Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
24s -
max time network
81s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19/03/2024, 17:50
Static task
static1
Behavioral task
behavioral1
Sample
cmd.bat
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
cmd.bat
Resource
win10v2004-20240226-en
General
-
Target
cmd.bat
-
Size
144B
-
MD5
31a39c1da1f977a07cd4c66f789460ba
-
SHA1
6695e3cf9f2f4d58e2144ee655a4d11310f4f0d1
-
SHA256
2fae3f8788ef5af3cd31515d9661620d014b38e02dd6f15dc1598b4f509ca182
-
SHA512
e5f6dee06cf64859da02b1fdd8e1123578974e37ba7608ee38ee29a683eb2dd5e52fee902c3c5f2cb675a7a561ebeffd67f47235ee0ff4b2dab8cdb124b4a167
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Runs ping.exe 1 TTPs 2 IoCs
pid Process 2840 PING.EXE 2592 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2556 chrome.exe 2556 chrome.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe Token: SeShutdownPrivilege 2556 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe 2556 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1704 wrote to memory of 2840 1704 cmd.exe 29 PID 1704 wrote to memory of 2840 1704 cmd.exe 29 PID 1704 wrote to memory of 2840 1704 cmd.exe 29 PID 1704 wrote to memory of 2592 1704 cmd.exe 30 PID 1704 wrote to memory of 2592 1704 cmd.exe 30 PID 1704 wrote to memory of 2592 1704 cmd.exe 30 PID 2556 wrote to memory of 2416 2556 chrome.exe 34 PID 2556 wrote to memory of 2416 2556 chrome.exe 34 PID 2556 wrote to memory of 2416 2556 chrome.exe 34 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2940 2556 chrome.exe 36 PID 2556 wrote to memory of 2120 2556 chrome.exe 37 PID 2556 wrote to memory of 2120 2556 chrome.exe 37 PID 2556 wrote to memory of 2120 2556 chrome.exe 37 PID 2556 wrote to memory of 2796 2556 chrome.exe 38 PID 2556 wrote to memory of 2796 2556 chrome.exe 38 PID 2556 wrote to memory of 2796 2556 chrome.exe 38 PID 2556 wrote to memory of 2796 2556 chrome.exe 38 PID 2556 wrote to memory of 2796 2556 chrome.exe 38 PID 2556 wrote to memory of 2796 2556 chrome.exe 38 PID 2556 wrote to memory of 2796 2556 chrome.exe 38 PID 2556 wrote to memory of 2796 2556 chrome.exe 38 PID 2556 wrote to memory of 2796 2556 chrome.exe 38 PID 2556 wrote to memory of 2796 2556 chrome.exe 38 PID 2556 wrote to memory of 2796 2556 chrome.exe 38 PID 2556 wrote to memory of 2796 2556 chrome.exe 38 PID 2556 wrote to memory of 2796 2556 chrome.exe 38
Processes
-
C:\Windows\system32\cmd.execmd /c "C:\Users\Admin\AppData\Local\Temp\cmd.bat"1⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\system32\PING.EXEping 8.8.8.8 -t2⤵
- Runs ping.exe
PID:2840
-
-
C:\Windows\system32\PING.EXEping 8.8.4.4 -t2⤵
- Runs ping.exe
PID:2592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2556 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7509758,0x7fef7509768,0x7fef75097782⤵PID:2416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1172 --field-trial-handle=1236,i,522810531473529862,15934715196847273361,131072 /prefetch:22⤵PID:2940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1524 --field-trial-handle=1236,i,522810531473529862,15934715196847273361,131072 /prefetch:82⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1576 --field-trial-handle=1236,i,522810531473529862,15934715196847273361,131072 /prefetch:82⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2024 --field-trial-handle=1236,i,522810531473529862,15934715196847273361,131072 /prefetch:12⤵PID:2820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2032 --field-trial-handle=1236,i,522810531473529862,15934715196847273361,131072 /prefetch:12⤵PID:2448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1488 --field-trial-handle=1236,i,522810531473529862,15934715196847273361,131072 /prefetch:22⤵PID:796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1376 --field-trial-handle=1236,i,522810531473529862,15934715196847273361,131072 /prefetch:12⤵PID:776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 --field-trial-handle=1236,i,522810531473529862,15934715196847273361,131072 /prefetch:82⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3824 --field-trial-handle=1236,i,522810531473529862,15934715196847273361,131072 /prefetch:12⤵PID:976
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
260KB
MD518f34071b5d522a657bc3f685e97ef75
SHA1ad2d0945f318410dfd4d141b0285a3e840f5dad3
SHA256ede8cb11fac87b72a079c1aff4bc0d8d5dcab9011830e159fbfcc3f9c4d163ae
SHA5127ff51d55b4df82836b73ec42eab32840c87f5b491724bb5325009010087d453fbe65c96897ce448f0d8515b703256fd271c44a6404d3205665aca3af8c26b3d0
-
Filesize
196KB
MD5813c1b41e435242e7365a4bcd7adcf23
SHA12d25e1564eaf93455640413b95646b3f88f9075b
SHA25670cb2151ee4ef83195855d29819491a23c5eafee2e72b7ffd9041b35363d1542
SHA512268c4fa1797700a205e37e716c1472592ad6242344645c703ab1ab8d4d68452c3ccce7cdc4d56a0b42d4061bdc793f1c79dffc397f038133387b94b2a1f4051e
-
Filesize
168B
MD5456a62d1df312822eb69e894858fa5a5
SHA1ee4a719867826eaa7f43d1383689848fe5a40097
SHA256e3564d522e0e637889c7cdf7d994eb535afa00a3f624ef675b7999519d2b9fb6
SHA512a92956bf6a4ac2196ea6c46e6ed012545c27304ce17d785fcc283d37e164ff67add0f46c650d7adf62093003f5ed02f2437ea051c4a484214b549ae7b1878ce6
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
4KB
MD5df94d85c595d3402901b22c77c735147
SHA197df993c75f7dceed5f23b09f930b8a7c66fb817
SHA25650b65f274a81807916110caf1a16ec42d55a692cdcb01e1db1d1664d76dee8e9
SHA51228379d7abe85c5a11d6b10b4995c6b598efa250368e2bc136078e6c05dfdea331bb1f1f821cb5f05d6f1a194cf2fa86c02352a0bcf3e608defcca263fa707e9d
-
Filesize
4KB
MD509c2334d9c7b0aba1dff2e82c38a9577
SHA12ac01fd9b520d4f0490f3e047bc755794bf2d2b9
SHA2561fd1d1604e5465ecf62431ba5b23004410b7833339efb92b657a1efd0e204dd4
SHA512735137bc9ac5baae653d18f6e149045ab6c9e16ac25d29bfcaf785758daf33eeb8bacee835c740239fa1642530f674786b0b37aafac9268d671e7fe752c0af07
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
260KB
MD56d5bbeabfed12302467b0444de810f20
SHA12cbf3a0eeb0b6408401ace267bc71c3029f57382
SHA2566ab78ed8e570c1e801a0c6517487ec67745e34640d30b0e4a471b569d33a2d3e
SHA512363b77be9072ee8ad710e7d967471cad3a9b51509f330fd95d982a7e61daf37325f4a0b236f41e9d165596ee7a105a1ac973281b98e189a2cb935265aa36dfb4