Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

13/02/2025, 01:26

250213-btppra1pcz 10

17/01/2025, 20:14

250117-yz7h3s1qfw 10

17/01/2025, 20:12

250117-yy9l2sslcr 10

17/01/2025, 17:25

250117-vy9p9sxpez 10

17/01/2025, 17:21

250117-vw8eesyjfp 10

17/01/2025, 14:16

250117-rk9ass1rhk 10

17/01/2025, 14:12

250117-rhv1ds1lds 10

16/01/2025, 12:52

250116-p4et7a1mez 10

Analysis

  • max time kernel
    381s
  • max time network
    850s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2025, 01:26

General

  • Target

    Malware-1-master/MEMZ-Clean.exe

  • Size

    12KB

  • MD5

    9c642c5b111ee85a6bccffc7af896a51

  • SHA1

    eca8571b994fd40e2018f48c214fab6472a98bab

  • SHA256

    4bbf7589615ebdb6c769d6d2e7bdcb26072bac0cda6e225a4133ba8819e688d5

  • SHA512

    23cc74b5a7bdf70ba789d1730a0009414cfb9c780544e3d8d841be58782b9a9a089969c4295a0da25d07285505992386486d6ff0524e75605b96bb99cd3aaa1c

  • SSDEEP

    192:BCMfc/GinpRBueYDw4+kEeN4FRrfMFFp3+f2dvGhT59uay:AMfceinpOeRENYhfOj+eGdKa

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 16 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Clean.exe
    "C:\Users\Admin\AppData\Local\Temp\Malware-1-master\MEMZ-Clean.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Program Files\Internet Explorer\iexplore.exe
      "C:\Program Files\Internet Explorer\iexplore.exe" http://google.co.ck/search?q=how+to+send+a+virus+to+my+friend
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1804
      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1804 CREDAT:275457 /prefetch:2
        3⤵
        • System Location Discovery: System Language Discovery
        • Modifies Internet Explorer settings
        • Suspicious use of SetWindowsHookEx
        PID:2092
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x534
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:800
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6c89758,0x7fef6c89768,0x7fef6c89778
      2⤵
        PID:2592
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1384,i,17877985187241246876,12898887510258511583,131072 /prefetch:2
        2⤵
          PID:2028
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1564 --field-trial-handle=1384,i,17877985187241246876,12898887510258511583,131072 /prefetch:8
          2⤵
            PID:1564
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1628 --field-trial-handle=1384,i,17877985187241246876,12898887510258511583,131072 /prefetch:8
            2⤵
              PID:2992
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2272 --field-trial-handle=1384,i,17877985187241246876,12898887510258511583,131072 /prefetch:1
              2⤵
                PID:2112
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2308 --field-trial-handle=1384,i,17877985187241246876,12898887510258511583,131072 /prefetch:1
                2⤵
                  PID:1636
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1420 --field-trial-handle=1384,i,17877985187241246876,12898887510258511583,131072 /prefetch:2
                  2⤵
                    PID:1120
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1264 --field-trial-handle=1384,i,17877985187241246876,12898887510258511583,131072 /prefetch:1
                    2⤵
                      PID:1592
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3468 --field-trial-handle=1384,i,17877985187241246876,12898887510258511583,131072 /prefetch:8
                      2⤵
                        PID:2432
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1856 --field-trial-handle=1384,i,17877985187241246876,12898887510258511583,131072 /prefetch:8
                        2⤵
                          PID:2792
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3800 --field-trial-handle=1384,i,17877985187241246876,12898887510258511583,131072 /prefetch:8
                          2⤵
                            PID:2952
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3836 --field-trial-handle=1384,i,17877985187241246876,12898887510258511583,131072 /prefetch:8
                            2⤵
                              PID:2848
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3476 --field-trial-handle=1384,i,17877985187241246876,12898887510258511583,131072 /prefetch:8
                              2⤵
                                PID:536
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:1484

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                Filesize

                                264KB

                                MD5

                                f50f89a0a91564d0b8a211f8921aa7de

                                SHA1

                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                SHA256

                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                SHA512

                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                4e2ba211938e522cfcd5d6ccea0fe066

                                SHA1

                                8b67bfe58f806e9e7e1914d01156d646ec365959

                                SHA256

                                f2eb934e88a079a1fb2ac6702e741712b70aa89cea000bef0fadc98b303f667c

                                SHA512

                                6ebd174d589ecc543a7cc9f43f301e56045b7d7e116aa815bce3a6108794fbf5e1d129a431d11a44de22d9ed55a77163d26101dc3429e83cd12f3de7698e0938

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                0c33e864949d7a9d7f927a2735f2cb4d

                                SHA1

                                e8b902a8e700854d0d67812c8781319a81d2053f

                                SHA256

                                d8840ce30dad6f511687b0c11e4beb9fddd1d77866e6c1e9b09d22608960ff8d

                                SHA512

                                0d5ccd8baf4018a4cd874f72ba70cf59696ab30211a26b85548339ed3feda155cfd3714d68e2ca6ed538232700d33a116613c27df108ac66dc9650d90ae7bee8

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                c780852d4516067ed4ee136fe97e1f7a

                                SHA1

                                8af98084c5e8e5d075cf82d77f71b69ee7f20466

                                SHA256

                                c456df71942688ee2140c388b226fc17c7b59cf7d9fc4a1732fa33f777a13ce3

                                SHA512

                                8ca8a9176ef226297a949641538c9b78f2e452222377be46d21fc570bf949a8cd50e430f6928def6992fd5c71ab15e6306862246303531615a8a129fbe4e3417

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                1922ae5eacb412b1b8b04883a4188c0c

                                SHA1

                                69e17ce9844ad23a305176e684a86d44648beaac

                                SHA256

                                cc6045fd1aeb5026c18195e8f0af8ceb7adf3a936a61e26d2a0b1f1d3956cf51

                                SHA512

                                14cd989daa538e0997219c2d40478409de47f81a73ebd108b08aeed52beb180901b779d2baebb29d2fb1ab348b1b52816fc6124aaa0ee95f5d8d7abf8f402794

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

                                Filesize

                                16B

                                MD5

                                18e723571b00fb1694a3bad6c78e4054

                                SHA1

                                afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                SHA256

                                8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                SHA512

                                43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                177KB

                                MD5

                                7685ccefb88a4a67ca5915fb7813170a

                                SHA1

                                c5b40e6c3b98178a516c90ba7fe1898d3ab2a817

                                SHA256

                                6b442c22d9f90e5194146efe4e20d426eac2dc05abe3b37080b3a73c0bc5cfc1

                                SHA512

                                aeea8ef806f71bc268e95417a707e680b26af3e09e15fcd32aee7a79be44a436cafb7e82466c3faecd983fa020615148637aa29a6367b24e0fcf7b7a2f852588

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                360KB

                                MD5

                                222670f7a92c96213aa024121a018ff7

                                SHA1

                                20e193a0abd5f29b445f1b6373b02a3e7997571f

                                SHA256

                                511cde2eac3eeba46718762dec2a3eb31dc31bec646a56946000a699d61db189

                                SHA512

                                fc3033f2c792e58ca657ce1ff9365e96570037fe2dba963a305132837bd6fd18d8097bb7393ede726f8b8720c630e827d21eab29b1b6c3d4f0e96513d151b7cf

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                377KB

                                MD5

                                c28749fa9a28794a6e432124f10a588f

                                SHA1

                                625ea9b6c8fc218d6f0fad2d5dcb94b50742349e

                                SHA256

                                aae967aea93b7f7c72ddc4674235bb201bdf2a88b374a57fefadc6564835621d

                                SHA512

                                5a17ab2c2accfaa6f36b22bf93b1a6834651388baf1c95ef13cc17396649f3a9d40ec77e59bf6af616f33ea5efb4c996e79e927efd36190b6929685a5b59d7a4

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\fd49cf23-b10e-4399-81d6-062ea2ffcec7.tmp

                                Filesize

                                361KB

                                MD5

                                ce8d3542940e5eabb59c081b7cf9c6f0

                                SHA1

                                2734610bb1795b835d09cce0239c36a0e2b9bb4b

                                SHA256

                                8ea6876f1062920187b099d801de1e8d2e1bb8d56f792514027940b4c0eb169d

                                SHA512

                                61e19d6887152e00cb874cd21559dbdf20d702c202e56de3269d12a75075adee0360b705d9a8318cd4256b6c9ceb9c9427f153b85e0de181434abdd3153b995d