Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240802-en -
resource tags
arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/08/2024, 00:45
Static task
static1
Behavioral task
behavioral1
Sample
setup.zip
Resource
win11-20240802-en
General
-
Target
setup.zip
-
Size
36B
-
MD5
a1ca4bebcd03fafbe2b06a46a694e29a
-
SHA1
ffc88125007c23ff6711147a12f9bba9c3d197ed
-
SHA256
c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65
-
SHA512
6fe1730bf2a6bba058c5e1ef309a69079a6acca45c0dbca4e7d79c877257ac08e460af741459d1e335197cf4de209f2a2997816f2a2a3868b2c8d086ef789b0e
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133673788761864991" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1952 chrome.exe 1952 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe Token: SeShutdownPrivilege 1952 chrome.exe Token: SeCreatePagefilePrivilege 1952 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe 1952 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 4176 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1952 wrote to memory of 1592 1952 chrome.exe 94 PID 1952 wrote to memory of 1592 1952 chrome.exe 94 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 4968 1952 chrome.exe 95 PID 1952 wrote to memory of 396 1952 chrome.exe 96 PID 1952 wrote to memory of 396 1952 chrome.exe 96 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97 PID 1952 wrote to memory of 4576 1952 chrome.exe 97
Processes
-
C:\Windows\Explorer.exeC:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\setup.zip1⤵PID:1976
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Suspicious use of SetWindowsHookEx
PID:4176
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:5092
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffbda74cc40,0x7ffbda74cc4c,0x7ffbda74cc582⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1788 /prefetch:22⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1952,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1940 /prefetch:32⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2156,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2212 /prefetch:82⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3120 /prefetch:12⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3388 /prefetch:12⤵PID:2136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4452,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4480 /prefetch:12⤵PID:1400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4672,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4620 /prefetch:82⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4816,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4808 /prefetch:82⤵PID:712
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:648
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:4712
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
352B
MD54a6a413757db7c905980f55543eaf8ca
SHA19d5b4c90335d146545c7e6e70ecb9c735e297fda
SHA2560eb967ddfe701d0ab9f017df857bfd81f12d9f29daccdf3d0a70c706cea02773
SHA5125685b7957672be7dacfb49826e184dc6f9dc976b868973c2b14947073ea060b94f964201f0a2fe1a9d4afaea01cea19e137a75ad8812a169ec8cc552f25dd521
-
Filesize
8KB
MD52974a50ff694b9c2abdef2f03aefc807
SHA13cc068ff707f83e5bca8c81226b731224c7a9936
SHA256601a80ee696c81db263d5ce85ea52479fff4b10fd24fde8cbefeed5379ec1ebf
SHA51242fdbb1dfef4a0554cb48d4d4eda238d88f542f565604d2e51bc4bf6e13e26591770affe3dc05d6ffb6dfddd52805bb01aa6cad13b9bb8f78418b11572c52c65
-
Filesize
8KB
MD56c167f3c5befc0998347ddd707724fe0
SHA1120a4588ba5dbe7724e975e76ba77767eb753731
SHA2565d91758ef60341fa4bb3409d9ead6ae65ed9ec567860ffa4ae914c7265f3f591
SHA512f2760ce8a69c5ee7a735f4eebf593f525198a8cc7674c2dbaf99cce734ab31c2d2adbb21f77acacf121ef596a3b1ac976b33adfee1d9f693fcf2072057c3cb67
-
Filesize
8KB
MD591081ec356aad805473ffaac20da6f39
SHA177f916c38575c211871a051eb40c20b52bae76df
SHA256491ec0f45d539c9893379f11c298cf456c2c08f8d9018e85675003833970816d
SHA51257a0580ed837fa0dee9cdf86213dcb2bb668c3999c71410edec97b213407345f5e97d9a8e0a9c3045ce87194d05f8cd3e95236f5e7c7dd69a17234f88f2a429c
-
Filesize
15KB
MD574e35ed577817ef38a7c2019c1a1bdaf
SHA1f8b5fdd1bae940afb57f9f2f860b870d3c14f63a
SHA2563237a5a13ee18d82baac99565435aba73ca1b8d25a488235728cd1c8c0acb264
SHA5123962b968205b17e0cfc13ad51c67be2a0168e93f8b542441bf3d6d63b20d1ecda28d5cf9954c635dd46959b568ffa0f0e42bca4aa8efff6032783856d64a0c1c
-
Filesize
195KB
MD5c1724a3b31e906fb613181ba43fa1317
SHA104263dbcf16ddcb2c8b48d29f095a3815ddbea67
SHA2564331ff2fcd67cfb7ea46fc83219885e87181d5dae0ef6b4a098b820f8f8b9beb
SHA512652653723eebeac4276698585d9e0ed05797d37675b2adb990810b820365033b32a1f24de27cc4401952ab433274597ef24e1adc58fd82f2aaaf6de45b92d0f8
-
Filesize
195KB
MD5b674a035693621bf4e58e8d7feb23698
SHA1a8bcb10be4e68e4b5a49a94b9f6b757425032790
SHA256d26a34cd7a760079f98cfe10df4c4d4c05e0d93f2cf5f794366a86af37c1c897
SHA51271e0e3eee0fe16717a49546e042f0bd5a0b7d5651b601cff4addf8c9017cf469945072c356d2dffbb4822692d40b0743b73c7de5d4dceafc81b8bbda32cc479f