Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    96s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    08/05/2023, 10:36

General

  • Target

    http://w9cNHMipGj.antui.fr?Z294b3BhdDQ4MEBqb2JicmV0dC5jb20=

Malware Config

Signatures

  • Detected microsoft outlook phishing page
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://w9cNHMipGj.antui.fr?Z294b3BhdDQ4MEBqb2JicmV0dC5jb20=
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2396
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc949c9758,0x7ffc949c9768,0x7ffc949c9778
      2⤵
        PID:2452
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:8
        2⤵
          PID:4472
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:2
          2⤵
            PID:4488
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:8
            2⤵
              PID:3224
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2740 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:1
              2⤵
                PID:1108
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2732 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:1
                2⤵
                  PID:3856
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4484 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:1
                  2⤵
                    PID:3056
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4336 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:1
                    2⤵
                      PID:3068
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:8
                      2⤵
                        PID:4628
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:8
                        2⤵
                          PID:4780
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4032 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:8
                          2⤵
                            PID:4600
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:1348

                          Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            717B

                            MD5

                            cef25bf9f0c02e7454ecdb072ffd8bd2

                            SHA1

                            7a478ec99edced095595212410e5ed187ea2c6a2

                            SHA256

                            6d356c6ffa836796d3481a457601c7b2ec8223df840c3ff29b54de0408c1a952

                            SHA512

                            ea7eb24dad689a5d6416cee255fa99e1538e48d2e65cfead9461d94e239926d5b99d3ffeae45ddb7137fd40b7db9a2f2b6f8cecbf8a522ba97cfab85fc651703

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            538B

                            MD5

                            7c7e106a1e314e82015ed4bf372017b1

                            SHA1

                            16330521966022d76e5686c4e24a2c1c042c786f

                            SHA256

                            386407df2ba0a4934e17fee605169186c4003ee55ab3963445475012b9789e62

                            SHA512

                            e65df82d1376cbc2c55eb1937be8d17b16560f838f3477a36b16b85422b24acb85b5c5083129231bb55d7928b0f7cd3315b8679b658e14f81ce554fb1ab9ec6f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            1dbb3410c6aee60bb91f6a5bcf68cad6

                            SHA1

                            b72223588ed7bb41a27a162fd69281b6a79ec12f

                            SHA256

                            ac8504f4da4749237466d44ead4529bb6450c65321b7f5f59f6189756ef7fa99

                            SHA512

                            6402db16a8465e7e5bb28832cf3f1bd10e391d4d6ead453895b00db2cd404e2b1adc483cf9e2c2f58d5f22e26fc4dbf0427283c6819078271e7f22cdc3949506

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            90b4e14f8c05cad3cc70c5fc0ba31ad2

                            SHA1

                            14128fdd2a922762da2e27bdaaf95f08633f36cd

                            SHA256

                            2b8c008c78e17fe16672ac8facff38863ba9d996c914ec32e1e75df72d3ad802

                            SHA512

                            7f4f5346183b49bf7ba92e06298d906e9e300b240ae6f27007599e247af53ac7520a3099dcf346d38c95c5a53045757d5c644ac625c9d4a81415f31d07e58371

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            3b7a7c2fb0e5cf82ee739854fd68b782

                            SHA1

                            be587876a959f7010795e19ada7cbb0a98d2c2ab

                            SHA256

                            65edbbe58f7568b2469734c4b06c4df1e590c533e0e58215e87896ab98e11540

                            SHA512

                            a8e0aa8e96975b9ce606f31ab797a988e700630d054bc7c52e271838b36ef44d23e43f1ff4a814d5ed143e36428be69571c86926974ebc859f8b8f25cdaf0b2e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            3c84edaadd5e7ce73051f42dab86c259

                            SHA1

                            cfac8471920c605b5ad585d15e2a507f021d3121

                            SHA256

                            cddc646fdc47e24f93c17a74831356aa0485d79208e47e01cfa0dc9d0a548e22

                            SHA512

                            f25d0a6aa82deb84b23ee9b1240515d3d49b44e3579fcb60445d6599994572d65bb686230d89930906da2b6760cc8b5327c9a456a67d7ac66e5aec2081372524

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            149KB

                            MD5

                            0888789b74bd625ef1d5c0c3c782b542

                            SHA1

                            bba0c6a6e3f3666a14963ea2f32a3f7b897e8046

                            SHA256

                            db4577decb26aca5a160853a2661b095320914fed3516160d5d4c9accb93f7a1

                            SHA512

                            c0d41e5e77daf54e1a881605a76cf73792d5882ee61d4c3ab4119904d182322ffdf2b4a4f397247d336319eb47be602ef534076e3ae2dde9a21acd391def2868

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                            Filesize

                            99KB

                            MD5

                            07a8d0e0f187bdbe280df066356d706d

                            SHA1

                            57f711fac4e4c3c48a218ed7c59af408c253d930

                            SHA256

                            e130e1f97a814301f4c469f20ab65b1f66f18343a23b7037c122fff8778a3696

                            SHA512

                            16815bc563025044734ec52c9fc31856108ad5d98cffd1b91ce338697a4f5ee3034c54ce197df31cd68293da10a0323dcd8468fabdd17945e0fb5912b622453a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580191.TMP

                            Filesize

                            98KB

                            MD5

                            ca987830b4d0230952d5e83eb06755b5

                            SHA1

                            db788df47dee4e08344cab5bb8d98d0adbf2995c

                            SHA256

                            1f1b155335efb122c56caaed47a54419abfe18fde5ce0903b0a8f03aea93ecde

                            SHA512

                            7d9b0c874462a92c198e7653978083188cbda44524a4b9140316e1d9fd4b5d8ae7b0afcac9fa59d34c70097b25706a44c53d5b2eac4f09841686c23afb62e04a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd