Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
110s -
max time network
133s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
11/02/2025, 06:45
Behavioral task
behavioral1
Sample
passwd.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
passwd.exe
Resource
win10v2004-20250207-en
Behavioral task
behavioral3
Sample
szczur.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
szczur.exe
Resource
win10v2004-20250207-en
General
-
Target
passwd.exe
-
Size
10.0MB
-
MD5
6c7345f80de6e0d5b32351be100a2279
-
SHA1
f5ef6f10a2cab097997fddfa891a728119900549
-
SHA256
36c3f97c77b6cc7871006ed40962ad8812389ce4d26787579789340820a6a135
-
SHA512
3823fdeeef994b68bba37b463e383585a455932637f0dd167e9fd018a3bf1445855c34432b90fe5fe32447853ad94a026578da3010c2db4a8b2742acb7fff04b
-
SSDEEP
196608:zWc0ejQ3SfeNTfm/pf+xk4dWRimrbW3jmyr:uCcy/pWu4kRimrbmy8
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2852 passwd.exe -
resource yara_rule behavioral1/files/0x000500000001a463-21.dat upx behavioral1/memory/2852-23-0x000007FEF5F10000-0x000007FEF64F8000-memory.dmp upx -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2172 chrome.exe 2172 chrome.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2840 wrote to memory of 2852 2840 passwd.exe 29 PID 2840 wrote to memory of 2852 2840 passwd.exe 29 PID 2840 wrote to memory of 2852 2840 passwd.exe 29 PID 2172 wrote to memory of 1672 2172 chrome.exe 31 PID 2172 wrote to memory of 1672 2172 chrome.exe 31 PID 2172 wrote to memory of 1672 2172 chrome.exe 31 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2508 2172 chrome.exe 33 PID 2172 wrote to memory of 2188 2172 chrome.exe 34 PID 2172 wrote to memory of 2188 2172 chrome.exe 34 PID 2172 wrote to memory of 2188 2172 chrome.exe 34 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35 PID 2172 wrote to memory of 2808 2172 chrome.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\passwd.exe"C:\Users\Admin\AppData\Local\Temp\passwd.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2840 -
C:\Users\Admin\AppData\Local\Temp\passwd.exe"C:\Users\Admin\AppData\Local\Temp\passwd.exe"2⤵
- Loads dropped DLL
PID:2852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7839758,0x7fef7839768,0x7fef78397782⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1128 --field-trial-handle=1320,i,608189137727841834,8688843641483064168,131072 /prefetch:22⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1544 --field-trial-handle=1320,i,608189137727841834,8688843641483064168,131072 /prefetch:82⤵PID:2188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1624 --field-trial-handle=1320,i,608189137727841834,8688843641483064168,131072 /prefetch:82⤵PID:2808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2320 --field-trial-handle=1320,i,608189137727841834,8688843641483064168,131072 /prefetch:12⤵PID:1176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2332 --field-trial-handle=1320,i,608189137727841834,8688843641483064168,131072 /prefetch:12⤵PID:2460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1484 --field-trial-handle=1320,i,608189137727841834,8688843641483064168,131072 /prefetch:22⤵PID:776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2944 --field-trial-handle=1320,i,608189137727841834,8688843641483064168,131072 /prefetch:12⤵PID:1188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3452 --field-trial-handle=1320,i,608189137727841834,8688843641483064168,131072 /prefetch:82⤵PID:2660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3572 --field-trial-handle=1320,i,608189137727841834,8688843641483064168,131072 /prefetch:82⤵PID:364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3828 --field-trial-handle=1320,i,608189137727841834,8688843641483064168,131072 /prefetch:82⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2708
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
16B
MD518e723571b00fb1694a3bad6c78e4054
SHA1afcc0ef32d46fe59e0483f9a3c891d3034d12f32
SHA2568af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa
SHA51243bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2
-
Filesize
1.6MB
MD5bb46b85029b543b70276ad8e4c238799
SHA1123bdcd9eebcac1ec0fd2764a37e5e5476bb0c1c
SHA25672c24e1db1ba4df791720a93ca9502d77c3738eebf8b9092a5d82aa8d80121d0
SHA5125e993617509c1cf434938d6a467eb0494e04580ad242535a04937f7c174d429da70a6e71792fc3de69e103ffc5d9de51d29001a4df528cfffefdaa2cef4eaf31