Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
16s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
06/03/2024, 07:29
Static task
static1
Behavioral task
behavioral1
Sample
To [email protected] 52818226 March 2024 .html
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
To [email protected] 52818226 March 2024 .html
Resource
win10v2004-20240226-en
General
-
Target
To [email protected] 52818226 March 2024 .html
-
Size
219KB
-
MD5
440dbc39ad7b737376bba37e536123c7
-
SHA1
9cbc24337ac2987718d5d8bf0bdc6f3fc41eb4c9
-
SHA256
2ea89c339d3db1a9c41754fb8c39e3ea3c9e8186d074ccb2a29b47c0677a5941
-
SHA512
7c5a4e420c10653f80bc76b1924d68aa3c9152d0aa88eedee181b154aa0db164773dd18697f8168c58c3b9eeef004e4d0f1a58cfbcb6247b29693a5b10d8b487
-
SSDEEP
3072:fJ3JcmYbDlcQ6jFDfqfBSHaFufbfYHTHeRGFxqPEHKjyOfQyzgBYsF2ZWScpND:fJZAlcB5fbfYHTHea0JjDfQvzvLD
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2948 chrome.exe 2948 chrome.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeShutdownPrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 2480 2948 chrome.exe 27 PID 2948 wrote to memory of 2480 2948 chrome.exe 27 PID 2948 wrote to memory of 2480 2948 chrome.exe 27 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2516 2948 chrome.exe 29 PID 2948 wrote to memory of 2396 2948 chrome.exe 30 PID 2948 wrote to memory of 2396 2948 chrome.exe 30 PID 2948 wrote to memory of 2396 2948 chrome.exe 30 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31 PID 2948 wrote to memory of 2364 2948 chrome.exe 31
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\To [email protected] 52818226 March 2024 .html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7579758,0x7fef7579768,0x7fef75797782⤵PID:2480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1228,i,2469949615685695467,12108106163941945107,131072 /prefetch:22⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1228,i,2469949615685695467,12108106163941945107,131072 /prefetch:82⤵PID:2396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1228,i,2469949615685695467,12108106163941945107,131072 /prefetch:82⤵PID:2364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2172 --field-trial-handle=1228,i,2469949615685695467,12108106163941945107,131072 /prefetch:12⤵PID:2332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2180 --field-trial-handle=1228,i,2469949615685695467,12108106163941945107,131072 /prefetch:12⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1416 --field-trial-handle=1228,i,2469949615685695467,12108106163941945107,131072 /prefetch:22⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 --field-trial-handle=1228,i,2469949615685695467,12108106163941945107,131072 /prefetch:82⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3400 --field-trial-handle=1228,i,2469949615685695467,12108106163941945107,131072 /prefetch:82⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3480 --field-trial-handle=1228,i,2469949615685695467,12108106163941945107,131072 /prefetch:12⤵PID:708
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:592
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5bfa41522cfd374101870e6fac44bea51
SHA14c89d61ddea4ecd8eac2053971ea1f71dc41eb75
SHA256996f6a26e21a122b372df13920274f86a2ef35d0f0260f415de02b027dd6ba9a
SHA5123eb205be7130c420c5b56913f983a3f70703cec07caade79a0d593de543f0d92eab039821e02d096eee5bca6e7f2add5137dea305f28fed8283288f80e8e1d26
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\CURRENT~RFf76b960.TMP
Filesize16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
987B
MD5127b50bab4121871feb850b8259d6aea
SHA17c17517ec8bdc98c097bc304449c19682e1ff00f
SHA2566613aeb767090eeb9ae7dcba9eaf8e65a8d92835c2e25059871247b9b4c9580c
SHA51258e95af04c41238694bb067ef84a4194af154aea79478b3e976ff13d02feac30403373fc7976a20fc26e1ad9154f1ad18670aacada7d122b3f402c2e4ff050c1
-
Filesize
987B
MD5ef4b62ac73458fb4971a4e1b3a23288b
SHA115f92cf06599edc5e4473d1be959ef59e81dfd6b
SHA2569b6088518b169754323112eae5dd247cbf99da86ead31e1ad5d957c660566f93
SHA5127c96a2708445151d9b04fdd6a706cf9031ed3c0200353f16a963eea01952222ab4c802ead600597cafde618152c9a037464e77e96554a7f416ed36007d2741b6
-
Filesize
684B
MD5db3323760ea88477202eed59af37e200
SHA1e430136973b299bacca83462f698e3016a72444a
SHA256d192f23d25c043e56cd2eaa11603cb8f0cdb9cf6de1ae72acfe5efc7367d93fa
SHA5123ef548d8da541e9d51dcd52ee7f3f4136d3f576c0e548eb0c1f9f0226990a341ad9dd4a6e27feee25311f9573400b49fe0ec7963f2c197e52baa1bf19e58c93c
-
Filesize
4KB
MD541884405fb376d173dba8ca982142fca
SHA194c42d9c229b4a7bcc415d3b4e316ca6e2645863
SHA2566c862ec7420819f60958681358c20cf567884173474b9f7798408359074443fa
SHA512bc40a4fca72d3fa07a3fe5a527caf1fc9b602d31fdff86e01d5e665c5ee712ca36cd3d0c8bee7d544e52220fd16470c4022024803feb51c7f2fd2e7a2364c6e2
-
Filesize
4KB
MD5f1b6a6e17f5c9547b73ab72121d14fc6
SHA15477c5c3d328a7b7749d26612d5cd870d4759ab0
SHA25658ae9ade38d7dec363fed4c79927b63ef68b5aa661e31dd2ddf3765ccb5a19ef
SHA512935ac6993ca9bf162da8373566666bb15332f2457bd9cfbdf584254697a37ac7c1f38e537dd30d7bce82d9e0b5cfd92e659b5364de6bc3812e4c5672c0d520fa
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
129KB
MD5f16397889f1a18621acb4e570f8bdbad
SHA1e2c78ec3311dd05c7de22c17eb161d5a14f81564
SHA2562ce447e4a3150ae1ddb2f5d9cc4d1714f3c1c0e07a6f58452f06b7baea372a3b
SHA5126d845c23b9ce32ede1587f0dfe4c53254166c3a89a55fc44d51c8ab781dee242f743313463a5eb54615f2c2e7294426aca0fa9e00361a0245f7dbb249cc97321
-
Filesize
129KB
MD5ec2d7142c15d75788f9867a2f13ec0ff
SHA1cd09e886a886ec369a9f7f2dd3d8a736874233cf
SHA2566764d7d5077e66678b2d03c5db2aae6efc349a84da9cf6171cea78e67b5abaad
SHA5120d77bba045a0d556860c7b0d504044da846f6b13ad9abd8f2e5dd9c2f5a783437e247f9cb8696ca8629313bfebe3715a1e928d50cf9eb637620a85222b954b6f
-
Filesize
129KB
MD5e9e3544e5b478f7f88eb941181907b1d
SHA1dd0827b00e4f04a9cc478e52cfcf512323bb535e
SHA25624a7d02218b66e5ea146398ee5efb31cce755bc050b9eca61d740b38442b6b26
SHA512a31d4f4088bc874506296840fd33dfa3ef1a4b08f2ee39265c26baeb2dda5e6ef63a2a5a6b900cf4d09803130dc0a8bd5be9d30273e3d607b070b28d05597319
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
Filesize
51KB
MD588da0f72c38dacc6c3fa996f888c38ad
SHA15f9c9b4d83483a7e5a2b5018d1dab8c2e4e9d3de
SHA25626b3c29e8c32d759ce947d7a36d304ca75411f0dce77f90e94628bb878e0c2a3
SHA51239f9b40dff19191a43ecebf62694b0ccc8dbe071ecd63a6d28101935e86a35bcdd5be07c0c5542b5ac27ad99be6e835dc02f59a7b7f2b245dfb0b57036319483