Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/05/2023, 04:56

General

  • Target

    https://github.com/yntd/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://github.com/yntd/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4260
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff987469758,0x7ff987469768,0x7ff987469778
      2⤵
        PID:3788
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:2
        2⤵
          PID:1496
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:8
          2⤵
            PID:4512
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:8
            2⤵
              PID:4464
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3200 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:1
              2⤵
                PID:2548
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:1
                2⤵
                  PID:980
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4968 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:8
                  2⤵
                    PID:2732
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:8
                    2⤵
                      PID:4924
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:8
                      2⤵
                        PID:3300
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=920 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2484
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:5028

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        1KB

                        MD5

                        d5233155ac0208de143543028ecf1977

                        SHA1

                        7afe2ad2d85428a20fc3382e0ed80327f2cf2911

                        SHA256

                        d3bfd3d338cd190297b8d10c1f9076d03e045c74fa96a726ce43ed7618d0d852

                        SHA512

                        ee8beb216a94c20e48264f1f9db955a9e67f5b2f127bd25d8ddcd7bab8cb5a5684c770f5276ea966e228ce62316ab8c8e94febdade63959badae076de17c3410

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        888B

                        MD5

                        a27c4927b7d645ed7f2785e20a7b5087

                        SHA1

                        65aadf8f07f28c98086a9a6180fd874848515cce

                        SHA256

                        00dc63579316e2da07879489025735bfb236bed2b0b017df99cbb651f2a2d0ba

                        SHA512

                        ac2c19c4a7ea65fa353b8a869430906a6b7447cbfdbfa210eb0667ee23bb3fc93a06ffd929b8d1df8208c6ba8cb5c7b1790c271f5b387cc030cecb8284ac7312

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        18a26076cc59d8cc840518970d159a4c

                        SHA1

                        a494e782e876d70635b938ac7f37caa2e6023fff

                        SHA256

                        c8876660174c5db1fde2a01528d9b7002c858189cfae67b42ace4f7039bd2caa

                        SHA512

                        216b05394c56d4239b2765810eee6af17e43a264c7603f924bf5791631826f6f9f11452f506293a12d363af3ee322c992e36ffaddc809dc2552843f2f7dd31cc

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        09d5e2499a687e4e5dabf62f44b4de0d

                        SHA1

                        ba39cab77eb90c3213f2f4fa52fceddd9735ea1c

                        SHA256

                        bfa63e1830bbc9b874ce498e7127cada3f80c199d488b98a1bea8d13368138b2

                        SHA512

                        941617491d8cb23abc27cd5769f37e426bffb31f60dbeb22b2374993b1fee7674ce3c1e5924a8e202875afe1457fe771c158aab257d490e5b35e2e8fcaaab4e1

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        bddbab06071557b68f00a0feeac18756

                        SHA1

                        665e4ad72fd15827c3ed220c38e6b527b4ee52cc

                        SHA256

                        44ae290733e92ac464ed1a2be6f3f8c4a34f60e9816850690cf9b52377f4b17a

                        SHA512

                        00e8a5009f73a6d85080103fc14107234b161f2cc0ee7cfa31ad8119004682c775a054ca981302f8be68cc2b313d53e8879ea09ddc9b99674bba42c68c58af8f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        1c95979c2334f0a866748c5f74a1c360

                        SHA1

                        4edbcd285dbb082a35a8fa0172b1a7c031aa40b4

                        SHA256

                        a371626b77addc9edb783595a955685bacc4e4a912a2fc7930a6adec3b0346d1

                        SHA512

                        86f24c5937d4cefcdc2323d3f0b13732476072532945a267d7948230c3b818e7c82f4177e77b5ebfab603acd0a31e87c09d16c378d4e6c0b71362ab531ee0843

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        c78cdfb371de13696d0387a3ec7727c1

                        SHA1

                        2573de060617a90e79b020e860e96be19ca5063b

                        SHA256

                        607838946b0f3d55403c262234c82f23c787fdc30fbd0e9b0c698c70d0125c50

                        SHA512

                        f5084b262b26d80da039103861d0106bd264eb713b9b1803caa253cdcd7cb2d38423764e222f4a1024fb4c6bf065013db378c04be363dbf8bc461fc4ffa931c0

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                        Filesize

                        15KB

                        MD5

                        8dcc79f95a2e38180aa10d24ff994a51

                        SHA1

                        38fe0e07a931f5f75b21305b0fc658848c252568

                        SHA256

                        6233596d890e7104390489c5f0889c36243d872d0ccf1c36851659443de30443

                        SHA512

                        12f1bfc32d74ca9ffcd2b46e741a24aec312cf1d21d6c72807f0c2bddb01a6833e6c77394d788ac9bfc25a74ae73e115909549447827fc34c44eb0f7e5f53b38

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        154KB

                        MD5

                        c765c53485e15b3ea8db86deb5961c08

                        SHA1

                        113ff1195c6e4e46b4f7560cc5dd6e091b6d3415

                        SHA256

                        bc2572e10cf83d2a99090affef5a9a0ebc9ad9edfefde2a43ed396db9d8be8c8

                        SHA512

                        68d2068c2d7957bfedc41294ce118d0455c2379dd5a2ff8bdb3167e814a7e3d4e16e9ecf7757cfd8c4c201bbec730123e2d37a5b58f6b67864c3ceae77b10041

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd