Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/03/2023, 12:35

General

  • Target

    https://sl.lansweeper.com/t/104690/opt_out/160119a1-1389-463c-ad77-bb5446aa64d8

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://sl.lansweeper.com/t/104690/opt_out/160119a1-1389-463c-ad77-bb5446aa64d8
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2460
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf2b49758,0x7ffbf2b49768,0x7ffbf2b49778
      2⤵
        PID:4896
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1780,i,13209060243633305840,1617971765393691494,131072 /prefetch:2
        2⤵
          PID:2584
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1780,i,13209060243633305840,1617971765393691494,131072 /prefetch:8
          2⤵
            PID:4800
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1780,i,13209060243633305840,1617971765393691494,131072 /prefetch:8
            2⤵
              PID:768
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3128 --field-trial-handle=1780,i,13209060243633305840,1617971765393691494,131072 /prefetch:1
              2⤵
                PID:4484
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1780,i,13209060243633305840,1617971765393691494,131072 /prefetch:1
                2⤵
                  PID:1624
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4496 --field-trial-handle=1780,i,13209060243633305840,1617971765393691494,131072 /prefetch:1
                  2⤵
                    PID:1452
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1780,i,13209060243633305840,1617971765393691494,131072 /prefetch:8
                    2⤵
                      PID:3880
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1780,i,13209060243633305840,1617971765393691494,131072 /prefetch:8
                      2⤵
                        PID:3876
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4892 --field-trial-handle=1780,i,13209060243633305840,1617971765393691494,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4844
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:872

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        72B

                        MD5

                        b2cdb08fa426d0ac93347e65b4505f84

                        SHA1

                        8d29ce437a07e22d476210c8db3c302be829f718

                        SHA256

                        5a8f0e6bcde5403375e1cfe532bfcf864d2db33791e0d74f899ab0e66d549c4e

                        SHA512

                        9f272404b36b1deef3475022eef993768b473ee212245822f36dfc608efda8690ec78bccb7cef6260fb93ec04f7107b27d060eae0fd76b0dab2f69fcfe08780a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        f456b7608b88c081d25288822fdb778e

                        SHA1

                        d6f3f5afb3c2c8bb60544cf90bf50d884447d57e

                        SHA256

                        990ea38fcc05ea9e53e12835bddc1ebf5c0086d3576b87e37996d35fa938d374

                        SHA512

                        0b4d9b932ee29719b3fbae51e689af53d39459bde2eb3d44844de868301b1a3d2ce19224e9d2056d16be770b74658efe490ca0032b3f7a32b02b55c1a2fa5ab9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        701B

                        MD5

                        59bfe9478aa354c64716e7e287c1a459

                        SHA1

                        d1bbc5d45a8ab6e5cde65a772e54d79effdceba4

                        SHA256

                        32cfa8392eecf698823062cddb3b6515f69c10257fd044f152d71069e92354a2

                        SHA512

                        132ca9642f93aaf8f2b533a44314334be542a1a83b172c9f375525e6ead027e0260bf0cb7eff9de00bd205bcb03ce9426b1e22d9f885e4d50d1e3b23a3481a24

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        701B

                        MD5

                        8af53c497b8b0807d267bb8edfbde20b

                        SHA1

                        facdd6934ec7fcb3f164c645b5b71114d03c8062

                        SHA256

                        28f29b8954efca7aeb0719623fddbaeb785d43fea2f27e7e8c70b448b0317e80

                        SHA512

                        81375b0f1512f4162f7140c037d12b1f2600780bb52311d64e2e75a3c566685a5630e32fdf4b9b4d4b0b881b7bf856c2264fa1a9bcabd7c22a365a87c0ff2282

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        7b7dde902268da4af8c2b1d8a85f14a2

                        SHA1

                        fafb0b34462ae1c290f1a39c1fabf13ad2519150

                        SHA256

                        1f40006576cafb4ba20825053dbede06a8f35a943d74370038b69ac17be8a0e8

                        SHA512

                        d1d3267479ff624296e71fbee2ca87632a262e112367a6626305261b0a1ffd831a90389d64b3cd5f6f720a270c970e934da816dd136ae29c806c0c957959b59c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        801a339649ad2337f1c0c431a66f6629

                        SHA1

                        fd76a4ceba92514db46c909dd2504d68282d40d3

                        SHA256

                        47adbb1c07a774a5b0fc53269d8b7361b0d8f4926bb2c5cdee959f932f90c074

                        SHA512

                        4df4fc7412912a27dc2e9e2572f7440d8209c3bf1beead8dea4af7e77301faf48149c03c0014c8c38681fcb4b863d214f66d4482daeb5677c586627b1ba89ec6

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        a20928664205b55db2ac5f1007708a0f

                        SHA1

                        1105a27c9299aee4cbcb942cf60f550f9604da0a

                        SHA256

                        67765989e693f9053912652c235770388429921ac7dfd76998ee9d524839e8c6

                        SHA512

                        9db29c98b8c852a37bdd90782e45c8ae7d07880f185a508fdcc7d5c750dd53122ac940357c3ec0c473390470733a82348d0ffc56df75ea65c33a24c6b1ad8523

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        145KB

                        MD5

                        07e972c874c763f29d08ff67a25c382a

                        SHA1

                        48df86be5360ad354f3213407e1f65bd9f76bb6f

                        SHA256

                        b1f2825d0e75375f190c882f96acc15fe7e6dd9b89d0989dd35cc8b3e9fba140

                        SHA512

                        6da3f4e4bd3e64a61a42f4c20f7b7537631b2348d5ed9aaa66735ee43e03fda54bf0fc9155a60ac9d9cfb796a35a00430b842408e3b30dbb668150891377b499

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd