Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
53s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
01/12/2024, 21:10
Behavioral task
behavioral1
Sample
Bootstrapper (1).exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
Bootstrapper (1).exe
Resource
win10v2004-20241007-en
General
-
Target
Bootstrapper (1).exe
-
Size
81.0MB
-
MD5
2bc0fe8068f5b9594c8ae89947572bdc
-
SHA1
f444bfa901bc509b7b8d3001f79a04b515fd0437
-
SHA256
d6fa0f7efc86f5e84415d40ad1f88c3da9f2cf7eec93563563dcb220675c4fa0
-
SHA512
55db1b13156b294c22a57878f8be3fb47d431a83f989e1fb3f17a9c96edc81e8ee84dd319cccac8f86451e2f4d01d04804d4831172c967b4822d2e1e369a500f
-
SSDEEP
1572864:HGKlEWDsmwSk8IpG7V+VPhqYdfmE7cliwiYgj+h58sMwoyvhiDEN+wJq:mKeosmwSkB05awcf0wy5EyvGL
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1116 Bootstrapper (1).exe -
resource yara_rule behavioral1/files/0x0003000000020a9f-1264.dat upx behavioral1/memory/1116-1266-0x000007FEF5530000-0x000007FEF5B22000-memory.dmp upx -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2592 chrome.exe 2592 chrome.exe -
Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe Token: SeShutdownPrivilege 2592 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe 2592 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1116 1948 Bootstrapper (1).exe 30 PID 1948 wrote to memory of 1116 1948 Bootstrapper (1).exe 30 PID 1948 wrote to memory of 1116 1948 Bootstrapper (1).exe 30 PID 2592 wrote to memory of 628 2592 chrome.exe 33 PID 2592 wrote to memory of 628 2592 chrome.exe 33 PID 2592 wrote to memory of 628 2592 chrome.exe 33 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2452 2592 chrome.exe 35 PID 2592 wrote to memory of 2556 2592 chrome.exe 36 PID 2592 wrote to memory of 2556 2592 chrome.exe 36 PID 2592 wrote to memory of 2556 2592 chrome.exe 36 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37 PID 2592 wrote to memory of 2836 2592 chrome.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\Bootstrapper (1).exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper (1).exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Users\Admin\AppData\Local\Temp\Bootstrapper (1).exe"C:\Users\Admin\AppData\Local\Temp\Bootstrapper (1).exe"2⤵
- Loads dropped DLL
PID:1116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2592 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5a89758,0x7fef5a89768,0x7fef5a897782⤵PID:628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1360,i,13494477056057001779,5928446783756420817,131072 /prefetch:22⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1492 --field-trial-handle=1360,i,13494477056057001779,5928446783756420817,131072 /prefetch:82⤵PID:2556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1512 --field-trial-handle=1360,i,13494477056057001779,5928446783756420817,131072 /prefetch:82⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1360,i,13494477056057001779,5928446783756420817,131072 /prefetch:12⤵PID:2040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2328 --field-trial-handle=1360,i,13494477056057001779,5928446783756420817,131072 /prefetch:12⤵PID:2740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1388 --field-trial-handle=1360,i,13494477056057001779,5928446783756420817,131072 /prefetch:22⤵PID:3064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1448 --field-trial-handle=1360,i,13494477056057001779,5928446783756420817,131072 /prefetch:12⤵PID:536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3592 --field-trial-handle=1360,i,13494477056057001779,5928446783756420817,131072 /prefetch:82⤵PID:1984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3780 --field-trial-handle=1360,i,13494477056057001779,5928446783756420817,131072 /prefetch:12⤵PID:544
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2924
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
215KB
MD52be38925751dc3580e84c3af3a87f98d
SHA18a390d24e6588bef5da1d3db713784c11ca58921
SHA2561412046f2516b688d644ff26b6c7ef2275b6c8f132eb809bd32e118208a4ec1b
SHA5121341ffc84f16c1247eb0e9baacd26a70c6b9ee904bc2861e55b092263613c0f09072efd174b3e649a347ef3192ae92d7807cc4f5782f8fd07389703d75c4c4e2
-
Filesize
280B
MD5cd140fc3d5f4faceedde5daec22b128c
SHA1b8d6161f27f3948fa5bbbe543c118b9934c6c272
SHA25690b59b5d737e99e88c0d144a6371e86acd4d6afa213e59350ac6fc72ff621972
SHA5129ca7a5a6a188837a05286282140ec8cc7a5107ebea3e5cd1b2442d17bd6629b519ca5572c2238d24b82bca4cb59125d1f50b27d569757d96cdafe1117a2ba2e0
-
Filesize
19KB
MD5c24171c241b3da9d1d54a267ddf88934
SHA1db022a0764408bb28f985643e797082f765ac105
SHA256ed14a5e20c5efacf5545180fd3fc5ed2f9be95e9a97dead00399565582d7098f
SHA5125bd148650185bf8c3fdbd39d3495b4273498850f3de600b92c2904a0f3bc73a4e7c301edad543a0d5f06d1ad96ddba0e3e2bb56b5734ce314c147178f2222f24
-
Filesize
168B
MD5289ac38a192029558076f21b897508fb
SHA15d543be3c70e1b07eef117839507230415854504
SHA256fe773c2756f3c7377aad2816a2d462d135092909ef7f6a01dc0bcc027d6b1400
SHA5124b1a9dfbe4b0cdcb79ac7323ea2715b7e1d8d3e6978b638d1a805e7beb76d92a1eea32ea5387f8a53ed1609e3dd1679e0d1f08660d14805b09c576a55f13a232
-
Filesize
168B
MD5359edf44efb64440161612a419c4e6b2
SHA12aee41a0848e9217c383ec1d8ec8ce789d9107b8
SHA256e74b441fcc735560caf68af7511666f4f1bd1e089a4428f83b67e05cc0d0b2d6
SHA512824e4090a6a9e35dc84bb4666f16f4ef5c06ed002a10946610dad65097bd5e59ee7f2bd89e0e22f15766a7002e66263beeadaa2941448f400eb600c57c12f785
-
Filesize
5KB
MD545d03b060d81c2df245071bdabfc9967
SHA1d6717c5a04a12931e06b1ce44367b5c78aaf4e1d
SHA256204a4434bf0e1d022021fe11affc290cf9870fbbb8015eda772c616eaa54e882
SHA512baf2a11e560af51763b644454e1336ae87ee1a1fda3307b8cef8ec76c11831ac839aac896e2802d7108078bb1ec4bcd1685b69bf07c07c55bbd0478beeda286a
-
Filesize
5KB
MD5cb4580d70e75778ef2450d0bb3c1a65b
SHA199481c8d895cb678e39c93e5c56aa3b6b2a67525
SHA2569be94844636aa63c3fba83b87a0ca003ff405344d13dd1f253a315981f38eeb9
SHA512b9f269665e6f0ef318d70959f9b2b7340c53388f186b5d714a53499b0abdd411dcb7986ea1d08ac45173d9134ecc9dae9a7eaf1002ac6f9317ed165ca41f2c3e
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1.6MB
MD5548809b87186356c7ac6421562015915
SHA18fa683eed7f916302c2eb1a548c12118bea414fa
SHA2566c65da37cf6464507ad9d187a34f5b5d61544b83d831547642d17c01852599a1
SHA512c0b63bf9908e23457cf6c2551219c7951bc1a164f3a585cde750b244fa628753ee43fde35f2aa76223fd9f90cf5ea582241ab510f7373a247eae0b26817198fc