Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    36s
  • max time network
    37s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/04/2023, 01:00

General

  • Target

    https://on.soundcloud.com/2viW9

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://on.soundcloud.com/2viW9
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6cc29758,0x7ffc6cc29768,0x7ffc6cc29778
      2⤵
        PID:448
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:2
        2⤵
          PID:2964
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:8
          2⤵
            PID:4600
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2264 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:8
            2⤵
              PID:1944
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:1
              2⤵
                PID:3732
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3208 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:1
                2⤵
                  PID:1584
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5224 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:1
                  2⤵
                    PID:956
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3248 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:1
                    2⤵
                      PID:1284
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5228 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:1
                      2⤵
                        PID:2216
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5488 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:1
                        2⤵
                          PID:4648
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5552 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:8
                          2⤵
                            PID:4060
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5868 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:8
                            2⤵
                              PID:3324
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:8
                              2⤵
                                PID:1808
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:8
                                2⤵
                                  PID:4752
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6116 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:1
                                  2⤵
                                    PID:2556
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=6000 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:1
                                    2⤵
                                      PID:3548
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:8
                                      2⤵
                                        PID:1840
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1852,i,6122397904423401056,16976674862978642780,131072 /prefetch:8
                                        2⤵
                                          PID:4992
                                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                        1⤵
                                          PID:3572
                                        • C:\Windows\system32\AUDIODG.EXE
                                          C:\Windows\system32\AUDIODG.EXE 0x338 0x33c
                                          1⤵
                                          • Suspicious use of AdjustPrivilegeToken
                                          PID:3412

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000d

                                          Filesize

                                          53KB

                                          MD5

                                          1780a016572ecef1088e47dcb70b474e

                                          SHA1

                                          d1530dc4e0b2531dbf5ca2070355cc2219b9d71d

                                          SHA256

                                          ce09d3215fe0caf457fe13de2aa7b0e6148e0547ac84260a86cd433ce1753bf6

                                          SHA512

                                          1e28f3e96014b00cf118d560897c3baa7cd46b416a99bf11536c39794cf5a69d0ac29e5c89c9c09e71fb64818e15c495a8afa0a16b69b792081b77fb855d5165

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          2KB

                                          MD5

                                          dd6ae161eff11dd62303a6dcf624052b

                                          SHA1

                                          68b0da4ea88d0ba9d6eddc71fc43254e26698264

                                          SHA256

                                          a0ab7d401c55875fec7261d901a49e5e32c37828de2dd0e4ec2ac23f42451e87

                                          SHA512

                                          cc075d869d79b93bf57b3bf880c66917570b22b4a69001482b7c020994dece2b07c2318621340de252a78241d053a867e8eb3a9868f78079284fb95e490db6da

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          3KB

                                          MD5

                                          a7c78beb4529606458f6a3dcf7780cdd

                                          SHA1

                                          762059bed37adad26f7675575de5b4389d999d5b

                                          SHA256

                                          cc9e96faa360bbd652310e63096b5a4edac002fef93a977c98b99cdbeb9be7c6

                                          SHA512

                                          bffcc790c4fc2dd7291e451053af081f8b1a1143fb132ce15bcd2eb1bc605b12f4aa86bc79762095e2120d59fd6723834f17998baae8ca797a49a51978fef254

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          0b5f97275880729c84325ae1c5e1f01d

                                          SHA1

                                          389092c8f6c26e2d612a5ef79ab469afb939b3dd

                                          SHA256

                                          c3bfb6922f5366adedba704e8da9fcac066eaeff462cedc478482ddcabde9877

                                          SHA512

                                          1469505b1ed5b8e7e3e010ae82fbeebe5447cd5418138cb516b5f22bdd0b5eb129a1d6f9612f4e4b1d3aa2781cec6ad70c1754c6c304c06d52c3e54531791a94

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                          Filesize

                                          15KB

                                          MD5

                                          163313bb8fc3f0679005f0a0926da75f

                                          SHA1

                                          4dd986d1c6ed83a6b46f0fe29ec7bf27d7b86f80

                                          SHA256

                                          e50837d52b861c95f7f0c38ea410bf0f330b6353d152f64d7306b4e28f1c8ef4

                                          SHA512

                                          192a25d48d2bd98ec0df92eb90cdff1b244697f07e1726656186046c89b76b545a1a8cfddd51b5fb68193b7905574c9c73d962e2cb2d997a13bfb5c5d232beac

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                          Filesize

                                          15KB

                                          MD5

                                          4651353449cdd6ae39a9979f7cd043f0

                                          SHA1

                                          1a63cb48fc802ba46c96f009ce409290c8aadde5

                                          SHA256

                                          df98a39b0b28d2a69681949075187b2aded2286ee91dbb798f7b3b904f47a5b3

                                          SHA512

                                          d090d323704d82e1b7eb34cf63ed7325ef487c19ceebeeede866cfb14a200e3bc357f9673e3d2334e04759a8f1675cce2a88d5fecc5bc163f69a265b9366d83a

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3ee6de3563d833b2fb341c8239a59d7a4a0767be\67ea9ecf-e132-43b4-8091-3ade3794fb86\index-dir\the-real-index

                                          Filesize

                                          48B

                                          MD5

                                          f73913e1e9f9ad19b5556baf78396953

                                          SHA1

                                          bd645b2b7f8e69a073e5302a7855b64f6cd23db0

                                          SHA256

                                          ca092851b74fa9d62ca20e3c8bb2440994b42f7b34de7ed7eedbc17cd595e5c3

                                          SHA512

                                          3f5a285ffd7d74dfbab40e37236be9c4f296589a46dcd5cd63aefa0c6c370f242078a6b101792cd177b68f0644d0ecca49019e9f923961985414934463bb438c

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3ee6de3563d833b2fb341c8239a59d7a4a0767be\67ea9ecf-e132-43b4-8091-3ade3794fb86\index-dir\the-real-index

                                          Filesize

                                          96B

                                          MD5

                                          878d6241c59a4de7fa491e870fcce292

                                          SHA1

                                          3fe2195b51100877bc97358e9e2508d2c5e21182

                                          SHA256

                                          e9f1a6e0f9c6aadbda8ae5076eaef6e19905625906431a57fe2c09ed2b30e032

                                          SHA512

                                          b220183b527dd1426c7cd2f84fba5a15b345a59ae7dc62403205c90f5f2fc9f7cf6b5d84f7ad2b666602d0b427cd569986e8063a04db13f7b3dc817c3b7edd5c

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3ee6de3563d833b2fb341c8239a59d7a4a0767be\index.txt

                                          Filesize

                                          111B

                                          MD5

                                          73ce9fe67ab6996b58320444158b28db

                                          SHA1

                                          550a7e6de08d784d4fe2ff5b049b0bcaf4a2088c

                                          SHA256

                                          72e914b35f92ed22dfde3d6be10839593089e6c2426697c57008dd7771872148

                                          SHA512

                                          124cc799608b46a0810a765983fea139cc839404baf206121c5cc99ad17072e887f3b614d55738318061ee743cc3bb80f6399dd33755e47042621898f6175cae

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3ee6de3563d833b2fb341c8239a59d7a4a0767be\index.txt~RFe56fd41.TMP

                                          Filesize

                                          116B

                                          MD5

                                          2a1edf7e159c7a5a6eddae10aa6e1c01

                                          SHA1

                                          cea5263243a4977cbbc2e7cbc358306d591ffff2

                                          SHA256

                                          216c95365a59cda68951b24e42f02271f9b9567a7508d5fb059db7ff129bae0f

                                          SHA512

                                          f76643cd661f63a1b7b5ddb2562877e0d8151a0105bc0cc3989ec93b2fa3f0faf10856602b9af8f87ace30f9cda1594db75e9b3cf2da5f0fcb215d9ee8ca5440

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                          Filesize

                                          72B

                                          MD5

                                          95fea9fcc56db610e52384bdf70bb5ed

                                          SHA1

                                          bcd2726661f7d60acdc812b861c04622cb000f0b

                                          SHA256

                                          417cc7382723ab6a34aa3c9953b5fc634d60c656b83244737b1ebc8fec91ac5a

                                          SHA512

                                          cd2263fd0b2650a986601c3229eca5268a2a27af0999bc9b11b6e4d62f574a2d999fd925c8281cf1bbc3537bc2b36ede0d069db9ddefd2e8dba5ec90da1bc442

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe56fc08.TMP

                                          Filesize

                                          48B

                                          MD5

                                          1bc3b681a925cdeeec8f8f43c4765600

                                          SHA1

                                          e48cb3f76b8a65f53ea6dac98718dddd9928e9ac

                                          SHA256

                                          603b7c84ab6213860665d617edfceb8a97ddc1936626760ed23e97611aaca462

                                          SHA512

                                          3fa26469d2ecc901ea08dea8264f7623774c1b4b4caf65700428777a3fadc0bf1558ec2739b0975ddee2401f6b2f536e1403db9ba9b9c797d8fa21699f641d69

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          72KB

                                          MD5

                                          0d2880dad995e6cfe22d40b3f9223692

                                          SHA1

                                          32cfc3abbee1f2a00482f6e71b2203838ca45e4c

                                          SHA256

                                          46669e7948531ceeff9fac9580d62e131c1aa2420250bcf917d83f9bc4fd7ce4

                                          SHA512

                                          bfd6ce3914d84bac0122b7077a0f3d38aca34fce867387a5f2c0e56ea203f556029cf64ca1708adbc6ecec7347c49a1309fcdc596f740a5d2fc314c59989ede3

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          202KB

                                          MD5

                                          f3e70765358f3bc773a0d28fc2b21666

                                          SHA1

                                          cd10b28f74b70dc2afd85d2378d80e1598548e7d

                                          SHA256

                                          b0e2c53b7a685ac9cddbaa5ffb451d56d2c7a52a670ee44c0e9930259905468c

                                          SHA512

                                          f941cd8f930f77a2858e366463d60bee27abb83855cd1562b347caf44dcf83172e3ad347fe78578ef60c0f178431feb69da91b9849cb3fd523739fb1d20437a5

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          202KB

                                          MD5

                                          effa5923b2d38558caa653fc12902a70

                                          SHA1

                                          525257bfdfd04a44e0de471292262088f8d239c2

                                          SHA256

                                          c386850d9368953cb402021193264e0ebf8bdb5182d6ab8b99d1d672fdc06b49

                                          SHA512

                                          5c9f0c39c3ea7f446dc3be8006387df5f620fa5d09ab7d39d7798e1afe6434fab352a4bebcb05560a550ac7daf9c7060fbdb9361d8f6235f7cb74c9e833828fc

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                          Filesize

                                          2B

                                          MD5

                                          99914b932bd37a50b983c5e7c90ae93b

                                          SHA1

                                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                          SHA256

                                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                          SHA512

                                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd