Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1797s
  • max time network
    1801s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/05/2023, 15:42

General

  • Target

    http://youtube.com

Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 20 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe" http://youtube.com
    1⤵
    • Modifies Internet Explorer settings
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4180
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:4180 CREDAT:17410 /prefetch:2
      2⤵
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      PID:3916
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Adds Run key to start application
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3956
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffdff889758,0x7ffdff889768,0x7ffdff889778
      2⤵
        PID:3884
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1812,i,2477162923484032173,8206986479270302492,131072 /prefetch:2
        2⤵
          PID:2700
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,2477162923484032173,8206986479270302492,131072 /prefetch:8
          2⤵
            PID:4760
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1812,i,2477162923484032173,8206986479270302492,131072 /prefetch:8
            2⤵
              PID:4484
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1812,i,2477162923484032173,8206986479270302492,131072 /prefetch:1
              2⤵
                PID:4168
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3204 --field-trial-handle=1812,i,2477162923484032173,8206986479270302492,131072 /prefetch:1
                2⤵
                  PID:524
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4080 --field-trial-handle=1812,i,2477162923484032173,8206986479270302492,131072 /prefetch:1
                  2⤵
                    PID:2584
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4496 --field-trial-handle=1812,i,2477162923484032173,8206986479270302492,131072 /prefetch:8
                    2⤵
                      PID:912
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1812,i,2477162923484032173,8206986479270302492,131072 /prefetch:8
                      2⤵
                        PID:2712
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4196 --field-trial-handle=1812,i,2477162923484032173,8206986479270302492,131072 /prefetch:1
                        2⤵
                          PID:3360
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4832 --field-trial-handle=1812,i,2477162923484032173,8206986479270302492,131072 /prefetch:1
                          2⤵
                            PID:4368
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3448 --field-trial-handle=1812,i,2477162923484032173,8206986479270302492,131072 /prefetch:1
                            2⤵
                              PID:340
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4864 --field-trial-handle=1812,i,2477162923484032173,8206986479270302492,131072 /prefetch:1
                              2⤵
                                PID:568
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:4160

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                646B

                                MD5

                                bf3684921af32fc1ee049ac6e09cce4a

                                SHA1

                                99700046496fa4a4203d93343e72c58f3ba30d83

                                SHA256

                                6b1d969729e36ce2499f7a7d157f0d64cceb4ff2fc14672fe8dde9c7c3852c6b

                                SHA512

                                062c9cedab361f848b14d7a507c96292772d3a2c58d202182b5476448c12a7ca2ebd57f1dc808db76e6381ade19b587c936a1b0bf1508add46625dfed9891fc2

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                ae5ae6d42315566e8b737e3a9b0db9c6

                                SHA1

                                7b8ee7702888647141e2bb06d028b23f529b5751

                                SHA256

                                22d0a9f8df2c0e0f2c4f498a235d6074a2ca351c6f77b5c188f872f3f7ba1101

                                SHA512

                                37c0c6b271768d61bb75e561b218d054815172bc3a64a8c5d3cbc54a4c77692e593eb268baf89ca91edbedabfb8f6a78d6771f627a65af9c814c58c0225bdaba

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                a17cda6ae517dd22def1ed872018e99d

                                SHA1

                                400927296307010586a4d017de538b8f3734d972

                                SHA256

                                33f21796e1f5b6b9a7e53ad3333ffaafc39f86979dccf932c242d7378921a666

                                SHA512

                                c9f927c27249c8d8ae7074627d9fb9c972b09277c329253457c594ddeadb17e4654722f713ae84b39a7473486a4e927e434de395f08604e165dc5d1351f5e056

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                Filesize

                                15KB

                                MD5

                                6543b569789399685728af805c18c941

                                SHA1

                                2d5eeb2057ec5736d1e856aad50c649cb291b082

                                SHA256

                                333f065295d916f0cc3c8f31d8c7a8c4c06f3f263c987c44f334b9862c238f71

                                SHA512

                                d014e967eb54127682984499b5dbeb119bbebbbe8fa63287c7079f8aff6fa02fce36dee26f652b2a2f7c89b56de5809d590abeffe1b64b694906b6d59f2c12a4

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

                                Filesize

                                264KB

                                MD5

                                f50f89a0a91564d0b8a211f8921aa7de

                                SHA1

                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                SHA256

                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                SHA512

                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                71KB

                                MD5

                                9efe2549ff75c52be9f8d20883c12170

                                SHA1

                                56aac3e66f7d179fc0e8ca9f46043fc99eeacfd4

                                SHA256

                                c3898ca6f4db73249f7be55e4c4ee90bc68229104984fb492e1632af37c1e749

                                SHA512

                                af7a9389591b5e19411a5cacb4934c4608f71ec2c4464785d63f8b588aabd135e47b0b1ccf709c6d59be43960b2fe621337f0e7efba30ac4880b471d5d83382b

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                71KB

                                MD5

                                26aabd64c948330dfa24a4d990867f5b

                                SHA1

                                8751c0c0f38aa72807a50e13d7884ce9939aef72

                                SHA256

                                636bf8cb798cfa6652e2923274814ea766f41b37988f3096cfdf0ced3f9e7ae0

                                SHA512

                                4277a2d95dd704bed6a2b4ac8719a59d9b7258bdf1f1050ae300bca54b21a6305ce3df4c3999f72541832013bd1b12fc7c0ca1249339e21a33708ca0d169abed

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                              • C:\Users\Admin\AppData\Local\Temp\~DFF5A4972D16569C3D.TMP

                                Filesize

                                16KB

                                MD5

                                61bea82b8e8ba4ff39698c51225296c8

                                SHA1

                                f24785fec0396f03e0a1259c0441f5973b9712e2

                                SHA256

                                8ed8697f60f13520d4456c91463d6ba134580f8637f96cb594b25da77f4d92a6

                                SHA512

                                6bccab4670276f1a7958629ad44c90531e3634613595682d5a99e39928a2aa7f604f40dc4a307bdefe4af85b465d3bb3b6cccddc13e7b8f05063ea37bb9fd723