Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

15/01/2025, 12:58

250115-p7l3nstjdv 10

15/01/2025, 12:56

250115-p6tq5atjcs 7

Analysis

  • max time kernel
    49s
  • max time network
    42s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    15/01/2025, 12:56

General

  • Target

    8WL@O7~XlRY.zip

  • Size

    1.3MB

  • MD5

    f2a2deb66220dec15632f27d91bbdb16

  • SHA1

    8edd492215d95f2df5088a2626fb87664697790a

  • SHA256

    de94a3e312de49229cfd088163fb38610b286c7399eb5dc15410e46a25fafb2e

  • SHA512

    ee611e2b151627adb6ce2caa5a29091a0d8e202099de56fa99fdea022a3ca03b26b5da2747a340198f81d12f57a00b58e5c7169d1ee29a38fd84e4a51fc51fd5

  • SSDEEP

    24576:mX8eLw0r9awIWR9DkplieZ2NOpo88EyV3zM1mOBACY+W8jBgGGOiFTQobTJq:m9r9FImB9fOpo443zMDBo+9WGziF0obw

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 29 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\7-Zip\7zFM.exe
    "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\8WL@O7~XlRY.zip"
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:3512
    • C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\7zO8BD593E7\README.txt
      2⤵
      • Opens file in notepad (likely ransom note)
      PID:3928
    • C:\Users\Admin\AppData\Local\Temp\7zO8BDC4CC7\Bootstrapper.exe
      "C:\Users\Admin\AppData\Local\Temp\7zO8BDC4CC7\Bootstrapper.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2028
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2576
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2488
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff70b7cc40,0x7fff70b7cc4c,0x7fff70b7cc58
      2⤵
        PID:1316
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1888 /prefetch:2
        2⤵
          PID:1576
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1504,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2100 /prefetch:3
          2⤵
            PID:2084
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2188,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2204 /prefetch:8
            2⤵
              PID:4864
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3260 /prefetch:1
              2⤵
                PID:824
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3296 /prefetch:1
                2⤵
                  PID:3976
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4404,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4448 /prefetch:1
                  2⤵
                    PID:1216
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4308,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4872 /prefetch:8
                    2⤵
                      PID:3496
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4644,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4988 /prefetch:8
                      2⤵
                        PID:1164
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4884,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5004 /prefetch:8
                        2⤵
                          PID:740
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4984,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4624 /prefetch:8
                          2⤵
                            PID:2560
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4992,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5220 /prefetch:8
                            2⤵
                              PID:3832
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4872,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5212 /prefetch:8
                              2⤵
                                PID:2900
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4848,i,1778914321620349608,639462641253872219,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5020 /prefetch:2
                                2⤵
                                  PID:4432
                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                1⤵
                                  PID:2512
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                  1⤵
                                    PID:5084

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                    Filesize

                                    649B

                                    MD5

                                    0192a25cac0d37de13d31b25be4a7b03

                                    SHA1

                                    d8de3c4d63fe643dad53f1606058f3ee237d640b

                                    SHA256

                                    3cf42aaa69bea29521bcd4d28feff6f84987504f3de3115e9f876e58ff380182

                                    SHA512

                                    1bb87fb4288d0da24bf937bfbed488f271708ed856b24d0d2a2124bf15ad1a1c97102387d6ad446034ee139f463bdb54af22f4e438073f2a20d5f63e532343f2

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\_locales\en\messages.json

                                    Filesize

                                    851B

                                    MD5

                                    07ffbe5f24ca348723ff8c6c488abfb8

                                    SHA1

                                    6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                    SHA256

                                    6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                    SHA512

                                    7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.85.1_0\dasherSettingSchema.json

                                    Filesize

                                    854B

                                    MD5

                                    4ec1df2da46182103d2ffc3b92d20ca5

                                    SHA1

                                    fb9d1ba3710cf31a87165317c6edc110e98994ce

                                    SHA256

                                    6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                    SHA512

                                    939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                    Filesize

                                    2B

                                    MD5

                                    d751713988987e9331980363e24189ce

                                    SHA1

                                    97d170e1550eee4afc0af065b78cda302a97674c

                                    SHA256

                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                    SHA512

                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    356B

                                    MD5

                                    5629b809cb7c017856422d29ac3133fc

                                    SHA1

                                    42c191584d08c8e3031a12cabac65f2ae782dce4

                                    SHA256

                                    3c085f917dc8a1b9760d7312a1e176038a5fd7e7db1441e7493e82a3b923312a

                                    SHA512

                                    67355df0fca82658577d1d6e5c2dfe676ca101da73d3320a508b41e9218cfa5c40d2d5d12f7f135009373db95e4453420cc890b9ef8a49c7bd57f0f27231bdba

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    3fecfc7a59e0a954f8221b352f2a8133

                                    SHA1

                                    f3d1970649319cf80823df036b078b707fb8d73f

                                    SHA256

                                    e0d7d41c40c3f5048937d0cb1d0149bca19927cbb8935cc855e9addf8d88749d

                                    SHA512

                                    0887384ab2dd59add5d8e96575122ffc17c9c536e764c32e44a8b20f39ad4511f2e048c9463e7ac7e9e0af10d3adde16545a0ace8832363b7995201b377f43cf

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                    Filesize

                                    15KB

                                    MD5

                                    4e400dcd2b21ef6debe0edcf1b0530ed

                                    SHA1

                                    8647c54cce71ca41f79dc26ba503ce3e403fd2e1

                                    SHA256

                                    f820824a463a522cd558ef9045d8f47634214f9091ec7b4642d69d1f0d196da4

                                    SHA512

                                    48fde73b021c6206bc901e7cbb1f3363fa962272affb35c25776219b784aac000e565fe41e131600a840ec465f60e7da2fdfbdb8ab3208266920f55230182d09

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    230KB

                                    MD5

                                    635f9479e3656b42c4be40aaf7403456

                                    SHA1

                                    6ce60e8839cc3844ccab6fc7aef7db1eceab5025

                                    SHA256

                                    8f80451c8283a5d7251ed7588f846c723685a875c3013245b94cdc23d9a6862e

                                    SHA512

                                    ab18a4855893c4f720c9a3847b9aedde7e93f36168f644a9999af5e32da2a7828133ca2f529b91ae45d198e55d48502bf23d7371e5f7f8cbe3eb4a56db2c3e27

                                  • C:\Users\Admin\AppData\Local\Temp\7zO8BD593E7\README.txt

                                    Filesize

                                    124B

                                    MD5

                                    3b4bb14e17a60137e3e93c7adac41bcb

                                    SHA1

                                    de09ed28df13d9325e816d0c656582a929077876

                                    SHA256

                                    bde691c014e6a2527d5ef783d065edf14bcfe83b20c1ff97c22d280633b5287e

                                    SHA512

                                    ec76f39b6ab4c6f822a1777c78212d659d86760458da9f050fba48bef12cba054573f25fc96278b49cdb163bed41a157123c01d3897226584cd1b57a653dfb50

                                  • C:\Users\Admin\AppData\Local\Temp\7zO8BDC4CC7\Bootstrapper.exe

                                    Filesize

                                    2.2MB

                                    MD5

                                    8ad45fd72a78fb731a2ba19df0149cae

                                    SHA1

                                    a0614e43edaa61ee50f750c95e5a9361ee76fc3d

                                    SHA256

                                    5612aad58f43e1beb974deda0f1f678e1a4b5f74dbb07a94db5b9558f2814426

                                    SHA512

                                    f94c257a90526a86fb93f0d2fbae87fa4326a3c35aac62c0cc46ee2b2b5f94faefd8d6535594e2d0e317b4c3e4ee468bf3b2b0876ee59440f7a2270d45adacea

                                  • C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_666273597\CRX_INSTALL\_locales\en\messages.json

                                    Filesize

                                    711B

                                    MD5

                                    558659936250e03cc14b60ebf648aa09

                                    SHA1

                                    32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                    SHA256

                                    2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                    SHA512

                                    1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                  • C:\Users\Admin\AppData\Local\Temp\scoped_dir2488_666273597\c81ace12-4996-4726-95c3-6de1f6b65c20.tmp

                                    Filesize

                                    150KB

                                    MD5

                                    14937b985303ecce4196154a24fc369a

                                    SHA1

                                    ecfe89e11a8d08ce0c8745ff5735d5edad683730

                                    SHA256

                                    71006a5311819fef45c659428944897184880bcdb571bf68c52b3d6ee97682ff

                                    SHA512

                                    1d03c75e4d2cd57eee7b0e93e2de293b41f280c415fb2446ac234fc5afd11fe2f2fcc8ab9843db0847c2ce6bd7df7213fcf249ea71896fbf6c0696e3f5aee46c

                                  • memory/2028-32-0x0000000003780000-0x00000000037D8000-memory.dmp

                                    Filesize

                                    352KB

                                  • memory/2028-34-0x0000000003680000-0x0000000003778000-memory.dmp

                                    Filesize

                                    992KB

                                  • memory/2028-29-0x0000000003780000-0x00000000037D8000-memory.dmp

                                    Filesize

                                    352KB

                                  • memory/2028-30-0x0000000003780000-0x00000000037D8000-memory.dmp

                                    Filesize

                                    352KB

                                  • memory/2028-31-0x0000000003780000-0x00000000037D8000-memory.dmp

                                    Filesize

                                    352KB

                                  • memory/2028-439-0x0000000000A10000-0x0000000000C42000-memory.dmp

                                    Filesize

                                    2.2MB

                                  • memory/2028-33-0x0000000003780000-0x00000000037D8000-memory.dmp

                                    Filesize

                                    352KB

                                  • memory/2028-19-0x0000000000A10000-0x0000000000C42000-memory.dmp

                                    Filesize

                                    2.2MB

                                  • memory/2028-18-0x0000000003680000-0x0000000003778000-memory.dmp

                                    Filesize

                                    992KB

                                  • memory/2028-17-0x0000000003680000-0x0000000003778000-memory.dmp

                                    Filesize

                                    992KB

                                  • memory/2028-16-0x0000000001B10000-0x0000000001C09000-memory.dmp

                                    Filesize

                                    996KB