Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
41s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
19/04/2024, 10:07
Static task
static1
Behavioral task
behavioral1
Sample
Cheezy.zip
Resource
win11-20240412-en
General
-
Target
Cheezy.zip
-
Size
5.3MB
-
MD5
d63ef5c1b26523820540bc5220a05023
-
SHA1
2cf319045c187f7cd6313e936d14a6c95b2cfd74
-
SHA256
3529aa429d43c3822f095c1d3b9e90ffd3ce768f290b955b9ae30335f4da8afa
-
SHA512
dd03d849a4b0d439bffb92c2094ea1b5bd9c8bdb25debca3de77aa5b7b0b19beacc3b9d91ee537c695e6bc33992d96625cb22f70719c7f57d446944a119198e8
-
SSDEEP
98304:0ACx2jk1Ugc6n/19EnRfifUs+2Tj1ZfhXwJ0GF4Ar:0AuGgfABqJh6Yo
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133579948836243531" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3120 chrome.exe 3120 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe Token: SeShutdownPrivilege 3120 chrome.exe Token: SeCreatePagefilePrivilege 3120 chrome.exe -
Suspicious use of FindShellTrayWindow 35 IoCs
pid Process 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe -
Suspicious use of SendNotifyMessage 16 IoCs
pid Process 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe 3120 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3120 wrote to memory of 2076 3120 chrome.exe 84 PID 3120 wrote to memory of 2076 3120 chrome.exe 84 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 4008 3120 chrome.exe 85 PID 3120 wrote to memory of 3048 3120 chrome.exe 86 PID 3120 wrote to memory of 3048 3120 chrome.exe 86 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87 PID 3120 wrote to memory of 1980 3120 chrome.exe 87
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\Cheezy.zip1⤵PID:2808
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3120 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc41e8ab58,0x7ffc41e8ab68,0x7ffc41e8ab782⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 --field-trial-handle=1772,i,3835639866708817965,4937685399937530528,131072 /prefetch:22⤵PID:4008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1772,i,3835639866708817965,4937685399937530528,131072 /prefetch:82⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2200 --field-trial-handle=1772,i,3835639866708817965,4937685399937530528,131072 /prefetch:82⤵PID:1980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3052 --field-trial-handle=1772,i,3835639866708817965,4937685399937530528,131072 /prefetch:12⤵PID:4300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1772,i,3835639866708817965,4937685399937530528,131072 /prefetch:12⤵PID:4332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4180 --field-trial-handle=1772,i,3835639866708817965,4937685399937530528,131072 /prefetch:12⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4024 --field-trial-handle=1772,i,3835639866708817965,4937685399937530528,131072 /prefetch:82⤵PID:3008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4464 --field-trial-handle=1772,i,3835639866708817965,4937685399937530528,131072 /prefetch:82⤵PID:1732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4372 --field-trial-handle=1772,i,3835639866708817965,4937685399937530528,131072 /prefetch:82⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4332 --field-trial-handle=1772,i,3835639866708817965,4937685399937530528,131072 /prefetch:82⤵PID:1664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 --field-trial-handle=1772,i,3835639866708817965,4937685399937530528,131072 /prefetch:82⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1220
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD526bed8d5d96c6c4251a9ecec902e9316
SHA1f8badadff08efdafa32461704779fe14e956465b
SHA2569e245f7f46e4cc4f822dba90773818ea52e820b9b95792d1b91a61ad6dd3e30d
SHA51230e50f70c1cf9b96a25d6ece7d15243ae2e15aa92e0b1d6b22e1e9447c0edd3f57989da27cb856c34ae462f39fe2de38d6fb03e3551b118fb8f6c12ddf2711ab
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
356B
MD53557c49c3a71a4b5084c7a1a7ca45117
SHA17a2dd4e15922e782280f86332d34e06c3c9a0a25
SHA25628ce6b2342f9702d9e4866ae93b4f6de72028afeb02db128446d49c64c986991
SHA512b37a3420f9f3c1fc38a894beb848d39847762fdb57d63b4104780fd0e0745b7ac812230c228eae5103b03d26746351cbca6b06e7f10fe29895073e90e440b51c
-
Filesize
6KB
MD5881cd32ab800c7ec529ef70c1d769d61
SHA1d785da95a25a2e9967cc75d06a63bc8f2fe60518
SHA256e2dd3af07ee3e172796ba1d69cd89c578f691ab1056ab87dbeb7ddef1c5e6bda
SHA512d3690049cbf52d90e5710841b6116856e3173010f5ce79461a86d83157baec14e06fd6ac35c036f5192ca6f7ba3a7a17c77e254690a91cc0cc7a9c14b93246dc
-
Filesize
6KB
MD54c45f1cf8c8e3006d71c281a435b3148
SHA109136592ae46bbf2bde1d5a5ff687dd6aa82ba33
SHA2564902e7e21be03acaf14cb63dd18600be92901edb726039a4ad341f2752c53f31
SHA512527627d626a986f032cfb124130ccf7cd00c75145a1c8e1bee0d862027b91d3e874587c1ea9e1948cbb5df2bfb57055176c74c1f0607a60629e4658c117e1bd0
-
Filesize
16KB
MD5a55710b2f0d70d854b536724a4c0718a
SHA18f98fb897c07ac28c836c2f3e6d952f3f49ca529
SHA2561d616a55cfa3a4ee3606c81c74f20a7319ff937d74c6adee0a148b86fc12fcaf
SHA51285ad248195185e6e02328beb5b647a454cae0baa308d50c90f0bc15fecff7e8ec5354d0097fe34de7c355755ef2ccfcc358b11381948cc4999b125c97936adc6
-
Filesize
252KB
MD550b7184a861b1f26c935eaaf5a6ee545
SHA139c8a173b5d56ea5363d095f905ddea180c48e56
SHA2567b0b7c3868d0b475c624d2ea4eb2e875b7738208b00d95fc2226990eba924702
SHA512ce5f17580966cafa6456565595add85b87ab9d421dd3582974ff3bc86eb5659f6c2604795280b65405c90f59c0126689df0497ceab8475c396da2d12fd01eca8
-
Filesize
252KB
MD58e20d5f933d5d2c98af11349c7b3180a
SHA1601f47c49af432f94f1a4262393f0462aa6da5eb
SHA2567b611c7f5a267568b889a9502b54dff4be142b23193126e4cf5c20f7794f26c4
SHA512f6b6b7d84540d2762d83d6484d93ec91336e53ca97b7c4bffbc4127d395be82338f29ba3bf39c4d68abfd4bfbce52a50d92455a58d942fc125c426094d753110