Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2023, 23:12

General

  • Target

    https://rise.articulate.com/share/g02W0DnR9sdGciWfqSRw9eM6DwUWfTin#/lessons/dvCrNL7jXAwlNaO8PXhvy8aWiFXdHuHh

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://rise.articulate.com/share/g02W0DnR9sdGciWfqSRw9eM6DwUWfTin#/lessons/dvCrNL7jXAwlNaO8PXhvy8aWiFXdHuHh
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89b539758,0x7ff89b539768,0x7ff89b539778
      2⤵
        PID:4848
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:2
        2⤵
          PID:2116
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:8
          2⤵
            PID:3920
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:8
            2⤵
              PID:4576
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:1
              2⤵
                PID:4788
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:1
                2⤵
                  PID:4468
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4540 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:1
                  2⤵
                    PID:3796
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:8
                    2⤵
                      PID:4496
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:8
                      2⤵
                        PID:1060
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5172 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:1
                        2⤵
                          PID:4752
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2828 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:1
                          2⤵
                            PID:4640
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4772 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:1
                            2⤵
                              PID:3288
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4860 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:1
                              2⤵
                                PID:3612
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:8
                                2⤵
                                  PID:992
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4904 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:1
                                  2⤵
                                    PID:1344
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 --field-trial-handle=1804,i,4748757950617195109,14200187474303712644,131072 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3212
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:4660

                                  Network

                                  MITRE ATT&CK Enterprise v6

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    168B

                                    MD5

                                    14efa01e7d2766bf213d840b631264d0

                                    SHA1

                                    86b2be5c194dafa0d2afde04a329e93f9da38bac

                                    SHA256

                                    74cea5d00c462613419a826e04e119522d3797882526ac1ed8c89ba69d53e3e1

                                    SHA512

                                    b91e91f19d5aef1ecc4a2a664a6c3206e9552d1d9e603a2c7a6546b1548c0bc9127756cffbf39d088da113dfd0d376fd0e72ffbf561f522121b3fa30259e3bb8

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    240B

                                    MD5

                                    ac7e3f93847293a3def3667a83b65505

                                    SHA1

                                    556469022f4b3ae18a9de1cf3e4d2ded7748a572

                                    SHA256

                                    75a498ffba769d175ffd49c7b9df36f475914178617a8d9b91a17afeec70ad84

                                    SHA512

                                    1ae30a26ac5f37e73f03f89b107147391c5434c61ff3f19696d5c6f85cdbb133df724e681978d020d41d1c44c783a9def53da1da61616accda089a0e605f3bff

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    2KB

                                    MD5

                                    4f37275b3b15d857ea50f0638908bfb5

                                    SHA1

                                    997d01c7fb309e38dc01b588adb498154ed870a6

                                    SHA256

                                    fa11369344656f73f1f857c8a58de87c37a9d00cf5e0c11eb927eba15c591e91

                                    SHA512

                                    c696ba38873417ce65d56f22c59c6abe5767dcf4fa8065b8f6648a1620bccb283e01440fb3b484f0d23da150f5900fbdf8f35c92d0e2e6a8b0ec523f797857df

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    2KB

                                    MD5

                                    843f54f88e41c46b27efda60d09b6edf

                                    SHA1

                                    2820fabe4abc197a9c60ab82046c9fc01ba1298a

                                    SHA256

                                    4494bf9aed4afb2f8b18362b0af5758a8d74e707c5a221c441088a4ffe828253

                                    SHA512

                                    fea8b1adf6304ef569c4f0b64bd921605481d4a29b9a900acb191efb8e34b348878c48a9d2df6d2958950296231a14e27c781c6cc6559d806d96b3edcff05f6c

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    a7234172c7e02b0677964fe033599421

                                    SHA1

                                    752b09a0d1d162c6f1ccdd8d3d8558eb1976d64d

                                    SHA256

                                    e7f017fa7d63f803b0e5f1f2b4874470bd9d296c048995a81e16cd4a1a704653

                                    SHA512

                                    5952e6f1512326698f73ec6543dedacfb9549c75ab22d9efb735ee841c96e742bbb14fd373ef3022a51d68b9e64870594a115b4ede27ed5eea8752d94dedfbec

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    62e5f36f11a065a103a8236156e72ad5

                                    SHA1

                                    7ced504759ba314b4b20f6ba88e18df8215ab189

                                    SHA256

                                    b5c5fbd27a013fd0606a2337312364f8595d5a9bc58de67d5f125fa6cd303dde

                                    SHA512

                                    5aa404d914bda2d79e76d863532cc38b3ceed0dc4c49b4956502f443f9c9f0875c8117e003d53aea0d9d6b60e173d744338cfab66a1d0aebfb3e93d0b4c863fd

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    4KB

                                    MD5

                                    b29f274d9ded1110e7aeae65d12ae994

                                    SHA1

                                    65be50875e385c39419f92ea10c4cb483a45617b

                                    SHA256

                                    7bd1995c4eb65f7adfdda441c475dc2fb5cf8866db32abf4cb06c4ae6ea18bf4

                                    SHA512

                                    4c9bd5c9293a1f6d9a7544dba93997fc6c790da4bcbf12fca164858a5a79c551e672c6e9d262412fcf8909fea44ff59cd3fc4306c9a13d4a8a8076657d7cd75d

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    4KB

                                    MD5

                                    9afb67196d97d6a61fd1b64e2498283d

                                    SHA1

                                    00e3e75bb7fff650b563dac951d1fd0a08c2624e

                                    SHA256

                                    60d465de52ecc0b0e2cfe8d9652f1a436219e66cd11ebc8be639db43f071d0fd

                                    SHA512

                                    7d981815756a5f1ed5f379f4c6609e917c424def3cf7e07430a3ee8d61fe4900ab2c15638d44c8e5dba0742a82fdbcaecbb48fe5f64523c402e5fd10d5b1c59c

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    4KB

                                    MD5

                                    9cd0cff45a384d22fbf625592b891103

                                    SHA1

                                    28b69d47c6129f1f09cb9fbd7a85b01df1ed159d

                                    SHA256

                                    135845a54e4865945d50c9b916103c037d40cecc252c20ad59ee51f8e5251718

                                    SHA512

                                    59ef58caa12a5e2fb16f7bfc73568cc467814ab0d797d3287bc473b96d75dce9ad76e5b0d03fd6addaf96c2522270825d1781541f18ca27127478d6f35cd6847

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    9a300f04c4e73fcdc1cd12afedac59ec

                                    SHA1

                                    e153afb772647d0c74c34b743c1ba59d1a528cf1

                                    SHA256

                                    6f9770239d613a6ea8eb3bbb6714589f3c3ae18f5214cf25de63fdad68e8c718

                                    SHA512

                                    315588d0a278907c0c291576c117ff92c1427e1b3dd4cec27193a38680d51d3033d80969b663302288b3d2340a0c9f6c32adaad560f68f9c081eb412c17442f8

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    4KB

                                    MD5

                                    b492cff58f83fa09e131c00137ce2dd9

                                    SHA1

                                    fbc7f9df4149267d80e820ffd91bfd41a4f29515

                                    SHA256

                                    132a2fcb54015fe64c6e8d3fbcc9878d479767e501b385657777e63976334845

                                    SHA512

                                    2a563c49aa8272793a97179577bf3464acb9ad185e93841679b7f9503d5197d0992c59bee777cf6be7bd3aa1d1c6acf877724e62dab46a835998a014aa15645f

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    8KB

                                    MD5

                                    f0b4b3e5442dd286ae2cfbcdd04b6d81

                                    SHA1

                                    641b300db402306b87093912db1809d9c46e3e33

                                    SHA256

                                    8b627bb063d5bf5059f0eeb51084b6ed506577199045329b8272ee56baf2d40a

                                    SHA512

                                    d8b95c51c029683614c97b688a1b9abda1470ec390d82542165f48d23c0022d71fa0d27ecd56b05af1494f70f018cc30d7ad0f52cda1ff01e46dc1ee5f1fe6de

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    150KB

                                    MD5

                                    1cef33195cc19059af257d341b1ae9bb

                                    SHA1

                                    6cb3a086a890becd5155add541d78af14328de01

                                    SHA256

                                    7b0f060a0389b647e60b74d48ca2831107d7f1500bd7210f00f7c76aa62bdc49

                                    SHA512

                                    2a2e72f5122fda60fd202af44913918674c7cc36734151d7db4c22558592c7afb9122b375cec7706fd0f0205517e2adb5be527d486ba2aebdaf3ad0939ffe579

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    150KB

                                    MD5

                                    129d0ec95260e053902afd5276a4549f

                                    SHA1

                                    0d0f58b308d6339fb9bdceae73c792accd552d1d

                                    SHA256

                                    0266ccc310a59fa5199b7670f5c1bb4057cca90cd7a206280426eeb6ae2885c3

                                    SHA512

                                    3da114ec094f2c83c0f0e31b8229c2f4c3f85decc896a4eb1cb9d156c45e97afbe2977b46912692d36fef3f3a98f080803bb98cda4c8dc477a0763a8ff5a6434

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                    Filesize

                                    102KB

                                    MD5

                                    000e55dca1555a9625a4e3a1843a42e7

                                    SHA1

                                    42da7fb1db8b068a6e11dc76ae5c6715db02bb4a

                                    SHA256

                                    c7e3234501f5433b5c3f27549fbb8dc917471b3bdf953d4d526861dc9c1ba487

                                    SHA512

                                    3005372fa0c7543525f4bbaae8834716a83158a8e1a5bb2e04c762b6eff0114b3d2cb32ce94361e6a6d820c10d8e0c586b8df892640e4266f3e97be95af0cdd4

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe585714.TMP

                                    Filesize

                                    101KB

                                    MD5

                                    739270dd84c91c70eab3e8e8af774510

                                    SHA1

                                    d5576b6d751ff4537ed178c17ebdd6a536abd85e

                                    SHA256

                                    a5d377eb594f8e0bd7dc231a73c442b77099987dc8815d31cc8b092c53aa9892

                                    SHA512

                                    f5aff824760465a40751567b9e206ed792bc6259c10de3b1a7b5df8e845d41d7f9960f893b421ea8bda0463d0aa6fc6251ffc3700f8fc6ba46e22f437816749b

                                  • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                    Filesize

                                    2B

                                    MD5

                                    f3b25701fe362ec84616a93a45ce9998

                                    SHA1

                                    d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                    SHA256

                                    b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                    SHA512

                                    98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84