Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

09/05/2024, 01:25

240509-bs4saadb89 8

08/05/2024, 23:29

240508-3gq6lade9x 3

08/05/2024, 23:20

240508-3bpqksfe35 3

08/05/2024, 23:17

240508-29zsrsda5v 3

08/05/2024, 23:12

240508-2663nscg6t 4

08/05/2024, 23:09

240508-25jkzsfa47 4

08/05/2024, 23:04

240508-22b2qscd7y 6

08/05/2024, 22:53

240508-2tz4labh7x 8

08/05/2024, 22:31

240508-2fqyrsba7t 7

08/05/2024, 22:31

240508-2ffg2aba5v 1

Analysis

  • max time kernel
    1799s
  • max time network
    1689s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    08/05/2024, 23:20

General

  • Target

    MICROWAVE.webp

  • Size

    59KB

  • MD5

    8c9beb192d4d9b3b8f605ce2f730a1d7

  • SHA1

    810a8fd46963e2cde9bc714177b893a633016e82

  • SHA256

    5e9abe7c0a9ee33a8597c5a923af28f91e90e706741c3e3191d9c261ebac78f7

  • SHA512

    25bcd758eba766fb2dbe89630ccf4a80c3913715452f46990e31d7edced41359e99a142ded140ab8106a5e1b89b8a2fca8815b64caa1aafeed86648c0fcc2f11

  • SSDEEP

    1536:ynOnmqlCB6c9CIdgYABxXIV3wYA3kKSG+VOe2asU8aaowh:OOKBf8agjlozYe2ya9h

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\MICROWAVE.webp
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\MICROWAVE.webp
      2⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2676
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6e79758,0x7fef6e79768,0x7fef6e79778
        3⤵
          PID:2968
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1160 --field-trial-handle=1292,i,519328902724641922,2204645937359974546,131072 /prefetch:2
          3⤵
            PID:2664
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1292,i,519328902724641922,2204645937359974546,131072 /prefetch:8
            3⤵
              PID:1376
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1592 --field-trial-handle=1292,i,519328902724641922,2204645937359974546,131072 /prefetch:8
              3⤵
                PID:2496
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2288 --field-trial-handle=1292,i,519328902724641922,2204645937359974546,131072 /prefetch:1
                3⤵
                  PID:2232
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2284 --field-trial-handle=1292,i,519328902724641922,2204645937359974546,131072 /prefetch:1
                  3⤵
                    PID:316
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1324 --field-trial-handle=1292,i,519328902724641922,2204645937359974546,131072 /prefetch:2
                    3⤵
                      PID:1616
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 --field-trial-handle=1292,i,519328902724641922,2204645937359974546,131072 /prefetch:8
                      3⤵
                        PID:2368
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1560 --field-trial-handle=1292,i,519328902724641922,2204645937359974546,131072 /prefetch:8
                        3⤵
                          PID:1304
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1968 --field-trial-handle=1292,i,519328902724641922,2204645937359974546,131072 /prefetch:1
                          3⤵
                            PID:2544
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3372 --field-trial-handle=1292,i,519328902724641922,2204645937359974546,131072 /prefetch:1
                            3⤵
                              PID:2044
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3688 --field-trial-handle=1292,i,519328902724641922,2204645937359974546,131072 /prefetch:8
                              3⤵
                                PID:2168
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3484 --field-trial-handle=1292,i,519328902724641922,2204645937359974546,131072 /prefetch:8
                                3⤵
                                  PID:656
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:304

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8534db3b-bd73-4154-8832-dc1d1cdd3839.tmp

                                Filesize

                                5KB

                                MD5

                                0383072d23bc4b03ee9857ba79fce585

                                SHA1

                                4a948024eb6d18ba103b7269550f45b64511ebb1

                                SHA256

                                e1fef1d5e45bb4a5ba0f2013f58a51344ef8f8730109eace9e978108fc4cb053

                                SHA512

                                33cf77f11ed4a2992f4366c81df1b940849e2b52d7ca9f0afe28faa3d7afbe1c20648a2c28ff90c3b39679d632566a577c6110ffd12c64de2974624cefad0315

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                                Filesize

                                16B

                                MD5

                                aefd77f47fb84fae5ea194496b44c67a

                                SHA1

                                dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                SHA256

                                4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                SHA512

                                b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                Filesize

                                264KB

                                MD5

                                f50f89a0a91564d0b8a211f8921aa7de

                                SHA1

                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                SHA256

                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                SHA512

                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                07fcb126cdfd40c9b18fca502cc35803

                                SHA1

                                41cb7e44e1582d9d5bcf90f4849a3c33cf09a37d

                                SHA256

                                b03eada36e8eebffc844b11a4fdcb684b72ba0a6bc4455470d8b6bca64caf5d3

                                SHA512

                                26071324de3dfc75fa5b0cd7c7f4dc6e44abd3d78850aab776ea60eee6bced9a46f28b949e0c5da5d996f21410b2c313a9dd5cbc2c427dc1a7d51ae7943d4d44

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                3fe46489390184e9455744a71b7d382b

                                SHA1

                                ed13c53b310232b7bb66defa6887182cfc10e7ae

                                SHA256

                                208ecf7d5f65c1791d8f9bb0ed1616f2b1f80bd42474f27065cea484a87d6c52

                                SHA512

                                78f3cb42104ef0264560597818b7179fcff400ead5355a35d5fbae484cea385512a4cc3f1266ff6547460bf36a4c3e1c181dc603c0b267cb031de0278cf7c70f

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                0d2ce913933465cc57b4f678e150eb36

                                SHA1

                                c0f4245f2ced5029f1a4061ad7ccfe72a55d5750

                                SHA256

                                d4da36dcbaa0d4d03e8bec37bbc6537fd187f38b6653cade25efb425ecf27e78

                                SHA512

                                774b12201f7bb66432d3dd444cc79548dbcc6d161d2b481c274424952f69bf790bd7b39b55ff2fce3fa9bb06e6be4ca49bc1172a01107c549dff6cd84955a82b

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                Filesize

                                16B

                                MD5

                                18e723571b00fb1694a3bad6c78e4054

                                SHA1

                                afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                SHA256

                                8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                SHA512

                                43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                277KB

                                MD5

                                b6e7721d03d069a06734024fecb1cd7d

                                SHA1

                                ce5fb7254be85732b89259edcbf029cce690e2ef

                                SHA256

                                494f783c014d67d521ab46d18762bcab5e2f5d472000b2a9ee169f75254e0212

                                SHA512

                                20d482647b0cff63a70b713837227942a8287054cbf95d93e765ab04511e92e93315118778ea1422f298d37f0c09cefd2a085425e167d014a8c62da14571a568