Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
553s -
max time network
1691s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
03/02/2024, 02:12
Static task
static1
Behavioral task
behavioral1
Sample
900w-k7iCjgKKe80.webp
Resource
win7-20231215-en
windows7-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
900w-k7iCjgKKe80.webp
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
1800 seconds
General
-
Target
900w-k7iCjgKKe80.webp
-
Size
14KB
-
MD5
729161c958d75da76b1a5b033e5487c3
-
SHA1
908c4e8c9ef8aa7aedb093bcbc853a325f393739
-
SHA256
cfa48b2480dd8443d9298b899b6edbf2f0254b244a95d7930ee28b7fb9f3de46
-
SHA512
881ce8710899a51d07ea38b320c5b1b41b8b011cf2b108193fb1639e45fbe5307abe371a48cb4289ac5de70211426e0837164e892ec02ca8220d5f8cd174b846
-
SSDEEP
384:oy0oO9OOeedVM8a+69zrSAG6mEanw/LT/JG+4ogd2J3vLS3z/z7u:oyFey8j61rNGQz/ZGfd8S373u
Score
3/10
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe Token: SeShutdownPrivilege 2696 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe 2696 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1180 wrote to memory of 2696 1180 cmd.exe 29 PID 1180 wrote to memory of 2696 1180 cmd.exe 29 PID 1180 wrote to memory of 2696 1180 cmd.exe 29 PID 2696 wrote to memory of 2772 2696 chrome.exe 30 PID 2696 wrote to memory of 2772 2696 chrome.exe 30 PID 2696 wrote to memory of 2772 2696 chrome.exe 30 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2564 2696 chrome.exe 32 PID 2696 wrote to memory of 2584 2696 chrome.exe 33 PID 2696 wrote to memory of 2584 2696 chrome.exe 33 PID 2696 wrote to memory of 2584 2696 chrome.exe 33 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34 PID 2696 wrote to memory of 2632 2696 chrome.exe 34
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\900w-k7iCjgKKe80.webp1⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\900w-k7iCjgKKe80.webp2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7a39758,0x7fef7a39768,0x7fef7a397783⤵PID:2772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1152 --field-trial-handle=1376,i,5499139569428614309,9734544312790695090,131072 /prefetch:23⤵PID:2564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1536 --field-trial-handle=1376,i,5499139569428614309,9734544312790695090,131072 /prefetch:83⤵PID:2584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1604 --field-trial-handle=1376,i,5499139569428614309,9734544312790695090,131072 /prefetch:83⤵PID:2632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2212 --field-trial-handle=1376,i,5499139569428614309,9734544312790695090,131072 /prefetch:13⤵PID:1456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2348 --field-trial-handle=1376,i,5499139569428614309,9734544312790695090,131072 /prefetch:13⤵PID:2668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1488 --field-trial-handle=1376,i,5499139569428614309,9734544312790695090,131072 /prefetch:23⤵PID:2408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3452 --field-trial-handle=1376,i,5499139569428614309,9734544312790695090,131072 /prefetch:83⤵PID:1940
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5e72f3a98761aa994057f44912bf48015
SHA1b948fe6a6dd96ce94e7c2b9316b2d4d1e854c8f2
SHA2569c907f5776a2f8409f5acba6e15a2419c5be229db29e853cc98fdc3e599e1ec7
SHA5127d5eb122e2af8c8f70ed5a0d44702ced5bbb017d27051f0423683d348b08c8b36f7991d489ff8e88ba559b3d8ca8c285d78b6baddc612c4107a90cef1ac304c4
-
Filesize
4KB
MD5025cc3c47bb4e071d73f8477b5480f1b
SHA16b01ec409fa47e4daf25c910062a60b41876a443
SHA2560b9ddedfb36bf49869e5ba79ea7001ee87a86c62e66a3a71ecd2484a24d0eae6
SHA5128882dfebfcd6a8966c3524c1d11e39493ea8b3afc1afe03e3211496c811861180f8b0cab39d6df52bd81e63c035f36fb507f5d0b0e6b28f3d7100e5e666a835f
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58