Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    45s
  • max time network
    108s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231215-en
  • resource tags

    arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/02/2024, 18:34

Errors

Reason
Machine shutdown

General

  • Target

    https://github.com/pankoza2-pl/Heptoxide.exe/blob/main/Heptoxide.zip

Malware Config

Signatures

  • Disables Task Manager via registry modification
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Writes to the Master Boot Record (MBR) 1 TTPs 3 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/pankoza2-pl/Heptoxide.exe/blob/main/Heptoxide.zip
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4068
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc61bb9758,0x7ffc61bb9768,0x7ffc61bb9778
      2⤵
        PID:4568
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:8
        2⤵
          PID:3964
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:2
          2⤵
            PID:4924
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:8
            2⤵
              PID:1836
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:1
              2⤵
                PID:4420
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:1
                2⤵
                  PID:860
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:8
                  2⤵
                    PID:2392
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:8
                    2⤵
                      PID:4604
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:8
                      2⤵
                        PID:3472
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1824,i,16159758701543029582,6137795153618882793,131072 /prefetch:8
                        2⤵
                          PID:1468
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:1828
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:4308
                          • C:\Users\Admin\AppData\Local\Temp\Temp1_Heptoxide.zip\Heptoxide.exe
                            "C:\Users\Admin\AppData\Local\Temp\Temp1_Heptoxide.zip\Heptoxide.exe"
                            1⤵
                            • Writes to the Master Boot Record (MBR)
                            • Suspicious use of SetWindowsHookEx
                            PID:1772
                            • C:\Windows\SysWOW64\cmd.exe
                              C:\Windows\system32\cmd.exe /c REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
                              2⤵
                                PID:3116
                                • C:\Windows\SysWOW64\reg.exe
                                  REG ADD hkcu\Software\Microsoft\Windows\CurrentVersion\policies\system /v DisableTaskMgr /t reg_dword /d 1 /f
                                  3⤵
                                  • Modifies registry key
                                  PID:1740
                            • C:\Windows\system32\AUDIODG.EXE
                              C:\Windows\system32\AUDIODG.EXE 0x00000000000004D0 0x000000000000048C
                              1⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2196
                            • C:\Windows\system32\LogonUI.exe
                              "LogonUI.exe" /flags:0x4 /state0:0xa3a23055 /state1:0x41c64e6d
                              1⤵
                                PID:724

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\14f21170-6fd1-4323-8df6-6d856da21e18.tmp

                                Filesize

                                6KB

                                MD5

                                0578357e4728b182c5b45b181cb06e8a

                                SHA1

                                5e0dcb909c65e000f45dda01a6427af5a475adb5

                                SHA256

                                6d88c8bbc1b67ef5a0be11a39b97573bcf36e2ceec03a45175e9a0857b6b6f99

                                SHA512

                                26014b0a74aecc68eb783490bb6f65ebaec7d585498a716e767c2a0aae3ff61646328e3bebbf913b261794446d9cc045428e373651eb04992ee17602ca715646

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                1KB

                                MD5

                                29a093fa31f3756863c2f7400dbcd2cd

                                SHA1

                                b461fea211da0a4087dc644aeb852497b91f5dc3

                                SHA256

                                7230b638e3c14d91e7f9b2f1ac23758d868b7b1392a07a66d27c2f631bef430f

                                SHA512

                                77eec5455b9b1a7b9606ff5341e20c48f29f89f7600420cca74144f736b89524483fe0b281af55183ce624e15ff5fe6c81b17169e54eedb5039f2cacbefe0733

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                Filesize

                                264KB

                                MD5

                                f50f89a0a91564d0b8a211f8921aa7de

                                SHA1

                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                SHA256

                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                SHA512

                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                53623d16125f2296ca3fb1b80ca42d7e

                                SHA1

                                22466ecd4064ea373b538875bb025d1c52d91803

                                SHA256

                                c03d340f30dc3d54f7fd15daf9e1b33e5a1d08d42e274dfbaf6039aff2743c95

                                SHA512

                                c824fb6e4bb1b0e5f8f65fccec33a289ae96be026c454efd7a1fabf8d1824531fd8f085f2134484272099bf23953cc3dc83b0ba7426d589840802930e1ac88d0

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                1KB

                                MD5

                                57c759c4426b0151b1adae21bab7bc16

                                SHA1

                                edf8fd85e2823022b9e3b2d7c7c606675a57d0cc

                                SHA256

                                51f23a302b9815b8df5778eadabc1c0321b4e2086f46bc8c7b5e78ec2920a9d4

                                SHA512

                                71c596ef175baca7e793cf8c9443622d6cc4a4b253217b2dd3e6c3471f86a118d0930c948201934d668a3ac1ba683e601539db8e8330111550762f6dd226ace3

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                1KB

                                MD5

                                5cd627000c90f48f14e30eab419bd94e

                                SHA1

                                edf82b42161622e3b6692743dcea9ba7e228051e

                                SHA256

                                2bc316318df99521da28f024d603cbc772531cbc1fb6ab7088fd8bfa9248e49b

                                SHA512

                                49d06f7a3506f46448441545087570e649a33a8fbf4d7613b768b3bbfd9e34a34d8554b0ff4e185e020e9b17917073bb0e5c75ab3f4eb43abc37479c4d188b91

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                2c686905974d0bacfc26d0f11567f281

                                SHA1

                                e9586ff96a6c45dee3c20d392acf9c37e0d34ecb

                                SHA256

                                212b194f074b9ca026748304889cbc2af94161b535c6a41ed16fd66859d7f4dc

                                SHA512

                                e3b2e6830295a0731b0e12957595b6f635cae1bd2fe9406535a73c47166f1a5483a5234be2cbcdb530f53793fa0e1ec191495075c5ca8b6af1df6dec11d0025c

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                114KB

                                MD5

                                5ff383443e9e6bf94ddb7ffa763a5267

                                SHA1

                                7954e6ac4ab0ef909b2740d0cdc8f81f6ae755c6

                                SHA256

                                8b3a32fd31f4864ab610e3398dcbef370142b8baa7802d5077a3eea9a439fd7f

                                SHA512

                                ef4a4cdc24841946af1051a7fa2fffbbea42ab4f5a903a60b1016f0e0ae9868c568245dd05f80aa742f0c629fb849541b11f8a65101306d4c854c5cb660c8b61

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                114KB

                                MD5

                                91be7472838281807b59333c13164277

                                SHA1

                                4b68446997866b71bbe6514b578d3a1fef647acc

                                SHA256

                                d3e176c8e4d668abede6c088f7724ebea1366ef48744434375490bb296f08127

                                SHA512

                                919f6bda7e183e3d90d0548f3dad8766892682be7f15cb48973125ac2fd709d2371bd596d30f01e61242733f3ba37a8ee02a2326f9583d6ef79d2902390492b4

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                              • C:\Users\Admin\Downloads\Heptoxide.zip

                                Filesize

                                112KB

                                MD5

                                d6432ec77eca2ef0059ef14192bc2a72

                                SHA1

                                d7f23e4db31753043703c91d4018ae05b6b0bc8e

                                SHA256

                                814a7c942439026ba9db24e6281f8f2af844b927c55ea71c69a1ff8881c01d45

                                SHA512

                                8ae21dc71d0fa2df0d5f92043b0a704e9c5f0aba99279f9433c1d5f440a1be437bce5c5e325e4739500de997831fb7c581da308d8e54bac2208a10b4a8e1b1d2