Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1697s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
07/03/2024, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
Striperson_Gim.webp
Resource
win11-20240221-en
General
-
Target
Striperson_Gim.webp
-
Size
8KB
-
MD5
0666863c154510a538835a4954320c1e
-
SHA1
5a149a5f06cd59703a0a7d8d2d742de0d6d5fd9f
-
SHA256
1849da9259bc62a0d50ffb5a8cc9df959892783b25a82c0bf71cae88b2c164ab
-
SHA512
9acd50f3905e92dc7316302c07e67c4499b3064cb943b5f18042175d2efdc5650d91a5debc38b471d45262893ef7b470377aad9a086489896cf8fa19cea1eadd
-
SSDEEP
192:/bimFEmqBc7WEFnXdTuPdJpwL1+gfiQkZRL3gflpHTSzqnUHjzj:/byRc7WOXdTUuAgK9hQflpH+WnU3j
Malware Config
Signatures
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133542997954280565" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3252 chrome.exe 3252 chrome.exe 1080 chrome.exe 1080 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3252 chrome.exe 3252 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe Token: SeShutdownPrivilege 3252 chrome.exe Token: SeCreatePagefilePrivilege 3252 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe 3252 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2564 wrote to memory of 3252 2564 cmd.exe 82 PID 2564 wrote to memory of 3252 2564 cmd.exe 82 PID 3252 wrote to memory of 2036 3252 chrome.exe 85 PID 3252 wrote to memory of 2036 3252 chrome.exe 85 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 756 3252 chrome.exe 87 PID 3252 wrote to memory of 1536 3252 chrome.exe 88 PID 3252 wrote to memory of 1536 3252 chrome.exe 88 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89 PID 3252 wrote to memory of 4572 3252 chrome.exe 89
Processes
-
C:\Windows\system32\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\Striperson_Gim.webp1⤵
- Suspicious use of WriteProcessMemory
PID:2564 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\Striperson_Gim.webp2⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3252 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd49589758,0x7ffd49589768,0x7ffd495897783⤵PID:2036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1820,i,5835041176464047508,11882819471000454889,131072 /prefetch:23⤵PID:756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1820,i,5835041176464047508,11882819471000454889,131072 /prefetch:83⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1820,i,5835041176464047508,11882819471000454889,131072 /prefetch:83⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2796 --field-trial-handle=1820,i,5835041176464047508,11882819471000454889,131072 /prefetch:13⤵PID:3452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2804 --field-trial-handle=1820,i,5835041176464047508,11882819471000454889,131072 /prefetch:13⤵PID:384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 --field-trial-handle=1820,i,5835041176464047508,11882819471000454889,131072 /prefetch:83⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1820,i,5835041176464047508,11882819471000454889,131072 /prefetch:83⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4640 --field-trial-handle=1820,i,5835041176464047508,11882819471000454889,131072 /prefetch:83⤵PID:3944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2948 --field-trial-handle=1820,i,5835041176464047508,11882819471000454889,131072 /prefetch:23⤵
- Suspicious behavior: EnumeratesProcesses
PID:1080
-
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2416
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d9e3e86d64342bae1b623990e905d07a
SHA1a38cea40cd7ae022e8cce6c6e0bc7728c0aef712
SHA256fb32b3774660c51f98cf177a532d9345d61435691626daf7de8ddf6535feec63
SHA512c80cc0e5f6d8bd9969aa984f1e0a4f6d533b85fca29854cd3b27305fe7867d5d986125485f42e134a7201bcfab9a0b86f205847b5e4406af85e32c23d5ed5f67
-
Filesize
6KB
MD5c3820081a5407885b4ab0ef0ec27ea2f
SHA11dded42c2f1e1604a4e7fc388d8959084c5609b2
SHA256ba4d0b4da0314f823e97b9704fdd53929346897f8ebdf10df7e59adb66f9926d
SHA512db887fe64d70ad0106d6d91b8393cab974c0dc84a6cb7ad65ea89a3b419f012c0a05acc619f2f5c11cf5ae2cbc8bafc95e11017ab8df1fd3c9806a78bffbbc5f
-
Filesize
6KB
MD550abd0f178bd63b2bf0cd82dabd9df8b
SHA1b8706acdac09d27cbe100ded94ad4bc4ec367d61
SHA25626d9b9085dff001ae4dea70a9a246f6628549f7f481c35799df96f82c502e98e
SHA512bf2d5099a1ee1404f43b8d5a7a5c630a03d157f3130b12538bd4517fc59afbfaa54616df79fa22c4dddf0f38365abb9bbda514742de70ff1278e27bbdfd153b5
-
Filesize
15KB
MD5a39867c01da0642f96fb9d475ade9531
SHA1427386cfa7754ee1ec73993e42e6341f25957ee6
SHA256966343432d859295cb47804f072a7c9a73ed9ec7b058cbb5544c450c454a4796
SHA51265aff805963d36b0a8a4a529dca26ed79790b45dd03e4476b63966a3f3f13b20301f35f6829938b536d5fdae46befb629e43a8b94bd302b7fc7e096093d326da
-
Filesize
258KB
MD502f7aa700f7568acdf5972b77a7a688b
SHA1e43b157ddf01a4cddec57dd90378852068d45669
SHA25678a99e56fac7a08d93848bc9aa639514313c47c26b411bc6bc80491e46d61584
SHA51237068de6a77ef0723bd48c19d573d0afa392d4ce45af8c91a0412dbf2790fc13518447b51fc860d293672ea5450d54ab1bba927a34f2ec11c51c69e3412d56df
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd