c60a8facd15f0297ccce6f4b74678dfc3bc
SHA51262d056081da5f42b03ee162fd88bb595743d93aa29754f18306439a1b493764246210e35f88ed5e556a567e60a23ffac2bde8bb96f6fdbd468eccbc51c6f09ea
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD56e6a51f1236c5865ec459126672a1d87
SHA193ccbaca146224339d806872515808d2ed7e2aaa
SHA2565c196a879ad104ea3c7ee3dc55b3a4664594525d32838c73e7b1e8a4d4c0d2ef
SHA5120f69c130a4563d839887607be08eed8ac7504ec57635ba02fc24512a3f2ac38c9f0d03f41cce487b3c4f3b485407c4d000ea4a6ac708be62380286085cc36c9c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD598cbc5082cc11497caf20b23a549ca56
SHA107370365df003dea2cfd46011750679382eb7e5e
SHA256d6f5d0833cd6f3ec4bb95d94a8eedb912e03dc5b10a8d397f70f872e7c3734f9
SHA5123b40b08cb2401c6bc3b7f0be170100083f427e4d0a1a4f332cf250c8fae00affc98665da20a4ac8295f8ce726f0dd8843fc9a8c20ab0c9104a95cc8193da4e47
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD572e9a1ffaf7792874bdf0969b3a05ce3
SHA1469edaeea1ec43a226c69e93af383290a98cda13
SHA256215cc8d379ba0b0e874be5673686a430651bbee0f1e1809592cf6acd770f83af
SHA512cfd3194e0597bf033eb9d0fc8a4789d2c0bc3b569e55820f0f0a3c246c6c48d16cfc16d73918133473fc3afc67fe3809c99bbe2b6357a25b04901e6f9decfdce
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5637653ab2e67ac3f462032869638e8a7
SHA1789fbcad41aa850a30054656ac06fd6589915c9c
SHA256ae033a029c3c60e62e49e635bfca0f1dc9ab29178820c7f5fccb3b166afbd2d7
SHA512fed85d3cc6f54ac4c54d811b7d71bce1f5ff56736f0f6598133a38bdb284f87fc5796b9103b74be8e8b1ff3aa491d4f98602e118752c640821ad1233677de20a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5e36586ffa232cdb2f7c24d7333e4f892
SHA1b30296c5fb0a183939827d2177ab93083bcbac9b
SHA256bceb7029f3d370a125eeb486491b0585bc46b6b197f8fed9cd7d88e7d2e36fe5
SHA51214a44694a3be3ab43f916645f67d22ab266a9722659f07caf47c0f689f35a16a81094e1b9ffadceb3609db5f2a9f623d96bbd61d6b92c3617cc1713f2523839d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5f15dd06788949f861158464a3d04cf9e
SHA184e629391144418cf123e50a58b3c6904dd43b69
SHA256640bfcfe50f0abd6d49c46b39a94ec89b0662f2ea1fff28ef34349fa348e4592
SHA512ee6f05f2b5a6dd32ba41ae85cf2b1f367af2c83b9715d9cc28b498edae7a03b9ed4c071ac29b673991f66ef16558ebb47f2109f79c305bedf68e4e49175fa8c7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD50f8dbbd5013e38e5a1eb92f780ca3899
SHA1a6bfcf976391c51c2c5eccae932b0a06989ff8bc
SHA2569c7d2c7b695ed43527fd3310245683f874226ff884c529fef7130d7e089eeef9
SHA512eb50bef69b9e7e04e38abdb2e7c00fa062b65390d2758d732bc069c6c88240e751cb6f043c7d05b1fb4c96c0916a89cfcbf251afd466bae7a4c0da2045cbb876
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5b33f2c372228b4f830b77e5cfffab0f6
SHA1932ffb20d4f8f6c6b94c25c9c1eb0fb85106a819
SHA2566f8924be63c77bf78bd1e4736512feb8a49d9c69b36136799bcd87f78075d41d
SHA512cbc269de090dbfada9f9e7c9b21b668516ecf8e53aa67cfc6dc77b1c65b0550571be93447e2578f7a285245c2885a71f47570f95e404b41480609df6d1945340
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
5KB
MD53486d3c5d43bff4b13fb04e280551139
SHA1aebf7ca33d68ceb87646220ca6f27f00808ab650
SHA256b5c62d1cb587ed29e4913453a9ad74047f4d936a158bfbc0d70c5aac128a96d3
SHA5128edfa579fdb8389689325319a4d99046c807446c6d097749017496d0707887f485f1d7789aae4156cbfb06fb32df3628f0b182d844626256731441f8d3d8f3cb
-
Filesize
5KB
MD542d512230c69e0677eaed7ff311b9023
SHA1a4061f035962c47df8c1e8ad41bacb219f15878b
SHA2563b3024f7e0c2816e85d44394d616da8ebd0d6eece6cad9e8eea62ddd09a8b343
SHA51222a224652fd2fb40b8e2e3f408b858ff7930b313bda629147f1b8307fe1de8cab679fb5a68ff257319e311c4304a2840d6ec2aa7a127870e32f5c125c0602b49
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06