Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1685s -
platform
windows11-21h2_x64 -
resource
win11-20240426-en -
resource tags
arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system -
submitted
26/05/2024, 15:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.virtualbox.org/wiki/Downloads
Resource
win11-20240426-en
Behavioral task
behavioral2
Sample
https://www.virtualbox.org/wiki/Downloads
Resource
macos-20240410-en
Behavioral task
behavioral3
Sample
https://www.virtualbox.org/wiki/Downloads
Resource
debian12-armhf-20240221-en
Behavioral task
behavioral4
Sample
https://www.virtualbox.org/wiki/Downloads
Resource
ubuntu2404-amd64-20240523-en
General
-
Target
https://www.virtualbox.org/wiki/Downloads
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133612140356191585" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3356 chrome.exe 3356 chrome.exe 4748 chrome.exe 4748 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3356 chrome.exe 3356 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe Token: SeShutdownPrivilege 3356 chrome.exe Token: SeCreatePagefilePrivilege 3356 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe 3356 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3356 wrote to memory of 2304 3356 chrome.exe 77 PID 3356 wrote to memory of 2304 3356 chrome.exe 77 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 4432 3356 chrome.exe 78 PID 3356 wrote to memory of 464 3356 chrome.exe 79 PID 3356 wrote to memory of 464 3356 chrome.exe 79 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80 PID 3356 wrote to memory of 4112 3356 chrome.exe 80
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.virtualbox.org/wiki/Downloads1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3356 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe297cab58,0x7ffe297cab68,0x7ffe297cab782⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1792,i,12444564492485578728,6037434242154762865,131072 /prefetch:22⤵PID:4432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1792,i,12444564492485578728,6037434242154762865,131072 /prefetch:82⤵PID:464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2112 --field-trial-handle=1792,i,12444564492485578728,6037434242154762865,131072 /prefetch:82⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1792,i,12444564492485578728,6037434242154762865,131072 /prefetch:12⤵PID:1736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1792,i,12444564492485578728,6037434242154762865,131072 /prefetch:12⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4348 --field-trial-handle=1792,i,12444564492485578728,6037434242154762865,131072 /prefetch:82⤵PID:3440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1792,i,12444564492485578728,6037434242154762865,131072 /prefetch:82⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1256 --field-trial-handle=1792,i,12444564492485578728,6037434242154762865,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4748
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:1100
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD57d9b1f870e8feffbd6ffdc77798562de
SHA13e28fbcec6e6b8f9c4879809fcd3f39c56558817
SHA2568a39b96f6f6c27d5a0a36d0feb7db7ad0467b3dcc162cc04a896749580013e54
SHA512695f0218eadcba1dc6a3fdd3a125a92a5150e332a2233b69e77447675dd3020dd04a85e943a36515d6ca7bd2926561350da7c3a257e952e4b2cb182856dc8d5b
-
Filesize
1009B
MD5348fd3ca4aa4fa0ee19057c5c9c1d398
SHA1a3b0a1dd6aba25ffd2e0c08a6e75ed46c4aa3d80
SHA256d2b923f072d8ff7b85de2d2547012b8421940f81cef921ebe449fb0584c64dda
SHA512464b86e4a40d80e55dfde7dd2960989dbc0aa0c9dfaf859b98f0bb77e336410f768c1e0fc55f4a9536edc82177a40d461f4e71524ef9ba1a7404a7706e4f5db2
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
524B
MD51c9b83ec83c61cb0ead657f92f4973b2
SHA143743f991c157e5889e9b5ffaa565d0143af1ffd
SHA25685aa13745455859a1a50a7c756a500b7e2419632b2b041c26671fcb8312e5fb6
SHA51254db3149326383d823577badc3eba0253e55fa477d04eaa38f8377b619410b29f5065aeace4afc3447ce35b696b891d257d04577fc6e1df41c650c4b0939c2cd
-
Filesize
7KB
MD5a0c26737f4927d550a584bc021ac4d40
SHA16533adaa9d231bd06e8c50e381bdd749c340d467
SHA256b822599b6218b5b9b1b4a998697c2e0d4ac8cd67a02675bbb663e3c7e9e9d727
SHA512a2b06c82f347edecc6c5cf9bdcae200f31e138275454658b417f845fdf302a8d4058ed597352629414ab88fd9c99cbf8a4a3610ef8c664b2a10b2b1f8a2a4068
-
Filesize
130KB
MD53862be749ed5eb7d92b7fb4f89c73d90
SHA1935b570bafb0a9cbddd7a3358dfe4dc134096029
SHA25632a54e925a6546cc3a077fd70cb41588be012247f93e16a897c38fea4fcd8208
SHA5124811da8bd8bc8b665b76137832f4dc142ab3cff274b72a6f41dc5f20806fc3410378b361a1905f04b28ef7bf992d4222193e5b2a57013f1ba80d3671bd3441fe