Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    300s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    21/09/2024, 05:16

General

  • Target

    MSIAfterburnerSetup465.exe

  • Size

    56.0MB

  • MD5

    17acf57e921224883fcfeea2e010f690

  • SHA1

    a2010ac597dff8eb54b4f62dbd5447ee3908e748

  • SHA256

    623b0f1f518e7c03e1d540415bdd159e2d03fa019d76e2024f6e6ec7489a6266

  • SHA512

    709b11b4071c750914a7a7d2013576950cdf7f769e3a7ea75b458f3cdb4f8e0ed4d5c424bb8bffa388d3fbcf97df60b2529fed822ddf3911cf5276a64ff1f2c6

  • SSDEEP

    1572864:i3Mu6Bw/3Zh8xIc+9q4qBn8pzpzhaaXMxAAPJm:icn+RCxI8/Bn84XyAPJm

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\MSIAfterburnerSetup465.exe
    "C:\Users\Admin\AppData\Local\Temp\MSIAfterburnerSetup465.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:2288
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2216
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef8099758,0x7fef8099768,0x7fef8099778
      2⤵
        PID:1908
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1132,i,5190063501544447193,16979587849653941694,131072 /prefetch:2
        2⤵
          PID:2572
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1132,i,5190063501544447193,16979587849653941694,131072 /prefetch:8
          2⤵
            PID:1600
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1616 --field-trial-handle=1132,i,5190063501544447193,16979587849653941694,131072 /prefetch:8
            2⤵
              PID:496
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2320 --field-trial-handle=1132,i,5190063501544447193,16979587849653941694,131072 /prefetch:1
              2⤵
                PID:2536
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2344 --field-trial-handle=1132,i,5190063501544447193,16979587849653941694,131072 /prefetch:1
                2⤵
                  PID:1464
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1416 --field-trial-handle=1132,i,5190063501544447193,16979587849653941694,131072 /prefetch:2
                  2⤵
                    PID:2248
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1440 --field-trial-handle=1132,i,5190063501544447193,16979587849653941694,131072 /prefetch:1
                    2⤵
                      PID:1316
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3672 --field-trial-handle=1132,i,5190063501544447193,16979587849653941694,131072 /prefetch:8
                      2⤵
                        PID:604
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2504 --field-trial-handle=1132,i,5190063501544447193,16979587849653941694,131072 /prefetch:8
                        2⤵
                          PID:2540
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:880
                        • C:\Windows\system32\AUDIODG.EXE
                          C:\Windows\system32\AUDIODG.EXE 0x580
                          1⤵
                            PID:1656

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000003

                            Filesize

                            1024KB

                            MD5

                            1375ee8f35ad301727405067dd5158e3

                            SHA1

                            0043fafe4ddafcb407d3eb30c6dcd29064fb0172

                            SHA256

                            2811a6a553a43e2df65f7e66643f4f972e025fc0786d3613f61992538625076d

                            SHA512

                            673ed3995b6fcbe947472bc67532b6b699c642fc11fd6a57039746aff3b02f653fcc899c25c630e13884dfb7060348a27bb34edb6b399343730c33aadcd67db2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                            Filesize

                            264KB

                            MD5

                            f50f89a0a91564d0b8a211f8921aa7de

                            SHA1

                            112403a17dd69d5b9018b8cede023cb3b54eab7d

                            SHA256

                            b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                            SHA512

                            bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            b4962fb68a2c99e976dc22f83b6ac622

                            SHA1

                            07bac2edd1d41c9953c03d0c1f3d95ff2fcb8127

                            SHA256

                            454463c6e09b0d5b465463eb5506d628af195a96868024f183bc0f64aff41442

                            SHA512

                            0d1f7ffbb32a01f02810be6878dacdb0621b9662926259872802095124dac8e8b4a22ef1de80b58807f9a19b6d64584fad0b3b5885a1be18e262f63f28eb6d03

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            633B

                            MD5

                            4a18e8bfea6b4c6fb24c485ff9bcd04d

                            SHA1

                            06ca2c99ef3e75cb2f919177cd1f75c87387afab

                            SHA256

                            f3e4edfe3d4c26530fd697a016fa24b236e8c8cf548b2a76f9db5b2baad257f0

                            SHA512

                            fc5b5f95aa183c3f16468878ca517b6de250d82b32bd6b7163ef7f5e70e4fbab93a26b27c2770a017462e3949ce574b3eca47e26b7ff7aea0d176ed913c9c906

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            be5722ed11e96442004496e69d22ff60

                            SHA1

                            69dc4a605260142313b13fa876082120648e7939

                            SHA256

                            494f3928a6b55aa68aec37c95219ce37cad83182e8d1ae62c665e568318136e9

                            SHA512

                            24fe039b42dca5d37c524f43f54b7ebd08d341dd95ac922c9a5d9d3e9cdbcff370144e70cca24e1549d48b093da12174bb0a65621fa9bf4b77f02fd1c558ce73

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            363B

                            MD5

                            8d425ecc437b258a09e30035756eb81a

                            SHA1

                            8de5fdb41c914708d4ac65533b48baa96670e523

                            SHA256

                            bb7e86e2d467d17d8ef1c643c7f1d5189e2612f4046ac6587083d1a12d333543

                            SHA512

                            7cee32e94208c5c4a3102c57da8b7abdfaeb562a70a1c965efd7bffbb1852a6ae439a67d0534715deb3317e4dce13319eda0a1bba60d4d5f8f874446f5dd7590

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            c95039dbfb4828129482178e219658dd

                            SHA1

                            f5d804c7bcd7a8a8eecabea9df1f8406b1753a93

                            SHA256

                            638ef5b26c115d0d20f57b056abeb4d9896b0422a65157cbfe522dcb834ee52e

                            SHA512

                            e2ad4051af4a5a17da5ca1a9e36df89670a8b3dd115fbdafe1418c0435885fc4271027cdb93686118ce0010c06698321088eef4b76b1e041cc41582fc2bde0cf

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            4KB

                            MD5

                            25625c362d2173afdb9d888db8c6991a

                            SHA1

                            6c81d165c644f60bd98a97a153cce0fce7baf364

                            SHA256

                            dc176ca600afd58406ae1bac1537a685006493f14011e78f54ca2264fe24ad3d

                            SHA512

                            da2420ae7fcbe3952154ea2a1112d540e04d7431f92c2cd513878bc8224811b9f0170c3ea521edc0256ac2cfdc96ed6c8705b9b8d552b69e2314633011b43e9a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            4KB

                            MD5

                            e3b6caafd5b3d0cefefa8d6809555181

                            SHA1

                            6dfe86c7de5518871ca16e0190eb3afeeef87144

                            SHA256

                            cdee9940dfd6bd069f2ed0bf7b11ff8b3434f73d570c81a27746411bcfb99a8e

                            SHA512

                            71bc44ff837b95ac4e08648dd990e7333b4bea4838db9c4582ae6811ee42ac0232174ebe0dc1bc8028268b72fdca9efe4e9cbd85002c2edb613720be0ecca14a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            4KB

                            MD5

                            f4429e2db60d4665707f87506d2c91a5

                            SHA1

                            8c96f37c09a833012b1038cdf85c213b6c167996

                            SHA256

                            5e9db7ac7985766f94b8071eaa30c6b6259405709960127b706177ae8f57557d

                            SHA512

                            845bbc779ef9fbc0bed4ee429c29b1d7d9778adb7441c1e489785d4c46a87183633620c8f2f578d4e869dcb403309b5bca3492047b18679fb9d0b77f2574699f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            819118dbdfe05a7239a4a682a7948eda

                            SHA1

                            96450f7d95545c27e6d5bf1229ce2be6cb8c3e58

                            SHA256

                            f09c7f05f3b1d107c6c3d10f29c16fd426a206f264693a124fc980df5f6a9417

                            SHA512

                            997f431888dfb0b09395ddd3f39e2d231f984a370fcc7f5f325444ecee728cca66aff201cd60b5db9af78ace85242ce60a2ab989cb50c9c8b12d580d0789a31e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\CURRENT

                            Filesize

                            16B

                            MD5

                            18e723571b00fb1694a3bad6c78e4054

                            SHA1

                            afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                            SHA256

                            8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                            SHA512

                            43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                          • memory/2288-59-0x0000000000410000-0x000000000041A000-memory.dmp

                            Filesize

                            40KB

                          • memory/2288-60-0x0000000000410000-0x000000000041A000-memory.dmp

                            Filesize

                            40KB

                          • memory/2288-53-0x0000000074DE0000-0x00000000754CE000-memory.dmp

                            Filesize

                            6.9MB

                          • memory/2288-44-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

                            Filesize

                            4KB

                          • memory/2288-0-0x0000000074DEE000-0x0000000074DEF000-memory.dmp

                            Filesize

                            4KB

                          • memory/2288-4-0x0000000000410000-0x000000000041A000-memory.dmp

                            Filesize

                            40KB

                          • memory/2288-3-0x0000000000410000-0x000000000041A000-memory.dmp

                            Filesize

                            40KB

                          • memory/2288-2-0x0000000074DE0000-0x00000000754CE000-memory.dmp

                            Filesize

                            6.9MB

                          • memory/2288-1-0x0000000001120000-0x0000000004922000-memory.dmp

                            Filesize

                            56.0MB