Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1800s
  • max time network
    1797s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/05/2023, 14:37

General

  • Target

    https://ipfs.io/ipfs/bafybeiakyjshnzqfcymbyrlmdg7mn6tylo4lysur5i5jxdkfmyifsxqxa4

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://ipfs.io/ipfs/bafybeiakyjshnzqfcymbyrlmdg7mn6tylo4lysur5i5jxdkfmyifsxqxa4
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1368
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd3bc9758,0x7ffbd3bc9768,0x7ffbd3bc9778
      2⤵
        PID:2204
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:2
        2⤵
          PID:5028
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:8
          2⤵
            PID:1896
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:8
            2⤵
              PID:4992
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:1
              2⤵
                PID:5080
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:1
                2⤵
                  PID:2368
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4636 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:8
                  2⤵
                    PID:728
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:8
                    2⤵
                      PID:3144
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:8
                      2⤵
                        PID:4716
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3680 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1152
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:2708
                      • C:\Windows\system32\AUDIODG.EXE
                        C:\Windows\system32\AUDIODG.EXE 0x338 0x394
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1548

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

                        Filesize

                        1024KB

                        MD5

                        28ca7ced579a7ce289edefef6dff6ea7

                        SHA1

                        71129493c393d52b64ca295acbf2c49c99c2046f

                        SHA256

                        07c27818c66d88e023b762afda1cc28b7fd422cc5456c788c22ad19c1157f522

                        SHA512

                        b4c22108ceb20d20eaa86bee3fecc9fe6acc164ed483b83e257a8c3437a0bc27a067473472d84b5af919bf199990f60f2672c2cb213d7cad5fa0aabe61d4e513

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

                        Filesize

                        1024KB

                        MD5

                        81d04c9cd641b5c6a44c9e9307e91ac1

                        SHA1

                        207af3d0259791921322c2bc7214285e70acec2d

                        SHA256

                        9dc914f778fc202f87cea7e8de3c153771586eadd67e30dba8471b2d9416f736

                        SHA512

                        a57c915b5022a0e28ebdcaa9fb6700047911dbb822ea35cfac4e56e8138ef7de6c3d61925fc54f868eba9117047427812cc7af0b934cac2829d3ac5da8b85c5b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        1e3c956ecd90f28706640c0ba0d28d9f

                        SHA1

                        a7e0307a564db42b4f16189fb7331787218dff15

                        SHA256

                        a77ead18742b91e89879fc1fc65829a79f685969ff8f061e10c5f7b98037c169

                        SHA512

                        891fe71c71e33970407db4df67bbe9af13e735f9ffdf3f3d61dd171ec7e24d1d59664fea222be3d80e9ac11efe128b766e4b17e8e3e30129bac404881812e449

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        694B

                        MD5

                        585fb7f5360fa487b6e6334c984c5dbb

                        SHA1

                        15957f8d1b08ba4fa733e584cceb4ffcdfacc983

                        SHA256

                        2c34a2e785f6919b3432fedda2a0087c6fd581cceee99dbaa7b974c889538245

                        SHA512

                        c3acd7ec7e29d6d9f84e88c45aba46ea94a1ce354f60e0ed3d9d3a73431bac4fb0688bb0e03cbafb2f1f85e2cf2f3070f78466e590c760fd9ab83042f54f3acf

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        538B

                        MD5

                        a65a9975e2eb04dc557fd6cfab847d76

                        SHA1

                        59212442e858a88757362023963fa80115b81dd1

                        SHA256

                        0fde27644d580702d918585d16f7560e592838260ee9615ec504781d48639f41

                        SHA512

                        e0c28e70e99c880ecbd7608ab6270ce1094b505d32ab2139b559968aad56d50b2d7453bbee0c6cbc674ce2bf4fb9264c50af1fa5687a302915c244c12cb774f4

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        c5131309f6c21b2acdc8a14c78380713

                        SHA1

                        6d5e3f9089a332143f789d3e4ec504cdd60d453c

                        SHA256

                        0e4daff46febda76fb118c21e5526355c05ae6692b6b7e7d370a9d5aeb7e83cc

                        SHA512

                        b0970ee52c966e8f5a63f2f170f829348768bd4a3c2a948690bd762db1b74e375b87beda751b86f3b3fa1e4f4b6ad2b4f851630b22cb254a036ec2313c7c8298

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        c952c0b2fe979789586c5d6cdc953959

                        SHA1

                        99f89e05926b3685540838232e7c1306b411bc0e

                        SHA256

                        d69f13528830c0bb92c06de3e39039503dc2a21836b7ecbb800a383a80af192b

                        SHA512

                        239158ddfa512939c2d4a4dcaf5d697d8267d5c835ab36919895f9ce169ff123802b0f370f33887fbd062fa86824cdb96f9abfa211622548214ccdb232efd4cb

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        4ccd1bde8d1719e18c0e7655a7c96ab2

                        SHA1

                        f406e589004c9504aaf19d500f1f1ac93251b9da

                        SHA256

                        11666d8c6a7bd69f0f06eb7155ef54e9eb62b410f915a404f818cf8e1d70deca

                        SHA512

                        4037443712e7b56e5a99241eb475331b23d25cbe3570bc061c5cf3304fb68857823aaa55ef0a313b5d5a1d346f34f24332127eb79f0f51030ab9c89b35b5f7b8

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        148KB

                        MD5

                        920842f25f2bdcdeb7106182f7dca2f8

                        SHA1

                        c847dba3346e03296ba3a7b8f487cc3a6ed18f52

                        SHA256

                        b0c040c34a0477f27b757c9558190304cc77c8534e31c55a323287ac6122e8c1

                        SHA512

                        280d8d9046e07449fd158bbbd34d76b9e8874e50049a1f50d299676c8e8867caa3686f2a8a5113c186a797b4f2f55d578f1817bfedd21e7c1c7f0fc98736aa58

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd