Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

16/03/2023, 01:38

230316-b2d8zsaf5w 1

16/03/2023, 01:27

230316-bvjvwsaf3w 1

16/03/2023, 01:24

230316-bsqknaaf21 1

Analysis

  • max time kernel
    149s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2023, 01:24

General

  • Target

    NewVoiceMail1633(29s)☏.html

  • Size

    566B

  • MD5

    97a9ddba9990f2cbc38a8d4147d31d74

  • SHA1

    ee72e54484127733dc36712ef8f1c865322bd97b

  • SHA256

    bc5720585c973834c0b76ed1125d9a9076f496183be03048a099f0334e0ce24a

  • SHA512

    e34270b189840f2441a56289e4af5cb73a30d61a2029753e37d5fa66526dac82d135fade5176b1687687994776d66364c09af2b1c60806f81a23208bb1befde1

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" C:\Users\Admin\AppData\Local\Temp\NewVoiceMail1633(29s)☏.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2296
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef8cb9758,0x7ffef8cb9768,0x7ffef8cb9778
      2⤵
        PID:2288
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:2
        2⤵
          PID:3904
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:8
          2⤵
            PID:3880
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:8
            2⤵
              PID:2456
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3212 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:1
              2⤵
                PID:3380
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3224 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:1
                2⤵
                  PID:4416
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:8
                  2⤵
                    PID:1992
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5272 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:8
                    2⤵
                      PID:1036
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:8
                      2⤵
                        PID:3004
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3788 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:1
                        2⤵
                          PID:4936
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3396 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:1
                          2⤵
                            PID:3328
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3384 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:1
                            2⤵
                              PID:832
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5076 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:1
                              2⤵
                                PID:3792
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3548 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:1
                                2⤵
                                  PID:5028
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3296 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:1
                                  2⤵
                                    PID:1820
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=848 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:1
                                    2⤵
                                      PID:2316
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3276 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4512
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=3324 --field-trial-handle=1812,i,12989561878687245733,29221786957445260,131072 /prefetch:1
                                      2⤵
                                        PID:1376
                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                      1⤵
                                        PID:4080

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\96394442-6c95-4d71-9247-582690ac8353.tmp

                                        Filesize

                                        145KB

                                        MD5

                                        ad096ec2ca7b51cfeea5df2138a5f865

                                        SHA1

                                        df3c01e2ad51b47febe1b2f59e26a3f37e5aa5e6

                                        SHA256

                                        fdac48073719903881a0028460798691aef3d073effa716036225bdc22bcef14

                                        SHA512

                                        cab6fbceaafea184e781d852f504d7c045e09e1fc62d852c63b7d8e39370acb5f2fc4fa61284426863d66e047671e726ebff6551ce4d2b78d1dec39c3b581e01

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        2KB

                                        MD5

                                        f172b70b7d40c64147c4ce33d812dd95

                                        SHA1

                                        5e1ac601c03cc2db21957c0256b73f9ca99ac942

                                        SHA256

                                        9f1e0797e1ae98a71616137b8f6d9dbda060b84122d175cb62d39a88c46590db

                                        SHA512

                                        427131a5cec4557a83a5a8e6a73551c8ce6cd0638f761b9476b91318394881cddda6caaf3cc5826fdb4b9388a5fe3ae55772f4733b9b6b070117ae7f2e8b732a

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        873B

                                        MD5

                                        2780a39727a19dc6fd5eaa0f6ccc349c

                                        SHA1

                                        34f63a31df0cb066ba3a6cbb0a7d6d77d8e63731

                                        SHA256

                                        3faa2af7b947fa894acf953f80c55a4a52c09e2e034e6516461a6ee6bf0ea8f0

                                        SHA512

                                        e28d9960ce7ee38b640957f2e617ad89c0bca80699684468eadba688e0e3e5e7b43d72a056a038370d97f51bfa665798f071d65ec4e4123705458cef5a9f0b17

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        9a6d2546dd8169203aeaf7a6d07389d9

                                        SHA1

                                        5231e1828936fb8fee4bed56e6d2b1c96ca9db33

                                        SHA256

                                        18f82c6b05dc972ee53ef49879f844e62bbd0801a289cb2f226fd71374661d28

                                        SHA512

                                        871f99c08cfa1ca7d05ee69d05f39034dbea13bb5c79060ec8e336154f5a47a89c9eb5fbc48e5d7e17bd76cee6202dbfefab8d847e3e22fa7639e26ed2ee072f

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        387b8bb9dc4a2cb9224034c3bbe1e5d0

                                        SHA1

                                        2f2b6bbc8c78f20d5f36b8378c3dffb5791776b9

                                        SHA256

                                        ef6f95fa9f731c85a5fbbaf8308428fded69b290ead3bddc4464383bb96d50e6

                                        SHA512

                                        294e0eaf9b8bf85c064507011d8161780fef7a797552bf3e24c778432ffdc6f9052460443b7bcbd0d618b3582ddffcf474c922a18d0390009f23b44bd5f85751

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                        Filesize

                                        15KB

                                        MD5

                                        84fef860b8decaf1ed385bfa35df782d

                                        SHA1

                                        d612732ecfea2f33da63d76cdf29d9d3cc15961a

                                        SHA256

                                        c8a9a8c8e80dba72db9660fc36ac47f3719704dd072a74f1778e624a9ebc21a0

                                        SHA512

                                        9dd1fc4983eb6c152aa16e1661b8a049a93ff7774291ade804be88a1c29e13c2e0e98295a00082027bbd703cee47cd2e8ee98dfc54bfbccd2ce6216bd45fa88a

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                        Filesize

                                        2B

                                        MD5

                                        99914b932bd37a50b983c5e7c90ae93b

                                        SHA1

                                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                        SHA256

                                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                        SHA512

                                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd