Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
50s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
08/11/2024, 10:05
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
General
-
Target
file.exe
-
Size
2.0MB
-
MD5
352997f0d471f1756a7dca5ecbfc5e35
-
SHA1
3886ca9444a2316379bb66719a6d1431032712f7
-
SHA256
884ffc38baf8607522669c1e424e559215994a62639a09a7beb30f155479b85f
-
SHA512
787d55746a6f07560e0a24bd46db84ca20bfbe084dc9fcfa5c9a8986439999e2e814ae01e2ca3340f2c9ccd861b4d71c67e066a247995106353a02d3de8048c1
-
SSDEEP
49152:e3cMhG52Z+kT6lCu5L6t8HY7zS32qQxPQuSjKUtF5jA+9w0xe2Uc:e3thG+P2Lg22yTDDXii
Malware Config
Extracted
stealc
tale
http://185.215.113.206
-
url_path
/6c4adf523b719729.php
Signatures
-
Stealc family
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ file.exe -
Uses browser remote debugging 2 TTPs 4 IoCs
Can be used control the browser and steal sensitive information such as credentials and session cookies.
pid Process 1796 chrome.exe 1816 chrome.exe 2520 chrome.exe 2440 chrome.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion file.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion file.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
description ioc Process Key opened \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Wine file.exe -
Loads dropped DLL 1 IoCs
pid Process 2404 file.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2404 file.exe -
Program crash 1 IoCs
pid pid_target Process procid_target 2064 2404 WerFault.exe 29 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language file.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString file.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 file.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2404 file.exe 2404 file.exe 2404 file.exe 2440 chrome.exe 2440 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe Token: SeShutdownPrivilege 2440 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe 2440 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2404 wrote to memory of 2440 2404 file.exe 31 PID 2404 wrote to memory of 2440 2404 file.exe 31 PID 2404 wrote to memory of 2440 2404 file.exe 31 PID 2404 wrote to memory of 2440 2404 file.exe 31 PID 2440 wrote to memory of 2872 2440 chrome.exe 32 PID 2440 wrote to memory of 2872 2440 chrome.exe 32 PID 2440 wrote to memory of 2872 2440 chrome.exe 32 PID 2440 wrote to memory of 2644 2440 chrome.exe 33 PID 2440 wrote to memory of 2644 2440 chrome.exe 33 PID 2440 wrote to memory of 2644 2440 chrome.exe 33 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 2028 2440 chrome.exe 35 PID 2440 wrote to memory of 1480 2440 chrome.exe 36 PID 2440 wrote to memory of 1480 2440 chrome.exe 36 PID 2440 wrote to memory of 1480 2440 chrome.exe 36 PID 2440 wrote to memory of 1824 2440 chrome.exe 37 PID 2440 wrote to memory of 1824 2440 chrome.exe 37 PID 2440 wrote to memory of 1824 2440 chrome.exe 37 PID 2440 wrote to memory of 1824 2440 chrome.exe 37 PID 2440 wrote to memory of 1824 2440 chrome.exe 37 PID 2440 wrote to memory of 1824 2440 chrome.exe 37 PID 2440 wrote to memory of 1824 2440 chrome.exe 37 PID 2440 wrote to memory of 1824 2440 chrome.exe 37 PID 2440 wrote to memory of 1824 2440 chrome.exe 37 PID 2440 wrote to memory of 1824 2440 chrome.exe 37 PID 2440 wrote to memory of 1824 2440 chrome.exe 37 PID 2440 wrote to memory of 1824 2440 chrome.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\\Program Files\\Google\\Chrome\\Application\\chrome.exe" --remote-debugging-port=9229 --profile-directory="Default"2⤵
- Uses browser remote debugging
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef72e9758,0x7fef72e9768,0x7fef72e97783⤵PID:2872
-
-
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1096 --field-trial-handle=1180,i,14921192693673039254,10222427201650106080,131072 /prefetch:23⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1180,i,14921192693673039254,10222427201650106080,131072 /prefetch:83⤵PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1584 --field-trial-handle=1180,i,14921192693673039254,10222427201650106080,131072 /prefetch:83⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2196 --field-trial-handle=1180,i,14921192693673039254,10222427201650106080,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2220 --field-trial-handle=1180,i,14921192693673039254,10222427201650106080,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:1816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1380 --field-trial-handle=1180,i,14921192693673039254,10222427201650106080,131072 /prefetch:23⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --remote-debugging-port=9229 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1276 --field-trial-handle=1180,i,14921192693673039254,10222427201650106080,131072 /prefetch:13⤵
- Uses browser remote debugging
PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1392 --field-trial-handle=1180,i,14921192693673039254,10222427201650106080,131072 /prefetch:83⤵PID:2284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3604 --field-trial-handle=1180,i,14921192693673039254,10222427201650106080,131072 /prefetch:83⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3220 --field-trial-handle=1180,i,14921192693673039254,10222427201650106080,131072 /prefetch:83⤵PID:1608
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 8042⤵
- Program crash
PID:2064
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2700
Network
MITRE ATT&CK Enterprise v15
Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Modify Authentication Process
1Steal Web Session Cookie
1Unsecured Credentials
1Credentials In Files
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
5KB
MD5490b52dc91f929dc363d7f225ab9c823
SHA1ad7d8b6aedad1e7601e42bf1c26ad91e7ad34c37
SHA256c982876ed1364650ba7b38754004c306f3d61a33e6c0972696d8966a6c731239
SHA5129a3af1374c38c4152a795cdd37785cfe52c0c2903d331bc04d461fbe135a01ecce504e7ad8697cd5314432b7702b2a2a8ef32a867720839b08ce745fb2b124c9
-
Filesize
5KB
MD5b971b3c8b3b7325a12c82db5bc1caaab
SHA16ec5001cbfcc7482efa02196af8d19d5cda42129
SHA256137bf511c57c331a053042fa430b8d0cb77811be7c6b12bae6fef7400980cb99
SHA5120579396cfc22cbc26d011b15a566ca724efbbaf095a02e1f3dd449c70a46d0e2b906e6430d583789340930094f1314f3272afc0a2b45a394ecaab1f146ab5cc5
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
676KB
MD5eda18948a989176f4eebb175ce806255
SHA1ff22a3d5f5fb705137f233c36622c79eab995897
SHA25681a4f37c5495800b7cc46aea6535d9180dadb5c151db6f1fd1968d1cd8c1eeb4
SHA512160ed9990c37a4753fc0f5111c94414568654afbedc05308308197df2a99594f2d5d8fe511fd2279543a869ed20248e603d88a0b9b8fb119e8e6131b0c52ff85