Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
45s -
max time network
108s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
03/02/2024, 18:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/pankoza2-pl/Heptoxide.exe/blob/main/Heptoxide.zip
Resource
win11-20231215-en
Errors
General
-
Target
https://github.com/pankoza2-pl/Heptoxide.exe/blob/main/Heptoxide.zip
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 14 raw.githubusercontent.com 23 raw.githubusercontent.com -
Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 Heptoxide.exe File opened for modification \??\PhysicalDrive0 Process not Found File opened for modification \??\PhysicalDrive0 Process not Found -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133514589049687336" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-771046930-2949676035-3337286276-1000_Classes\Local Settings chrome.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 1740 reg.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4068 chrome.exe 4068 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4068 chrome.exe 4068 chrome.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: SeShutdownPrivilege 4068 chrome.exe Token: SeCreatePagefilePrivilege 4068 chrome.exe Token: 33 2196 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2196 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe 4068 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1772 Heptoxide.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4068 wrote to memory of 4568 4068 chrome.exe 77 PID 4068 wrote to memory of 4568 4068 chrome.exe 77 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 4924 4068 chrome.exe 80 PID 4068 wrote to memory of 3964 4068 chrome.exe 79 PID 4068 wrote to memory of 3964 4068 chrome.exe 79 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81 PID 4068 wrote to memory of 1836 4068 chrome.exe 81
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/Heptoxide.exe/blob/main/Heptoxide.zip1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc61bb9758,0x7ffc61bb9768,0x7ffc61bb97782⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:82⤵PID:3964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:22⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:82⤵PID:1836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:12⤵PID:4420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:12⤵PID:860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:82⤵PID:2392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:82⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:82⤵PID:3472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:82⤵PID:1468
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1828
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4308
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Heptoxide.zip\Heptoxide.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Heptoxide.zip\Heptoxide.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetWindowsHookEx
PID:1772 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f2⤵PID:3116
-
C:\Windows\SysWOW64\reg.exeREG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f3⤵
- Modifies registry key
PID:1740
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x000000000000048C1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x4 /state0:0xa3a23055 /state1:0x41c64e6d1⤵PID:724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\14f21170-6fd1-4323-8df6-6d856da21e18.tmp
Filesize6KB
MD50578357e4728b182c5b45b181cb06e8a
SHA15e0dcb909c65e000f45dda01a6427af5a475adb5
SHA2566d88c8bbc1b67ef5a0be11a39b97573bcf36e2ceec03a45175e9a0857b6b6f99
SHA51226014b0a74aecc68eb783490bb6f65ebaec7d585498a716e767c2a0aae3ff61646328e3bebbf913b261794446d9cc045428e373651eb04992ee17602ca715646
-
Filesize
1KB
MD529a093fa31f3756863c2f7400dbcd2cd
SHA1b461fea211da0a4087dc644aeb852497b91f5dc3
SHA2567230b638e3c14d91e7f9b2f1ac23758d868b7b1392a07a66d27c2f631bef430f
SHA51277eec5455b9b1a7b9606ff5341e20c48f29f89f7600420cca74144f736b89524483fe0b281af55183ce624e15ff5fe6c81b17169e54eedb5039f2cacbefe0733
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD553623d16125f2296ca3fb1b80ca42d7e
SHA122466ecd4064ea373b538875bb025d1c52d91803
SHA256c03d340f30dc3d54f7fd15daf9e1b33e5a1d08d42e274dfbaf6039aff2743c95
SHA512c824fb6e4bb1b0e5f8f65fccec33a289ae96be026c454efd7a1fabf8d1824531fd8f085f2134484272099bf23953cc3dc83b0ba7426d589840802930e1ac88d0
-
Filesize
1KB
MD557c759c4426b0151b1adae21bab7bc16
SHA1edf8fd85e2823022b9e3b2d7c7c606675a57d0cc
SHA25651f23a302b9815b8df5778eadabc1c0321b4e2086f46bc8c7b5e78ec2920a9d4
SHA51271c596ef175baca7e793cf8c9443622d6cc4a4b253217b2dd3e6c3471f86a118d0930c948201934d668a3ac1ba683e601539db8e8330111550762f6dd226ace3
-
Filesize
1KB
MD55cd627000c90f48f14e30eab419bd94e
SHA1edf82b42161622e3b6692743dcea9ba7e228051e
SHA2562bc316318df99521da28f024d603cbc772531cbc1fb6ab7088fd8bfa9248e49b
SHA51249d06f7a3506f46448441545087570e649a33a8fbf4d7613b768b3bbfd9e34a34d8554b0ff4e185e020e9b17917073bb0e5c75ab3f4eb43abc37479c4d188b91
-
Filesize
6KB
MD52c686905974d0bacfc26d0f11567f281
SHA1e9586ff96a6c45dee3c20d392acf9c37e0d34ecb
SHA256212b194f074b9ca026748304889cbc2af94161b535c6a41ed16fd66859d7f4dc
SHA512e3b2e6830295a0731b0e12957595b6f635cae1bd2fe9406535a73c47166f1a5483a5234be2cbcdb530f53793fa0e1ec191495075c5ca8b6af1df6dec11d0025c
-
Filesize
114KB
MD55ff383443e9e6bf94ddb7ffa763a5267
SHA17954e6ac4ab0ef909b2740d0cdc8f81f6ae755c6
SHA2568b3a32fd31f4864ab610e3398dcbef370142b8baa7802d5077a3eea9a439fd7f
SHA512ef4a4cdc24841946af1051a7fa2fffbbea42ab4f5a903a60b1016f0e0ae9868c568245dd05f80aa742f0c629fb849541b11f8a65101306d4c854c5cb660c8b61
-
Filesize
114KB
MD591be7472838281807b59333c13164277
SHA14b68446997866b71bbe6514b578d3a1fef647acc
SHA256d3e176c8e4d668abede6c088f7724ebea1366ef48744434375490bb296f08127
SHA512919f6bda7e183e3d90d0548f3dad8766892682be7f15cb48973125ac2fd709d2371bd596d30f01e61242733f3ba37a8ee02a2326f9583d6ef79d2902390492b4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
112KB
MD5d6432ec77eca2ef0059ef14192bc2a72
SHA1d7f23e4db31753043703c91d4018ae05b6b0bc8e
SHA256814a7c942439026ba9db24e6281f8f2af844b927c55ea71c69a1ff8881c01d45
SHA5128ae21dc71d0fa2df0d5f92043b0a704e9c5f0aba99279f9433c1d5f440a1be437bce5c5e325e4739500de997831fb7c581da308d8e54bac2208a10b4a8e1b1d2