Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
17s -
max time network
12s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
27/01/2025, 01:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://drive.google.com/file/d/1G_MSQXWpKXFLMJ3nsGl_umyZLDB9ZoQM/view?usp=sharing
Resource
win11-20241007-en
General
-
Target
https://drive.google.com/file/d/1G_MSQXWpKXFLMJ3nsGl_umyZLDB9ZoQM/view?usp=sharing
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 3 drive.google.com 4 drive.google.com -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133824143981000977" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4249425805-3408538557-1766626484-1000_Classes\Local Settings\MuiCache MiniSearchHost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5048 chrome.exe 5048 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe Token: SeShutdownPrivilege 5048 chrome.exe Token: SeCreatePagefilePrivilege 5048 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe 5048 chrome.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2424 MiniSearchHost.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5048 wrote to memory of 3672 5048 chrome.exe 77 PID 5048 wrote to memory of 3672 5048 chrome.exe 77 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 4004 5048 chrome.exe 78 PID 5048 wrote to memory of 1260 5048 chrome.exe 79 PID 5048 wrote to memory of 1260 5048 chrome.exe 79 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80 PID 5048 wrote to memory of 4432 5048 chrome.exe 80
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1G_MSQXWpKXFLMJ3nsGl_umyZLDB9ZoQM/view?usp=sharing1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd4a10cc40,0x7ffd4a10cc4c,0x7ffd4a10cc582⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1776,i,11925684408001698012,16777161128196759436,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1780 /prefetch:22⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2092,i,11925684408001698012,16777161128196759436,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2112 /prefetch:32⤵PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2192,i,11925684408001698012,16777161128196759436,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2124 /prefetch:82⤵PID:4432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,11925684408001698012,16777161128196759436,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3124 /prefetch:12⤵PID:3616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,11925684408001698012,16777161128196759436,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3164 /prefetch:12⤵PID:1236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4284,i,11925684408001698012,16777161128196759436,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4420 /prefetch:12⤵PID:2632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4664,i,11925684408001698012,16777161128196759436,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4672 /prefetch:82⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:4144
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc1⤵PID:3680
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3560
-
C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2424
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD557c5ebb4fb88b1706782f7367bcf78d7
SHA10054acf0e2b87a1b602877578eef551d2a0410f6
SHA25628c771a327a835d15da7c24aef049f17cbc1967d3d8fdb0e0c0b261bb24526c2
SHA512b503e1c4925533ed76f907d6b1ee0a9b33414a8ae0cc5619df4f1bda0c0cf254234c791cecf33aa7ea0dc53952e59f1ce7c335043994e447bc24e88dc7f9e2d8
-
Filesize
432B
MD5669790731f001446b28b026b5c221a8f
SHA1652f3a4f0a9f21f096620c8b739e64e1441134c9
SHA256b15d73a9471f8fe97c2599cd050b9c4d70d007cf1e331e1d2d78a00d6a0e2419
SHA512e7f6fdc71a03aa494f6d453e32fec7cf31f95b7fe756b6a4de63bd09349baab2d4b543eb6ab7599eecf5c4c5ed8d9dcdd0881e218c18e16fd66676ef289ace71
-
Filesize
5KB
MD5960b1dd27ab41bafe283d8458dbd856e
SHA106ba6a9f0528c0e925ce004d007353daf35b8f88
SHA25622910bddeead17d8bf3bc4510b43e4a1b096cc4d635650836db2e8f154a1ab84
SHA5121d01631d6bab3903feb405f1ce60bfc8dac0f72b55a2cdf186c086329b52755208a36c18b5587ba126972e1dbc0c6645569a1d7a5af1ffabc5967dbacd405d48
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD51431bccae54d5745aa2a39cf7163d8bd
SHA1bd812726b401ce2ee5702cff147a88eac4969ba2
SHA2569c890b49faf94b29f932284af98f822ff22931c09659186f3956abe73cabad92
SHA5129d49e8c469a251b1ecec3b9632e132abb72a81cd4985687b5c5d8fb65eac913dd22af3648c2b0a825212f30f902f2c475fc59bac1be3df34db8435daff9b5b7f
-
Filesize
9KB
MD59d0f884ad95eac96d277b7779a5dfe74
SHA194cb2f3428485ee8ae8ef599a6fba4d64ae2731c
SHA256c2b1099ba1a603b53cc39fdfa1a837a5a91e560959da3b30fc3c2f83f04bb0db
SHA512d6f413c20d9ec32ede6926cb268e6c27ed51edcea0ce2bd9a0700adf3e7dce19d96abd273ef4a975dba34506bb4acc600c1ff97abb53f40230932bf21482b94f
-
Filesize
228KB
MD556a64e31452c1fe9bf1f7eb6bf273959
SHA14c336c5a0ac823ff7171783bec7859beb0ec777f
SHA256ea660014436666cd6f1324f93ac54b39ff75884c3dc4f1b27cbab2de33414343
SHA512f08436a3da1e67053ab77ad19009680011908267c519f32bed7f6c4a539f4bf380ba8e6529ceee5fe21fe13b68992ae07c6e0376f01f8e8649400c1359cf2438
-
Filesize
228KB
MD59d8d4b0130447b36af462bc0ffa197b0
SHA1d161c613506776f2e60bd20d11e67f4224416c34
SHA2568c90b1b8cfe4b4461f990994e8be5177b48898da3166db74b94d0e16469935ea
SHA512abb7528d7255770339574d284055366e8d5e0fb038eb2a72779ae8fbf5eae6bb6212e6fa86d55ab2d54b71812533644d347c369683aff43a9e03f577fc908f31
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD596329c73cc49cd960e2485210d01c4d2
SHA1a496b98ad2f2bbf26687b5b7794a26aa4470148e
SHA2564c159cab6c9ef5ff39e6141b0ccb5b8c6251a3d637520609dfbdd852fa94d466
SHA512e98736a879cad24c693d6c5939654b2fd25bf9d348f738668624214f22d541a9b781c967201ab2d43cbac9207946824a0299d482485f4b63c48d5d2a839e5baf
-
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
Filesize10KB
MD5847a64ce22adca83e091e5403ef844ed
SHA1f2cf8559f0eba3d237cee1162b811613d2a0c308
SHA2561db255895b125edbed50b5296edafaf303dde2b93a600313b6a1aa61f9ec2b88
SHA51294abff56e498bfd7af0e72a652a0b03d29cbe7d0322f43cb8fa4182cfa829ec6d608c5bb3f6deaaf1dcaae764c90036beedb503109c8080999dfaf2d6a2e9de6