Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    30s
  • max time network
    32s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2023, 09:19

General

  • Target

    http://8924803779

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://8924803779
    1⤵
    • Adds Run key to start application
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4692
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa91569758,0x7ffa91569768,0x7ffa91569778
      2⤵
        PID:3824
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:2
        2⤵
          PID:4656
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:8
          2⤵
            PID:640
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:8
            2⤵
              PID:2304
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:1
              2⤵
                PID:3896
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:1
                2⤵
                  PID:464
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4560 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:1
                  2⤵
                    PID:3508
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4832 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:8
                    2⤵
                      PID:624
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4548 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:8
                      2⤵
                        PID:4760
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3828 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:1
                        2⤵
                          PID:4340
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:8
                          2⤵
                            PID:2108
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5544 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:1
                            2⤵
                              PID:2904
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5736 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:1
                              2⤵
                                PID:4376
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5840 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:8
                                2⤵
                                  PID:3208
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5892 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:8
                                  2⤵
                                    PID:5112
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:8
                                    2⤵
                                      PID:1512
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:3632

                                    Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

                                      Filesize

                                      37KB

                                      MD5

                                      519005befdbc6eedc73862996b59a9f7

                                      SHA1

                                      e9bad4dc75c55f583747dbc4abd80a95d5796528

                                      SHA256

                                      603abe3532b1cc1eb1c3da44f3679804dd463d07d4430d55c630aba986b17c44

                                      SHA512

                                      b210b12a78c6134d66b14f46f924ebc95328c10f92bfed22a361b2554eca21ee7892f7d9718ae7415074d753026682903beba2bd40b35a4eeb60bf186dcdf589

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      312B

                                      MD5

                                      f2f641c4603250b7be438c799ae0b470

                                      SHA1

                                      aa5ca285710032eba185e7d56eb394c5cefd9e2c

                                      SHA256

                                      ae4e828a4d3e60703c7e8cb57bd0d56084d3d578aa16bafe5012141b48602e89

                                      SHA512

                                      ac70e4afc6da63b9bebd7226d0db91c7a3fe5fafa28eb1b27192fbe5c41d115207dc3c62aba59a0c452fecae3f7241fa2191a54be8fd00cbef8484f6980dc126

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

                                      Filesize

                                      264KB

                                      MD5

                                      f50f89a0a91564d0b8a211f8921aa7de

                                      SHA1

                                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                                      SHA256

                                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                      SHA512

                                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      8edd6b94350885d0561a88ca749bc19f

                                      SHA1

                                      b4fa17748edc157955a4229155494d09b2ede1af

                                      SHA256

                                      b9196b773c5e9907a01c68326c3efb44ab470f1f524312ab98663286462b2591

                                      SHA512

                                      58a7042b0ab97684d50bc7bb39e476587f935086dfc9f2cabfce4688f29261b51703e6b6938f9879837fa75c06bdbe100d71d88b9bd4d7572723ebc4abec5af4

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      371B

                                      MD5

                                      6ebaaf0d10b4e7de8fadbf879ea1114c

                                      SHA1

                                      6e566f0759dcf9ad4af963ac6ba5a160c132c8b5

                                      SHA256

                                      54b4ffd3dcd4bfc8cc049483a590dc0fba54a29e7c29aa2f96a8541a208f420c

                                      SHA512

                                      adc0abef1f02584f0261b10ce20acfcc702d81365976d9942ce175d167ecca7d7e4d2b1e0885418eb5d9a7061a56f71873667f167d9d7b300fab0958f31409ea

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      4KB

                                      MD5

                                      49fa35f86b43cfef2f278afcc65b5668

                                      SHA1

                                      075b199ea2f78103d49b0f8010ca980dbfe15fe2

                                      SHA256

                                      d713a03b6a7c7c96140cdd52e6cbbc326641e5188d2db218557d3d6ab2334d09

                                      SHA512

                                      db50707964b957e9d5c43db5e89b3ec40dc2cbf6d066c15fa58bc3713921b81b7ad51df1e585bd8a6eb753a176ade9469c4d93894a800e97bd1dd78ee192ea91

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      6d51c727ba078a71e838864c60a1c33e

                                      SHA1

                                      c653cd40ddef9566129740c2d3f4ba1a3d0e6c45

                                      SHA256

                                      c9b3c0422f5a8b1f1d2a3384c66ec874e4f4b96511f81ee662ed4889bc043d42

                                      SHA512

                                      796a595b318084979005cbe7eb79990431ad64b5009e2f30373bed9cd4a4ad340062aa69d7050d809eed2f518d7004411e009254af9e05eec62478c594a57a1b

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      147KB

                                      MD5

                                      095e740a45a27adeaffacc63dc8651b9

                                      SHA1

                                      e30fb3adf45c20a46d3d7e6da50b8f901a6ff73d

                                      SHA256

                                      0aa85b3f5f90d1275692fbcaf371064b5d95e0cee1852fe4cff8376aff72b2e3

                                      SHA512

                                      1a5af2d4719dd46d22e675daa65e7ee8dfe605996ba40c2750ad8a7565aa639c84a553452960da264cbba63ca13c8be115a3a3f98b82330af53fec948c5056f9

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      147KB

                                      MD5

                                      cd9477a640a82ed8dc9cc9a5ed2d2286

                                      SHA1

                                      0713a95ccb3cfeba96bf4bec521b5fa63cb7b15d

                                      SHA256

                                      87d57e7519cd387b55de5d6f3f11cd4da0e8fee9d0f2ea4792e505404d19d17e

                                      SHA512

                                      b7d36bc7afbe7aa0cd8c978b801ad87cd107343985348398f58f44f6f693b3a26ad34a0c006f10ec6e0e66a40c0a8bc51853ca01017ba3b71fbbdbcb87798cd8