Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/05/2023, 18:29

General

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: LoadsDriver 3 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/[email protected]
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacf3c9758,0x7ffacf3c9768,0x7ffacf3c9778
      2⤵
        PID:2948
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:2
        2⤵
          PID:652
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:8
          2⤵
            PID:4196
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:8
            2⤵
              PID:4784
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:1
              2⤵
                PID:4836
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3160 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:1
                2⤵
                  PID:2588
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4484 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:1
                  2⤵
                    PID:2900
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:8
                    2⤵
                      PID:3948
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:8
                      2⤵
                        PID:2092
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:8
                        2⤵
                          PID:4048
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2700 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3948
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:4580

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          168B

                          MD5

                          1aa7380b2f4d2ec4dc4d3c1ab7abed13

                          SHA1

                          7c0e24c5113b80a168b123c3a832b61b58040892

                          SHA256

                          21dbe00cd4d3a6d0bc7991d26366d8027952b970e03ec72d6caeaa8f00856371

                          SHA512

                          bd925b01d141dfd0ab2717db850661fd59e4e3ac1ea817f44f9f8979beaeb8e3bf53c43b0d3373de258752ea9bef6c527f37ec7d206549060a9e9a6ccfb92f86

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          2KB

                          MD5

                          c203374894ddb2d57287f3383bf96700

                          SHA1

                          9069ce854ec05ead1b6dd53499c2dd44520314df

                          SHA256

                          449dec352fd4ddcf990ce747d69afd70750f5b1420d322c68ad0d98747c3d04f

                          SHA512

                          b1e1a7b81340c4e62830b6f5a73c2cdafed848d5a9dadfc74b6b705dc2e2863959d24235ed3a70a810ba23af70358238032082f0d41814125afc4185d4eb1caf

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          d51a2881e100e6cb7f4d05df216fd6c5

                          SHA1

                          4e14078beb4dc8fa14ab201fd743662a12b242fe

                          SHA256

                          e4155b9c4ac10237440798911849c2d5c98d24de511db1ca0d014c3e93086b54

                          SHA512

                          1d377fbd0340266846111b585935e970fc057640617f0b7a6ff81607d23ba1bc571c234358e39a52a360bac371f701c12e50bc2d3ab64803eec29bbc9ea66167

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          a2c759e46a35aacd46dfb3ef3b49d3f5

                          SHA1

                          d3cfc0dad91fa9438484175951c558c0ba3d4689

                          SHA256

                          62c29e9cca2502970771a420c723e5e6c200068f01e3c02535e7d6ec212a568a

                          SHA512

                          dc73e383c7e6cf6cb9d2eefc304e96719010b2d99e83366d4b807d4f82745eea3d2b8f4a5ea675ac1ce2d5480ce4f0085a5e003637f1d52cec03aeb8499a9fd8

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          4KB

                          MD5

                          c213b148052c3792aa2e288b8da6268c

                          SHA1

                          28f4ab320aeba2d14bf9853494d69a4e6ce25abc

                          SHA256

                          86552b6baa94cbbea30dbeda5492505846af155535eba282b5b4ab7e1b59380c

                          SHA512

                          05106ee3ec3b1126e43cb6884f2545b3ce7a3b4a0e942755b0aadf68fbd289b16c694e10a75b438223c227c1b00546fe02e5308fbc10532b6760d7f89b6bfbcd

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          4KB

                          MD5

                          add3a29ccd6b62efe34b7bd2a3bdd7ab

                          SHA1

                          e317b3a38f315210ed314fa79fa660186874e9af

                          SHA256

                          177321796db0c213cf5e58fdde28149d1d4c89b8dbee6876399dabbccb43fae6

                          SHA512

                          356251a31f03bb8f9975d9c59a8e6e463a9b1387b684a81115c453b87a7785d04de289ecc585b3095eb0913bb85ce2305fe1505fa7a5c306611d1dfc3bafaa64

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          4KB

                          MD5

                          b47f18ceec54fba68203044134881c28

                          SHA1

                          9fd0a6ce63b0fde5553c79ee5779bb79bd6c5226

                          SHA256

                          ca10e91e6705ee80dcb71dccea79f85feec83dd7c68d63200faeb2f34fa7edea

                          SHA512

                          4b90cc657293989e84847a1587e816c1c62d1f5b1ce5a0a12fb383c0947e4e44dfdd648355b7f8bc57038127340fb763efa8049e0096d0544da8b625c42c48cb

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          150KB

                          MD5

                          db5fad806651495785b6b3a4618fad4a

                          SHA1

                          5a814cba6a0053609bff4d3e8652d169045db9fd

                          SHA256

                          f1b0974117cb59a04a36633de134006545ad13d774621b84de045c7e86b58427

                          SHA512

                          18426270a3d82c99d0a919c506304eb39171627801ba1967644c14f6e1ea6ee8ae67563f3cb33d99a3b3d970c4f5606683dacbdb0a869c075d0634149feddbbf

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                          Filesize

                          103KB

                          MD5

                          d715cb78b7743c408b6d74ccb82e2792

                          SHA1

                          6be7cde22fa45668c8e1c1bebd19f313c605c854

                          SHA256

                          4018aab4e8e83351add50221e7e00b40123cf349a03433377dabe79b48137ed0

                          SHA512

                          6dc5ec8eef0b8f09fd7468b13e33f228163ef005d512eae55a4fb95d24428fd33cc3eaeb43b94ccad4f2fedee07be3ac4daa14b860d975d9b221be274cf8a26e

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57689d.TMP

                          Filesize

                          99KB

                          MD5

                          117f4c6eadaae6d2691491fe65432a31

                          SHA1

                          a337d1c934004c851c7e8b9c7d6de7889383b15e

                          SHA256

                          6ebed8672c6ae9e78601c679d14ab24667fc9366b7113e5d134d0ceada3455fd

                          SHA512

                          d28187cdc07fc615fca4119c4b4b2adb5999afd64c0cae477f4818c1271229a262dff62b08e15480a48e30ed09ed98fe3a25ae45cf71ca9a3a535316eb1fe5dc