Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    52s
  • max time network
    445s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    16/04/2023, 09:34

General

  • Target

    https://www.youtube.com/live/-zMu3ZmF2lM?feature=share

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.youtube.com/live/-zMu3ZmF2lM?feature=share
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1708
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef6839758,0x7fef6839768,0x7fef6839778
      2⤵
        PID:932
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1244 --field-trial-handle=1328,i,15161285710137646405,12076652190213967798,131072 /prefetch:2
        2⤵
          PID:1784
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1564 --field-trial-handle=1328,i,15161285710137646405,12076652190213967798,131072 /prefetch:8
          2⤵
            PID:1668
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1688 --field-trial-handle=1328,i,15161285710137646405,12076652190213967798,131072 /prefetch:8
            2⤵
              PID:764
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2512 --field-trial-handle=1328,i,15161285710137646405,12076652190213967798,131072 /prefetch:1
              2⤵
                PID:2020
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2532 --field-trial-handle=1328,i,15161285710137646405,12076652190213967798,131072 /prefetch:1
                2⤵
                  PID:2024
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1384 --field-trial-handle=1328,i,15161285710137646405,12076652190213967798,131072 /prefetch:2
                  2⤵
                    PID:2128
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3976 --field-trial-handle=1328,i,15161285710137646405,12076652190213967798,131072 /prefetch:1
                    2⤵
                      PID:2400
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4236 --field-trial-handle=1328,i,15161285710137646405,12076652190213967798,131072 /prefetch:8
                      2⤵
                        PID:2612
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1100 --field-trial-handle=1328,i,15161285710137646405,12076652190213967798,131072 /prefetch:8
                        2⤵
                          PID:2384
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:1812
                        • C:\Windows\system32\AUDIODG.EXE
                          C:\Windows\system32\AUDIODG.EXE 0x568
                          1⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:2684

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000004

                          Filesize

                          50KB

                          MD5

                          322c7ea5b81a01940fdc4cebe6d5022a

                          SHA1

                          000df4a603c205667c9da9735609019a4d1c77c1

                          SHA256

                          089d9480833d283208012845bcf91b1ec55b6da8db9c0f753e80bcd5b9d91b65

                          SHA512

                          681939f3979b71d914caccca22adb28988506becc3b795e7d0bedb87be932546b9da173b7352e792f9ddaf2a6f618bb0acec620ac9391ecbc4c273f50bee409b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                          Filesize

                          264KB

                          MD5

                          f50f89a0a91564d0b8a211f8921aa7de

                          SHA1

                          112403a17dd69d5b9018b8cede023cb3b54eab7d

                          SHA256

                          b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                          SHA512

                          bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.youtube.com_0.indexeddb.leveldb\CURRENT~RF6c8759.TMP

                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          4KB

                          MD5

                          2bce3730fb5b5008b98f2e9556eb571d

                          SHA1

                          7210c3f846727714bf73ecdb759f830500f360f7

                          SHA256

                          159dce1caf8fa575d8939985cbd339763f4c1eef1354901315e72419e17ae98c

                          SHA512

                          10f7aaddd394a06a1dc9ce99f8464d74fd5f7bebad3c35462004eb7664fce8fa8f1a2bbe18a01511abfe8de6ce466c78ea6ba3d29742bb732920bdf308bad027

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          4KB

                          MD5

                          fb818b81617c3cc564a51e9002270abf

                          SHA1

                          39818dbbb736e0b627e4e8a9f64b107a4618fa25

                          SHA256

                          920838c016eb095f76f7f4526ba7c73bdfc21b45aaa1fdb92d10c8dfac3c6d49

                          SHA512

                          8e9d850098e3f6ca993c7dc69864500ff975bb0f0321c863ce47f0b5b9e6c47bfea50c77455003455cddf1150f2a35a4dfbe104a9fc511bc9bc179e7c7013b26

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          4KB

                          MD5

                          10809c6205fed054306066784614784c

                          SHA1

                          364406f25270eae588dab4a581b5c0b41c3cf537

                          SHA256

                          25bf152f4c0cd947ff6729fd453d3d80463daa4d964f2ffcb6e85d0ff5c9f07d

                          SHA512

                          c96c208936d831fe59daf9b6f3958121a2152f7cc48b423f380cfa9259a4641be33bad131898bc5aaf555976abcffb9224595baf90c47c0d0147dfe89aaa8459

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          4KB

                          MD5

                          5810cc6815d5bcadebbb3b144700d9bd

                          SHA1

                          050ba110ae52d846bbae16bd1f0fab1dc25e889a

                          SHA256

                          d8d729ac41188da16498f0dd00646bdbf2de5ef584aaadb5e1caeb9ccf4482a1

                          SHA512

                          616fcb3031ea57ab357f4d14df80ca0ce7531b53ac078f3ed21971d6770a4b43ce71b952a4670030dc1ce7554fac28af069ede116b3eeff36013f08dcea82a28

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          689B

                          MD5

                          7d2606f3ccc70be94fd382f0dd2bf98a

                          SHA1

                          b992a8cbb2e7b1fb74d6363a418f8a515dd07684

                          SHA256

                          216aab44feea55ff9c26ce9f57d2a68d3f342883467fa617c309689108f9dad8

                          SHA512

                          c1d85596f3b000be383d11b29b2a077104539fa3dbf1748f86fd2ae783748067823d849bb4579d16a251a87ad7d7fa153201a589f8d35a4ad629a2eadd0caa90

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          689B

                          MD5

                          9db4389473cb3f870ab02c466de61502

                          SHA1

                          fb6ea22e0d3e385d74c78262c8c1f520061f8c04

                          SHA256

                          5aa200fb4c99a4f7ee82c25fdd92bfa16baaf92dd5ed5d81df950d0d2a4f0914

                          SHA512

                          15c9b058029bb9c01fa0a8895c295be43039d328ec73752d345bad2853dcc0c1dd1be6dff0ba148d9d8cfce747a123ef6247faf44ab61575753dbf23dc7affa3

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          523B

                          MD5

                          4352e103be014f9731c1b108045267c4

                          SHA1

                          3aeaf3299e5b4e59668a1d013b3c4ef900197755

                          SHA256

                          a4d5b1c28faa3ac8b99e77cc7f4f8f2c762888984c147666e9fdef682013e78f

                          SHA512

                          a59ea5b6f4fb9f849f6f37a134fa31475325d5b6961450654d1c4fd6a59aabed0ee70495028f8c558f4a7c525fb2c1f5d5d2e0aec45cdb140541b46ed0aeb114

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          4KB

                          MD5

                          f856eb77777a93519057eb2edf0e0349

                          SHA1

                          5b9de142a0ee68ba31b600cca96e473f05bceb51

                          SHA256

                          4e213058ff0a82a654f4594829c68a8150689f13cc021207616a1a177547215d

                          SHA512

                          4ed899d0a85b4517f526e3e1ea7bdb8199455ff7e01eb57240da4d2e3888d89ded07aec1d7991e9f1c80bcb46a2126af689a7460b53df2f2d4ec134f7aba8869

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          9184bed2bae5c03fe69acc47ae2ef174

                          SHA1

                          97665253b0342d7c0a3050b6824ea0a7ab304734

                          SHA256

                          650f6433617fecefc2395d79b3a6c3683674f82a712f7f8518e5ab36ed2d2501

                          SHA512

                          9dad33d52dd151efc1eafccc0fd9400302458645963e2618d83ebb09b5cebdd12c61052dbfbc4ca8462c26c50e51ff5ed162f124a067c31e7d7e682b354513c3

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          4KB

                          MD5

                          03091306246b47b6c37715404fac8099

                          SHA1

                          f801decee1165764362586b940af0f2c375ea7ce

                          SHA256

                          560e2fe8caadaeb5c35c62ba6193297ee504a0e2e538b112fb40eb5980153973

                          SHA512

                          fd375373e89ec39c3c37c5791cf6f6939fc9647492f03ea127c7e1055721a0ef71e176dc1130abd3f0aeec8f24c8593c63ebc27e5f8e8e883f7dc2ea6c05fbec

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          e376cebba78e6363673341314b7ae96a

                          SHA1

                          d8d33ff3bbecd1a480fd94be86e0da91df646d09

                          SHA256

                          fa4aee15dd090831863cb3743ced833eb3e9825cf65fd9c0fbbe93b8356cae4c

                          SHA512

                          2540397c2747168c1179f841bf3751ece7bde5f91842f7340947494ff6ecc40e2aaf4d1406b8b894549d6b89539ae249effea6283e08d169c6d00b20d782c27b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                          Filesize

                          56B

                          MD5

                          ae1bccd6831ebfe5ad03b482ee266e4f

                          SHA1

                          01f4179f48f1af383b275d7ee338dd160b6f558a

                          SHA256

                          1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

                          SHA512

                          baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                          Filesize

                          129B

                          MD5

                          8f95e37046653d0739b5b0d7d6bd1871

                          SHA1

                          beade9d516df3c44258f0c1a85225a97569853e1

                          SHA256

                          b8b77a2abb2a26b0a9e70976bf9797a9377302db564568ae3494dfd6452cffe3

                          SHA512

                          6626cc99b6f7329f5e789b2bb0dc88668617e34c7bf4ec1d2e696a206ea5b41f3f8a890ca1f81b287cb5541d035a23fb9d5aa391a6704cdfed97b9e09e453d6a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\000002.dbtmp

                          Filesize

                          16B

                          MD5

                          206702161f94c5cd39fadd03f4014d98

                          SHA1

                          bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                          SHA256

                          1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                          SHA512

                          0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000004.dbtmp

                          Filesize

                          16B

                          MD5

                          6752a1d65b201c13b62ea44016eb221f

                          SHA1

                          58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                          SHA256

                          0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                          SHA512

                          9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389