Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    60s
  • max time network
    60s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-es
  • resource tags

    arch:x64arch:x86image:win10-20230220-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    27/03/2023, 19:37

General

  • Target

    https://www.cicade.com.ar/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.cicade.com.ar/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1092
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd90209758,0x7ffd90209768,0x7ffd90209778
      2⤵
        PID:1124
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1772 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:8
        2⤵
          PID:4048
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:2
          2⤵
            PID:2820
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:8
            2⤵
              PID:2024
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:1
              2⤵
                PID:3812
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3008 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:1
                2⤵
                  PID:3548
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3768 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:1
                  2⤵
                    PID:5084
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4744 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:1
                    2⤵
                      PID:5076
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3772 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:1
                      2⤵
                        PID:5068
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4876 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:8
                        2⤵
                          PID:3940
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:8
                          2⤵
                            PID:204
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:8
                            2⤵
                              PID:3316
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5164 --field-trial-handle=1776,i,18151534225776576120,16562103710143132853,131072 /prefetch:1
                              2⤵
                                PID:4152
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:4928
                              • C:\Windows\system32\AUDIODG.EXE
                                C:\Windows\system32\AUDIODG.EXE 0x2b8
                                1⤵
                                  PID:3788

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000038

                                  Filesize

                                  132KB

                                  MD5

                                  1d8dd5edb6fb757ccf0ce9101cb32b6f

                                  SHA1

                                  b3cae3cb2e8ddab380d6c30faafab4cbd9e2fb57

                                  SHA256

                                  e2e3beb941d0b13d74012260645934d72c51da9bd7a5892b3f6b3a30be2ccada

                                  SHA512

                                  16d78c96bb9171a481dec23a1c3533d95d7c201b295c5e0fe1db92a202bdd53e4a9f3ab3f362836dec883a4db5f58da4377c192f666e7b96d63182b4d7d50acd

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  1KB

                                  MD5

                                  7255b0870966e3bb1da24ed4f088c636

                                  SHA1

                                  e59168d6bbbe0e163c0f11750f2f91d3c7992364

                                  SHA256

                                  a23dc475cbf832e56facd2d31d0a48e199aed2b56a47cad5c0a597be0ce99239

                                  SHA512

                                  129ba02b5a84d5df74481e718359e533a0a07f98b35bb0b59609a3c13c9fe530cce085094eea03d9881536433360694aaa2178bca3d3eec8171e3ea172e2033f

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  1016B

                                  MD5

                                  bd3385b0a0aa94c9d9e0c6d23348ffe5

                                  SHA1

                                  7cb648e94129b35123300f9001b0fa160a26196a

                                  SHA256

                                  c1171261258864fa9a152146aa7ee59a463b1ad0911ce0a41b31443a6dee7e38

                                  SHA512

                                  610a956629b3ad30f5fb6b6bd743eeb6630e3a0f3f34ac5a4241d46ec8037a2dcbb027e6234889d21abb08060b0cde69d4cccad9627a59c08e47b296cb023655

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  1016B

                                  MD5

                                  80e49739c6b74230f3a15d0b32836d12

                                  SHA1

                                  5f868e02f592e960d15a5313e6ec09f5359fb52a

                                  SHA256

                                  e30740358a7dfc1d9a4615686a674c646c0612053e4be1fc64e758c56b72897a

                                  SHA512

                                  69216d912614534f3de328ad07e6f377e717138083126fa0e1c1b81f300325a6152c67e30de2bd44676ca720e685dacf79265ffd877d688956b7a756b78b5d1a

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  76769cf3a01e323a082225491f8dfc82

                                  SHA1

                                  e1031815ee37298a9783048cd39266672d277f63

                                  SHA256

                                  12b2a47aa854439a4e43ffde73c26702341177ac210f710e11174d40670b3f3d

                                  SHA512

                                  e624944a10d42548c1e946e8238c358e5be49f855151d23aa6b8aa64b396651f10117389abf878c16abb44c5dea192430ada0dc33834e323f03fbe059ffafdbf

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  5KB

                                  MD5

                                  6691391f15590d86ad10c8200f38f638

                                  SHA1

                                  d3de1094fa5714589128dad0fc3edccb7c6caff6

                                  SHA256

                                  44243c5912152161fe9d191b45e8a196f1422ea9662ad725b589538dad7168b6

                                  SHA512

                                  970a097c5e7212c66058a03be5fbb4e459d4aa400da704a41551eac1fb77c598a56102c09b61c8e999b679668a378b1d68125a1e59057f96c88659c07f7edb52

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  145KB

                                  MD5

                                  25ce5c81e36158ba909df27e195805eb

                                  SHA1

                                  777216034640c5b97bdd14b4a4a796e257fa9e6b

                                  SHA256

                                  0f12c29ca49b76caffa1383c01b90b77f8c94dbc0e468ad5f9fd9fb90589de54

                                  SHA512

                                  7ef53c185fbcfc23c3fa8adf644a4babf6d49e5f39c3c6f980226d01debdacc2f4220af03795c8a4b16ab32673b579294681837b1367d05944b29359852d31a7

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd