Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
238s -
max time network
247s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
08/03/2024, 08:13
Static task
static1
Behavioral task
behavioral1
Sample
1709446527561x378976547485777900.html
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
1709446527561x378976547485777900.html
Resource
win10v2004-20240226-en
General
-
Target
1709446527561x378976547485777900.html
-
Size
11KB
-
MD5
e22c386ec8dcd8ec3b99d9a0edddc067
-
SHA1
5909d666a6be1ab0803e2cb82a047e212555b054
-
SHA256
04ecb4ef5281619833dffa2544eeaaec3f0b48b6f73a5f1923a93f371c6cc145
-
SHA512
28b78d56fc889ce176510a06cebe32a3f687b044ef08bb15b232b2c5e7c38b9fc522d965d3627813dd103971037b9c148382e6293ecf9c1980c80b28b64f25e5
-
SSDEEP
192:FO1Ybf6HHEbAlLPiLa9OHffdwWPxmE3zyViw49qMYqeqp8Fq3V212E6:FAYbf6Hk4O/fdwWPxmgzyViw40MpLp8C
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 1660 1804 chrome.exe 28 PID 1804 wrote to memory of 1660 1804 chrome.exe 28 PID 1804 wrote to memory of 1660 1804 chrome.exe 28 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 1976 1804 chrome.exe 30 PID 1804 wrote to memory of 2596 1804 chrome.exe 31 PID 1804 wrote to memory of 2596 1804 chrome.exe 31 PID 1804 wrote to memory of 2596 1804 chrome.exe 31 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32 PID 1804 wrote to memory of 2812 1804 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1709446527561x378976547485777900.html1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6d49758,0x7fef6d49768,0x7fef6d497782⤵PID:1660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1196 --field-trial-handle=1396,i,6454035022759733900,1335995906350753947,131072 /prefetch:22⤵PID:1976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1540 --field-trial-handle=1396,i,6454035022759733900,1335995906350753947,131072 /prefetch:82⤵PID:2596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1644 --field-trial-handle=1396,i,6454035022759733900,1335995906350753947,131072 /prefetch:82⤵PID:2812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2264 --field-trial-handle=1396,i,6454035022759733900,1335995906350753947,131072 /prefetch:12⤵PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1396,i,6454035022759733900,1335995906350753947,131072 /prefetch:12⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1504 --field-trial-handle=1396,i,6454035022759733900,1335995906350753947,131072 /prefetch:22⤵PID:1524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3520 --field-trial-handle=1396,i,6454035022759733900,1335995906350753947,131072 /prefetch:82⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5731f6785d660a65309abaf1c936ae317
SHA1884069ad90097fae8ac904320370cdd3b6eefc0d
SHA2565d590bd4895c2af911df56010f22dd6d10afed3ab44b62fa44dbbe0e5a06a194
SHA512b755e0b30030f974627a6f14f244d029eec805096871cc709922e17c4445e69623a9022828b3066bab52ed0958f96ea7a5573e774e41961934e7192e3e64b857
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5ca187aadae859ab45b59acbd0b8f8ab2
SHA194919761b47f388c029cce86d09d6590ca9eab55
SHA256a97450f459fa2dfd337adfb6d72e61ffc67ad80d4839430660baadc8fc0d3ba2
SHA512e6da3fc994d7a4025e34cf750f52420859b5e6be856eab115b4f3ea72e21477b2003fb7f430a1be4442be85812f34be7da3dc899217c98701fc416e81c8111fa
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD5fb2ef3851858d0f5ec29ad8821dd3577
SHA1fcc4f48b4edebce5761dc3b17f73b7f1a9a0cfe6
SHA256f9386199bffa83fb7f2ebd947878c93828eb1f38167bf1a3003f775f1d654f7c
SHA51241516e8d3f28d85a59121a9fc6f94bd75ef1ef282c08b07a7f0983c2076988ee9efff3f12ddb785a2f71d2edddaf8f8e635838bd4e7b3f2366a3368372d8c1aa
-
Filesize
5KB
MD550c2ecd5aef61b23d83b570d201758a8
SHA19f1b12e53a81ac642a638f19a054890060a0a06c
SHA2560de23d85427a09997b75f2d46bfe0a4d1698e6c6703d0a283fc33e1665bd8daa
SHA512ed535d11501ee6818b6c0200a5fe5ea598d40819c3ad37ae47e7689d7db3e6571d9ae2f685899b6e618244b7ec48d708cf7d680feaa2d57cfd29bc0d2eeaa21e
-
Filesize
5KB
MD57ebc74d9e35ca2fab7f5cc08baab570f
SHA18b5dab4aff3a7e9cd0d7709b8ad95e8f802c4c81
SHA256c6012645c769c6a8683d28ad2b28f826c04d33fce6acac85ffdd22ff40423d1f
SHA51232689b8df4ad3c9eee9c71bb486413d11e12fee97570850048eec90a2d1c454cfaf77c208dd134c7f8633f15818682e91f923c30241fa486c1c87775c2b2f86f
-
Filesize
5KB
MD52405c04365c1bc40a6de2b51bcfc9b38
SHA1345333d79b219ef6416834c7b3fef5dfd75395ff
SHA25617267088048410819a3862d46825ddb88e14b0a70277ea2644a0292898a3352f
SHA5122887985168a63e1a89f32660f8ee9e68d8a8fe2e5a9a96e86f1f1015dbe0a20196cc518a4115f6ff9571b8a294b9e1a77eea7f8ba5ff1854e66496972864759a
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63