Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20230220-en
  • resource tags

    arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system
  • submitted
    09/05/2023, 14:39

General

  • Target

    https://securepubads.g.doubleclick.net/pcs/view?adurl=https://colnoticias.com/mini/miniature/?antde=Y21lZGVpcm9zQGhvdmlvbmUuY29t

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://securepubads.g.doubleclick.net/pcs/view?adurl=https://colnoticias.com/mini/miniature/?antde=Y21lZGVpcm9zQGhvdmlvbmUuY29t
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3144
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffab6a79758,0x7ffab6a79768,0x7ffab6a79778
      2⤵
        PID:3768
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 --field-trial-handle=1720,i,4020082489270192265,10218099584426982005,131072 /prefetch:8
        2⤵
          PID:1812
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1720,i,4020082489270192265,10218099584426982005,131072 /prefetch:2
          2⤵
            PID:4120
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2028 --field-trial-handle=1720,i,4020082489270192265,10218099584426982005,131072 /prefetch:8
            2⤵
              PID:3944
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1720,i,4020082489270192265,10218099584426982005,131072 /prefetch:1
              2⤵
                PID:944
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1720,i,4020082489270192265,10218099584426982005,131072 /prefetch:1
                2⤵
                  PID:1336
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4672 --field-trial-handle=1720,i,4020082489270192265,10218099584426982005,131072 /prefetch:1
                  2⤵
                    PID:2652
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1720,i,4020082489270192265,10218099584426982005,131072 /prefetch:8
                    2⤵
                      PID:4576
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4920 --field-trial-handle=1720,i,4020082489270192265,10218099584426982005,131072 /prefetch:8
                      2⤵
                        PID:4920
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1720,i,4020082489270192265,10218099584426982005,131072 /prefetch:8
                        2⤵
                          PID:3312
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4820 --field-trial-handle=1720,i,4020082489270192265,10218099584426982005,131072 /prefetch:1
                          2⤵
                            PID:4932
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4980 --field-trial-handle=1720,i,4020082489270192265,10218099584426982005,131072 /prefetch:1
                            2⤵
                              PID:3400
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3192 --field-trial-handle=1720,i,4020082489270192265,10218099584426982005,131072 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:2032
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:4256

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              192B

                              MD5

                              fa79f17c5c5fae5970d2329fbae9f069

                              SHA1

                              36b274ef7a7a45c4ea2c794882a287eeee7156db

                              SHA256

                              5974a3481f3eaba6c885de5d590d511da51fed8cc9b1e64fdf7ea57474721f92

                              SHA512

                              55b299857b7a53b90ece720f1a3a65ac7af18bf2f7c5468f17114d461a7333aa49f91719c3f5f0c80b37d0f54d51ef527d72d04c11353ae95bccbdd5441ffec2

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              0f4c3d3012248c955c818190eb15f333

                              SHA1

                              5ccfc475aab59dc3c697d204fb3626dc68b946fe

                              SHA256

                              d7fbf93fe200eee96ec114780f1d05a0efc1ad4f9bf9fb9c051c70f26ac3aaeb

                              SHA512

                              b262c9c6a8dd5f7fe1d1c00516d3cbd46fb0cfdb9bb8e16a0adbe9dffeb6219b2d582c5ce53093256cc0ae1aa36d78e45033f0a1bd7b79bbca27de9469591afd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              0fb74ddee1d6546f285455dfb5cbb3a4

                              SHA1

                              7e38cfd8c45077b2ec4ab9ae1957883c6e90be0e

                              SHA256

                              09cd732df007bfe3bfb4a247eacf89b7a02e4c967d6aeaba37a2d2823c2da80c

                              SHA512

                              d5fdae4283dbdc9825af4a571f4bd3cd8e0c88f7547b5618364cddf792008d24de5eb6482ba49200855ba355a75e66eed12c66105c425824300ab7430a8d1c94

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              11223b07fbd85e61bf51da19e57050e9

                              SHA1

                              9191d6d529589491fb8eaaec542e7156e8165024

                              SHA256

                              339e87326542aa5c61d2a57f1f247778ffed1feaa67804d41126b6953d614d6c

                              SHA512

                              10a8d80f4abe9ae39698e242ff7b4fe9d3b913395f962ea274a30b1e196ad6ef9c52c9553d7273dbaf6d9aca5a82ef46d9ccb3c4d40e079c3f16217c8c7e5024

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              f9ad945d7582037298f845f8177047ea

                              SHA1

                              f323502403bc8cf9cab645dd3dbc69151b9c9fc1

                              SHA256

                              eb07a79c893e59df9743489068c7c3931b8ea1be99150d9a9ce4c611547a4a79

                              SHA512

                              3486df4f7235bae15acfd2f59bd90feecb0d0b4ea1bbbc5ead8e7ba6747e7e0cc4435632ee9a0eea5ec239829937cbc5a7f3e7a4074f17d09b8a8f0e221c4d37

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              b7516b09acc15930f9a56ffd200ba877

                              SHA1

                              65296ac6796611d28321be8ab132cf20c7563827

                              SHA256

                              9af144f87372051a8c2397e755cee290e04d6c2b462d03c091f9b03ed4431191

                              SHA512

                              96d5f5d7ae52830f2f30b95316cbc5e1ee8570c3f12985cfe6f9fc8202e6f0c5363f72df01a58206246bc530eff4762079fdeab4035eb8989f5fa9a36398847f

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              65470bab2e2e43b2d4975ecfa19118ad

                              SHA1

                              f1d30dd1842c4dc35637e4adad88a45bcd6f79b8

                              SHA256

                              6ec4c34837a21f72e499f35797f0df174805d475d76832bfa1886a708e95dd19

                              SHA512

                              c4f44eb1229fbca88318c3fa79dc8a207408c4badb8fd8c795d5f03e739ef44e3844ae7815ba53a7de3d91b98cb62dc20eaaad18fe1320d2c472eed8c0caf6d3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                              Filesize

                              12KB

                              MD5

                              c6b1f99fa75460cdf20f898c29eb69c7

                              SHA1

                              b65f26148e47ca0f37cf6d5651bb9f0278f462ae

                              SHA256

                              8bac6ab0d30cd4f63bbac28cf713f3e1f27ea02d2ef916965aa515c9bcdaca4c

                              SHA512

                              e841b2bcc641ae24b3747a5009a4be13a1c76b19293cc6b6df40fa0c795afee05eebaefdc4f5b61be37df679c134321007257c3f4766e2729a63fbd6bc121606

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              149KB

                              MD5

                              c48d53bd1370a1ddb20b9e249f326d30

                              SHA1

                              a2ea87b902f7f1a826ec0ed9814a5f25d137759e

                              SHA256

                              b0b3c947da08aaa32e767178740683661701e6ff49fe2d7a34d2eeb6c126c9b7

                              SHA512

                              d7204c5fd4463e13c63bee04aac0f2e569b256a196a29e70d5f0093b7271bb49d01b16b4ec8d4845bb3764e3d5886d8b5265686eac0b803214ccd20366617237

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd