Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/04/2024, 22:41
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/loneeps/Wave-Executor-Roblox
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
https://github.com/loneeps/Wave-Executor-Roblox
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
https://github.com/loneeps/Wave-Executor-Roblox
Resource
win10v2004-20240419-en
General
-
Target
https://github.com/loneeps/Wave-Executor-Roblox
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 868 chrome.exe 868 chrome.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 868 wrote to memory of 2348 868 chrome.exe 28 PID 868 wrote to memory of 2348 868 chrome.exe 28 PID 868 wrote to memory of 2348 868 chrome.exe 28 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2464 868 chrome.exe 30 PID 868 wrote to memory of 2736 868 chrome.exe 31 PID 868 wrote to memory of 2736 868 chrome.exe 31 PID 868 wrote to memory of 2736 868 chrome.exe 31 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32 PID 868 wrote to memory of 1000 868 chrome.exe 32
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/loneeps/Wave-Executor-Roblox1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7249758,0x7fef7249768,0x7fef72497782⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1368,i,1697975093147531495,16682847522370373745,131072 /prefetch:22⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1436 --field-trial-handle=1368,i,1697975093147531495,16682847522370373745,131072 /prefetch:82⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1500 --field-trial-handle=1368,i,1697975093147531495,16682847522370373745,131072 /prefetch:82⤵PID:1000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2260 --field-trial-handle=1368,i,1697975093147531495,16682847522370373745,131072 /prefetch:12⤵PID:2480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2272 --field-trial-handle=1368,i,1697975093147531495,16682847522370373745,131072 /prefetch:12⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1904 --field-trial-handle=1368,i,1697975093147531495,16682847522370373745,131072 /prefetch:22⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3392 --field-trial-handle=1368,i,1697975093147531495,16682847522370373745,131072 /prefetch:82⤵PID:580
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD5a2632fb8d4155c839557e78f711ccb46
SHA11e59659203b60a6e58e86c0f355fbabf6e23a33c
SHA2566a9f4fc64af3a32f9c4d2bdeaeef99c225337c52ab24e8e5a49fe1e1da0623dd
SHA5129c918ce608bf2804e579758b7416469ec0f530ab93bd45a2b299f045d588794353126deaf12144daf272223a033a80778844d256830fafe33d62631a5a29c4d4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD52d78da33e175335c3a6322b29c56b96f
SHA1ea256ade7823c6a3ab31c952d8ad7eb0f869cf7a
SHA2565754d497cbf74c5c8ad152e69d91a64d69075d6845ca615838f92ceb6bbe9b73
SHA5120f34b2c83f540e8a6cf7a11590c87a24e267cc7367751cd26da4e52046d2c449b13fb2cee40fd681acbde39622fe96cb539fe846a86f1f3ecfb90835d7d0590e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize344B
MD522e9d5399a5ede36900b4060bab42300
SHA1f54271a971d31f323b8538d83691d62deb8a6961
SHA256c96b5d4f99fc810dd6b023da10e3c8ee3e7148c039a279491898c80b914f87ba
SHA512d9c0f1a304b4e32dad287162cd5ce0a68861b54c91ce9b908815dfaec532f579dc188a28ceb213cbd7581aaddb9241278583f9b68476926db7a204d286374465
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
986B
MD552f97098bff1a061fc4361bd8aeacc90
SHA1ea56cf645c31aaec21b4d504add6fe7dfb969cd2
SHA2563393862d4f0ae98787c575f98b9693e6c55e3d87c421a5493d1da6f2bdd54e21
SHA51205ac3335f696fc75cc4831ca75fd6e8e174fa42cf4a9febeef6ce59e2a5485cd2665ea7eedc9fa58688f6e71f91e38dc5108ec866eccddb68759e9c1b9ffefb9
-
Filesize
526B
MD5fa2a2057649cc85efa80c027277db722
SHA118d95ca91af9a84b6033c03c82acb5eb79d709e2
SHA25623970629667e99ae0718c25e368c930be3379d25fb41a9e20f8dfde71f1ff435
SHA512102c9b37bb33246ebb74dc4fd49a418a4f361beffbc6cd1bb46359776933b412d288ab08757139b51d221134a16b82ed807d99e8ecbd970cf079762e9fe2eb9d
-
Filesize
5KB
MD50f0a96cfbee86d0e33e8e6040298a48f
SHA1df41f286951c2baca18cf15997fb8fa1a038fdc1
SHA2569943eead6dab6f2c0c863cf5d34d0fc2ee5fe9d0d3f56de53be53a64d084952c
SHA5121a119b3ac48a50217fab657dfa4effe2692b5e5ff58cacefd412a5ba47235789889678b0b94d71ca4d750d4eab4194224b5653332109a195c9967dffb5fbd06b
-
Filesize
6KB
MD52a7051924231ea6dd6df8e1846b2e2d5
SHA1716720bac7352b30ad9ed2bb291daedd5fd56de5
SHA256fcc62305b0e3603192606049158ed7b2f65146a8ff5f2db13c327c5e9bdbf3b5
SHA5124f4f2d02fe65ca6086de04098cf46623a95e0f47752f44b0e12f6ab5b53702d2573f192bef2091124cbebe070cd241470ca330d3396fee7ea13f124f2e937094
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp
Filesize16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
Filesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a