Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    240s
  • max time network
    241s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    02/08/2024, 19:46

General

  • Target

    Teddybears Sthlm, Mad Cobra - Cobrastyle (Video).mp4

  • Size

    10.8MB

  • MD5

    4be2f4f6a74d703b5a774f0f26a6c532

  • SHA1

    dae63049684e19c4c23184a355345f3c09412544

  • SHA256

    cea8a0e506198d7e86fce66da8447e711a4d80a26ac056301c6fb8b16a457d9d

  • SHA512

    5508aa8cb4a3e136080927b55edd81423d48fdfdbac052ec30e4ed44f5a65b38712ee6ff09035a5ad0c50b8fb1c913096f37a2e772e5eb3b4243050387c1c6c2

  • SSDEEP

    196608:2byXahLyri4u4ejoycOQLVj82xBMDNdptIZCkFq0CpnkDTewoDVMgYf1:2iahLyilLcOIBEhdrMCSq0ckvewXBf1

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 20 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 46 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\VideoLAN\VLC\vlc.exe
    "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\AppData\Local\Temp\Teddybears Sthlm, Mad Cobra - Cobrastyle (Video).mp4"
    1⤵
    • Suspicious behavior: AddClipboardFormatListener
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:2164
  • C:\Windows\system32\SndVol.exe
    SndVol.exe -f 46204061 8366
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:344
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7cb9758,0x7fef7cb9768,0x7fef7cb9778
      2⤵
        PID:1876
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1548,i,10536365194765595073,16082353790903680126,131072 /prefetch:2
        2⤵
          PID:1756
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1392 --field-trial-handle=1548,i,10536365194765595073,16082353790903680126,131072 /prefetch:8
          2⤵
            PID:1200
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1472 --field-trial-handle=1548,i,10536365194765595073,16082353790903680126,131072 /prefetch:8
            2⤵
              PID:1452
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2216 --field-trial-handle=1548,i,10536365194765595073,16082353790903680126,131072 /prefetch:1
              2⤵
                PID:2016
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2224 --field-trial-handle=1548,i,10536365194765595073,16082353790903680126,131072 /prefetch:1
                2⤵
                  PID:672
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1684 --field-trial-handle=1548,i,10536365194765595073,16082353790903680126,131072 /prefetch:2
                  2⤵
                    PID:2336
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1652 --field-trial-handle=1548,i,10536365194765595073,16082353790903680126,131072 /prefetch:1
                    2⤵
                      PID:1700
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3676 --field-trial-handle=1548,i,10536365194765595073,16082353790903680126,131072 /prefetch:8
                      2⤵
                        PID:2908
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:1988

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8ad30c4c-d245-4e72-93fa-3da7a9b3df25.tmp

                        Filesize

                        311KB

                        MD5

                        22025163ae53489f563f6f9e40fe6237

                        SHA1

                        904ee47c8236cbfb5db66af4376b3556f7abf810

                        SHA256

                        6e47c9931c3afb0407335d2bb7c262a2191eda6ac4e5711804cec4ecfb27ec49

                        SHA512

                        5e5a1d7f68d0f7ff7586b962621431bc35c39648558fd5f9da115859ee39ed0b857e640a21926b0f85365f3eb77e32446cd83b5722a4ca32777f590fa218c2dc

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                        Filesize

                        16B

                        MD5

                        18e723571b00fb1694a3bad6c78e4054

                        SHA1

                        afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                        SHA256

                        8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                        SHA512

                        43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                        Filesize

                        264KB

                        MD5

                        f50f89a0a91564d0b8a211f8921aa7de

                        SHA1

                        112403a17dd69d5b9018b8cede023cb3b54eab7d

                        SHA256

                        b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                        SHA512

                        bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                      • memory/344-125-0x0000000000190000-0x0000000000191000-memory.dmp

                        Filesize

                        4KB

                      • memory/2164-17-0x000007FEF7A60000-0x000007FEF7AA1000-memory.dmp

                        Filesize

                        260KB

                      • memory/2164-57-0x000007FEF27C0000-0x000007FEF27D1000-memory.dmp

                        Filesize

                        68KB

                      • memory/2164-11-0x000007FEF7B10000-0x000007FEF7B27000-memory.dmp

                        Filesize

                        92KB

                      • memory/2164-14-0x000007FEF7AB0000-0x000007FEF7AC1000-memory.dmp

                        Filesize

                        68KB

                      • memory/2164-40-0x000007FEF32C0000-0x000007FEF32D1000-memory.dmp

                        Filesize

                        68KB

                      • memory/2164-13-0x000007FEF7AD0000-0x000007FEF7AED000-memory.dmp

                        Filesize

                        116KB

                      • memory/2164-12-0x000007FEF7AF0000-0x000007FEF7B01000-memory.dmp

                        Filesize

                        68KB

                      • memory/2164-10-0x000007FEF7B30000-0x000007FEF7B41000-memory.dmp

                        Filesize

                        68KB

                      • memory/2164-9-0x000007FEF7B50000-0x000007FEF7B67000-memory.dmp

                        Filesize

                        92KB

                      • memory/2164-8-0x000007FEFBF40000-0x000007FEFBF58000-memory.dmp

                        Filesize

                        96KB

                      • memory/2164-16-0x000007FEF5490000-0x000007FEF569B000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2164-20-0x000007FEF74E0000-0x000007FEF74F1000-memory.dmp

                        Filesize

                        68KB

                      • memory/2164-21-0x000007FEF74C0000-0x000007FEF74D1000-memory.dmp

                        Filesize

                        68KB

                      • memory/2164-30-0x000007FEF5430000-0x000007FEF5487000-memory.dmp

                        Filesize

                        348KB

                      • memory/2164-29-0x000007FEF6DE0000-0x000007FEF6DF1000-memory.dmp

                        Filesize

                        68KB

                      • memory/2164-28-0x000007FEF6E00000-0x000007FEF6E7C000-memory.dmp

                        Filesize

                        496KB

                      • memory/2164-27-0x000007FEF6E80000-0x000007FEF6EE7000-memory.dmp

                        Filesize

                        412KB

                      • memory/2164-26-0x000007FEF6EF0000-0x000007FEF6F20000-memory.dmp

                        Filesize

                        192KB

                      • memory/2164-15-0x000007FEF56A0000-0x000007FEF6750000-memory.dmp

                        Filesize

                        16.7MB

                      • memory/2164-25-0x000007FEF6F20000-0x000007FEF6F38000-memory.dmp

                        Filesize

                        96KB

                      • memory/2164-24-0x000007FEF6F40000-0x000007FEF6F51000-memory.dmp

                        Filesize

                        68KB

                      • memory/2164-23-0x000007FEF6F60000-0x000007FEF6F7B000-memory.dmp

                        Filesize

                        108KB

                      • memory/2164-32-0x000007FEF5290000-0x000007FEF52A7000-memory.dmp

                        Filesize

                        92KB

                      • memory/2164-31-0x000007FEF52B0000-0x000007FEF5430000-memory.dmp

                        Filesize

                        1.5MB

                      • memory/2164-22-0x000007FEF6F80000-0x000007FEF6F91000-memory.dmp

                        Filesize

                        68KB

                      • memory/2164-19-0x000007FEF7A10000-0x000007FEF7A28000-memory.dmp

                        Filesize

                        96KB

                      • memory/2164-18-0x000007FEF7A30000-0x000007FEF7A51000-memory.dmp

                        Filesize

                        132KB

                      • memory/2164-6-0x000007FEF7CA0000-0x000007FEF7CD4000-memory.dmp

                        Filesize

                        208KB

                      • memory/2164-5-0x000000013F780000-0x000000013F878000-memory.dmp

                        Filesize

                        992KB

                      • memory/2164-34-0x000007FEF3810000-0x000007FEF3A16000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2164-7-0x000007FEF6750000-0x000007FEF6A06000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/2164-39-0x000007FEF32E0000-0x000007FEF330F000-memory.dmp

                        Filesize

                        188KB

                      • memory/2164-38-0x000007FEF7A00000-0x000007FEF7A10000-memory.dmp

                        Filesize

                        64KB

                      • memory/2164-37-0x000007FEF3730000-0x000007FEF377D000-memory.dmp

                        Filesize

                        308KB

                      • memory/2164-36-0x000007FEF3780000-0x000007FEF37C2000-memory.dmp

                        Filesize

                        264KB

                      • memory/2164-33-0x000007FEF3A20000-0x000007FEF528F000-memory.dmp

                        Filesize

                        24.4MB

                      • memory/2164-48-0x000007FEF3010000-0x000007FEF3060000-memory.dmp

                        Filesize

                        320KB

                      • memory/2164-49-0x000007FEF2FF0000-0x000007FEF3005000-memory.dmp

                        Filesize

                        84KB

                      • memory/2164-50-0x000007FEF2D40000-0x000007FEF2FF0000-memory.dmp

                        Filesize

                        2.7MB

                      • memory/2164-41-0x000007FEF32A0000-0x000007FEF32B6000-memory.dmp

                        Filesize

                        88KB

                      • memory/2164-58-0x000007FEF2750000-0x000007FEF27B1000-memory.dmp

                        Filesize

                        388KB

                      • memory/2164-62-0x000007FEF2220000-0x000007FEF226E000-memory.dmp

                        Filesize

                        312KB

                      • memory/2164-61-0x000007FEF2510000-0x000007FEF2521000-memory.dmp

                        Filesize

                        68KB

                      • memory/2164-63-0x000007FEF21C0000-0x000007FEF2217000-memory.dmp

                        Filesize

                        348KB

                      • memory/2164-64-0x000007FEF2180000-0x000007FEF21B4000-memory.dmp

                        Filesize

                        208KB

                      • memory/2164-60-0x000007FEF2680000-0x000007FEF26F4000-memory.dmp

                        Filesize

                        464KB

                      • memory/2164-59-0x000007FEF2700000-0x000007FEF2747000-memory.dmp

                        Filesize

                        284KB

                      • memory/2164-56-0x000007FEF2AF0000-0x000007FEF2B03000-memory.dmp

                        Filesize

                        76KB

                      • memory/2164-53-0x000007FEF2BC0000-0x000007FEF2D3A000-memory.dmp

                        Filesize

                        1.5MB

                      • memory/2164-55-0x000007FEF2B10000-0x000007FEF2B33000-memory.dmp

                        Filesize

                        140KB

                      • memory/2164-54-0x000007FEF2BA0000-0x000007FEF2BB5000-memory.dmp

                        Filesize

                        84KB

                      • memory/2164-52-0x000007FEF2B40000-0x000007FEF2B52000-memory.dmp

                        Filesize

                        72KB

                      • memory/2164-51-0x000007FEF2B60000-0x000007FEF2B71000-memory.dmp

                        Filesize

                        68KB

                      • memory/2164-47-0x000007FEF3060000-0x000007FEF3074000-memory.dmp

                        Filesize

                        80KB

                      • memory/2164-45-0x000007FEF30A0000-0x000007FEF310D000-memory.dmp

                        Filesize

                        436KB

                      • memory/2164-46-0x000007FEF3080000-0x000007FEF3093000-memory.dmp

                        Filesize

                        76KB

                      • memory/2164-44-0x000007FEF3110000-0x000007FEF3172000-memory.dmp

                        Filesize

                        392KB

                      • memory/2164-43-0x000007FEF3180000-0x000007FEF31C2000-memory.dmp

                        Filesize

                        264KB

                      • memory/2164-42-0x000007FEF31D0000-0x000007FEF3295000-memory.dmp

                        Filesize

                        788KB

                      • memory/2164-35-0x000007FEF37F0000-0x000007FEF3802000-memory.dmp

                        Filesize

                        72KB