Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    300s
  • max time network
    302s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    10/03/2023, 01:49

General

  • Target

    https://notifications.google.com/g/p/APdRdFw2O2gkxxI48UBj_cfxATNre8n6etJh--QJkIpGscutAjxQQEHdMNDDrq97sDYcH0MGsm5JL_hfi8TZwbptw8dyvIGAxiVzGMSK4XfYEtcRNvG7mNiHyXydkga-0S9MVZcBAoD74_KdpLT23ZFeDsq91AdkJVTHrxOTFF5H3YHclf3gfhefkrQ9KvQpzH3dAlrGnp2LXCzHk2Lz0DaUSxs0

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://notifications.google.com/g/p/APdRdFw2O2gkxxI48UBj_cfxATNre8n6etJh--QJkIpGscutAjxQQEHdMNDDrq97sDYcH0MGsm5JL_hfi8TZwbptw8dyvIGAxiVzGMSK4XfYEtcRNvG7mNiHyXydkga-0S9MVZcBAoD74_KdpLT23ZFeDsq91AdkJVTHrxOTFF5H3YHclf3gfhefkrQ9KvQpzH3dAlrGnp2LXCzHk2Lz0DaUSxs0
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcf7759758,0x7ffcf7759768,0x7ffcf7759778
      2⤵
        PID:4064
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:2
        2⤵
          PID:2488
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1880 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:8
          2⤵
            PID:1752
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2116 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:8
            2⤵
              PID:1564
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:1
              2⤵
                PID:4260
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:1
                2⤵
                  PID:2804
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4324 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:1
                  2⤵
                    PID:5008
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:8
                    2⤵
                      PID:4924
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:8
                      2⤵
                        PID:488
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4924 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:1
                        2⤵
                          PID:5096
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4372 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:1
                          2⤵
                            PID:1588
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3164 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:8
                            2⤵
                              PID:5024
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:8
                              2⤵
                                PID:2008
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:8
                                2⤵
                                  PID:1852
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:8
                                  2⤵
                                    PID:3492
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3712 --field-trial-handle=1692,i,196809136567533983,18330267157732374310,131072 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4948
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:3508

                                  Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    576B

                                    MD5

                                    b6e4dc30b258b8877738b87d5ff935af

                                    SHA1

                                    a3c265e5f93817ff0d969f71bd8a95cc195b8d77

                                    SHA256

                                    d1de7a8529259958e00666e43e7b77be1ba80b9826d1c264b3c1323cd9f6208a

                                    SHA512

                                    c9a4d652d9608e9447cda5b0501533a9501c05dd3e101fa2eeb39c12404c88a37bba0aadd69db03e43a462f3795278468dd0ab8c7abf9444f7fd266d258b1083

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    4KB

                                    MD5

                                    39139eadd22c4c5498a09cb3dc70445c

                                    SHA1

                                    3dacc2ac1306a857fe3c6021322574c26d58478e

                                    SHA256

                                    685d3bd85e65c443fc311143c0c59446754fa1075de99d8d0c32ad77b9fac7a0

                                    SHA512

                                    a15b732b318559fadf37d53a3884c25c81842b1caec8639f0c6dc7b6e82701952a8704c0ee551dd7c727afc070ab357576609afb7fd7a647b85ef479b674954d

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    b9f4958121d6b2751472a4168a46bfd2

                                    SHA1

                                    4113dc4f1841e09b2f73efc06409540f1b42514c

                                    SHA256

                                    53ca36dd15a59d67fbf50c8d825469b49c5b679a4a1514d231c3a03734cbcb01

                                    SHA512

                                    962af4c6b60a7bbbc314a3aedf2e0e9b76ab015d2766a75204f58da4d55230d523a3b7f3f60a346b7ebe65294e03c01119d379bef40ad14b161d050b96f0d691

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    cf74da05f4094c6f39b8854296fb23e6

                                    SHA1

                                    f19cb26cdad3667621bdef487ce82f0a14489b9c

                                    SHA256

                                    ebdbd0eb1fe24b3afa3ef83c3817e7909f7bb63bac2fd8ad7325932b2d443ab2

                                    SHA512

                                    daa47fb457c361857a117a8c94751806998789425beb172803ca9813017107bd5afabdbeb319733121250881866a49d13fbde9623ac4fc98a7c28043481dd834

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    8f272a88fd8403a228d5be3fab62513c

                                    SHA1

                                    d462ef1dc5ee024b49eb2ef811c5b83216953997

                                    SHA256

                                    49d86dc25aefeec4bf0ee9faaf5093848ae49a5ebe83416924e8be521a89459a

                                    SHA512

                                    b2e149c0511f7d9c63ffd3958207bf819dc8dfbb88ca87307d653843fca32856eefb78f5bcf913d44a970cdf278575936a42dee4bf2113228eab4e00bb046636

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    874B

                                    MD5

                                    05cc3d8d072636451993b6b30d585d5a

                                    SHA1

                                    81b34625efb497649340c02f403a72ef8311e643

                                    SHA256

                                    5fcde877c9a48662c2920d7fcc3f6c9dae5c01d5ab9e2773762cd653cbcafff5

                                    SHA512

                                    ee7a33aedea95851e7eb95ab9f9a7554d506f33c8b735d48f42d8113846b74e94503cc9b766bfa60480fcc9cff3b883ccae4a304b47117fcd0594f642653c47a

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    874B

                                    MD5

                                    a5ecb5ec4d512dacf7f7132e2ef8a4e2

                                    SHA1

                                    349eb7bd07d40b9a4a3de133d154e0c2736eb404

                                    SHA256

                                    60c38e05c15fd5a5232cc0b5566a63d8f31792fffd5072966fa009e4e669864a

                                    SHA512

                                    3fabb2b1e742a1f8930581124dfbf3f77f8d16326a3dfd0a5f35decb8b5565c1845e50f2b80c02d6db4cf939a50b5d76faa452843ac93eef414e9cc7c8ac883b

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    874B

                                    MD5

                                    857dd6c383b417509313d117c5956947

                                    SHA1

                                    fb733156a854c7a261e0229ad51ebd912d0c5881

                                    SHA256

                                    fda72ebf6229b4d042bf1b85c32c9177878d46792cce329813963a56d8d51108

                                    SHA512

                                    69a0e63d96a8b23329a248ed2521b7ae722d7e09a6ac915f3396bc38ce6ffa33f58a642c6adffc910bfff97b8fbcc52ddbc4b0f84cd33712408f6a8d7c45be09

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    874B

                                    MD5

                                    bfd39b7b484f3c79f624060b7838fafd

                                    SHA1

                                    324367e94e82f2549e87b178ed6b77db731462e6

                                    SHA256

                                    0acff72dd8c14607ff0a4ca6abd1a14d0c01d9ac26921f699ddf9958c57cc882

                                    SHA512

                                    f4938bf7ee2b9c481030d2daeddf5e8e4a087ddd50094ac299d9823febd75e430accc1df3d27b429280a539c61a0f32d5a519443827d043edb8ba573db45fdcb

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    874B

                                    MD5

                                    b9a41f15e0f2680c7c395cbc7b12fb87

                                    SHA1

                                    b2844c43ea99d12cec1669061794bbbfe1247615

                                    SHA256

                                    44ac27629c1fc2c79de52b9727855856c468e5026bc5af19c1844dad8b5fe7f7

                                    SHA512

                                    023303839f990ed4f4404d6cf2df067771f988d1bd6b9f21a053f4e87b3537fcacb8a591200dad1d8052d029529b2b3ebde5b62f85f393792baae8735c7f172b

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    1121f90a282de8f6ba584c3ad6cbde2b

                                    SHA1

                                    db04dffa63f1cf62d78961ead25a92b2ee6911a5

                                    SHA256

                                    af12a5c9c30e2f64cca5fd4f3a2c6248efc3be6879ae98b9499bec0999ce55ac

                                    SHA512

                                    da47a8830b5108b3ff0a16fe47fb06158be828569ea144222b0c36482b6bac2f7cf4775314db7f0e9da4e04562f4ab8b285c9daff35f2cdcbbf5d52642c7dabf

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    c92313cd666eb2600b6b8a1d3f62644b

                                    SHA1

                                    962db44e6057f298d303737d85d274fe8c8bb7e2

                                    SHA256

                                    beb9e57e21f499c8ca776b3afb3b6fa2c567a3adeb2738729bc7463708c0cfb4

                                    SHA512

                                    d66db19dafe2be6b08d2429c48c1a6351e72bcbdab1e7abbed4e0d67014589f45819a4bab16893f9f6263dd0a04c08134488e432ed670d99b838f543fbbfb092

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    106aa172988f119769cd631cf90a388b

                                    SHA1

                                    f17673de8a74a21a33e51f79c11386ed3639ef82

                                    SHA256

                                    7239b6e4acecb0d822ef325acadfe444acb897f962cf75264df9bcf3b5ae2f2b

                                    SHA512

                                    a8b65d40f358618a4d2ef8d91dc380c86f9eb9b9554f4a23566ad90e6d4a6748b03196e7feedfe1c57a61536489d9e55888b034afbf15a7ecd31ed03f2933575

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    145KB

                                    MD5

                                    f01297fa275b79d9004a419745018535

                                    SHA1

                                    b76210eb71f4fa132e9c304c57a2ac81a3bdd69e

                                    SHA256

                                    b3cc2313dec6acd2d5be10fb650575c12cdbb2af9bb4542fcaf7966e7440a88a

                                    SHA512

                                    96aa59063523cf9e35daebfdfb0e96b4a5dce4d2e8c56b886341412b3ad6edb5cfa351db5f53cd4e1a8f7c752d5bef7f2af14e132ba9daecfd91f4872b91a701

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    144KB

                                    MD5

                                    f834a653f86459f237f7fb3f59bae6db

                                    SHA1

                                    2f73b3d6f4549221b8d911e4628d3242c3c24294

                                    SHA256

                                    69e59f512f305093dfd0a170618d16fdb6b683b273f30a3c0353721a1424d8cf

                                    SHA512

                                    b018c33fd6144596ee30ed3f8b760f5a9b107ffd31be85b2da06d8d4461fd4f6ed3327205930f59c082c21631e329d694fee2406db8da754af9fe747a72f4a2e

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    145KB

                                    MD5

                                    4bd25d61d266aa8e401e8d490501186e

                                    SHA1

                                    2e6a6dc39ee55716fbf4a232863673627baedb9c

                                    SHA256

                                    3cc661a2e7af16947daa424df9c09d54be52e64d9c6d79862c90a01f65131f9a

                                    SHA512

                                    445a527bd74407e4a04f36731c625024f58b649a45bf9d6a0e74de1ccefd7025d05f85d55a02e6056ba8ca417ac135fcc7ad7c5f959245c9e7c694256c786b5a

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    72KB

                                    MD5

                                    42389409ccc781d05532247442296c94

                                    SHA1

                                    83f0659e91759bb6d5d56dd90e7f87f8f6804809

                                    SHA256

                                    eeb50ff078a493a2d3f51827bfe7f723141e314e083b89eef31bb577458d08be

                                    SHA512

                                    ac675c3accdfc371530827e791a9433e9144426a32867d0f4b91ea6b02324c19c356ba389c4dd86d4ee872ceac2b5e32889bc7245adadf4cef8feabbd2c2b817

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                    Filesize

                                    2B

                                    MD5

                                    99914b932bd37a50b983c5e7c90ae93b

                                    SHA1

                                    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                    SHA256

                                    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                    SHA512

                                    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                  • memory/2488-134-0x00007FFCFDBC0000-0x00007FFCFDBC1000-memory.dmp

                                    Filesize

                                    4KB