Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/06/2023, 14:46

General

  • Target

    https://www.bing.com/ck/a?!&&p=8906b41e4j13b963fJmltdHM9MTY4NjAwOTYwMCZpZ3VpZD0xODRjZjdmMS1mNmE5LTYyYWMtM2UxZC1lNTBmZjc4NTYzMDImaW5zaWQ9NTE2NA&ptn=3&hsh=3&fclid=184cf7f1-f6a9-62ac-3e1d-e50ff7856302&u=a1aHR0cHM6Ly9leGZhbXVlYmxlcy5jb20uYXIv##c2xlYmxldUoBldm9sZW5g0aGVuhbHRoLmiNvbQ==

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.bing.com/ck/a?!&&p=8906b41e4j13b963fJmltdHM9MTY4NjAwOTYwMCZpZ3VpZD0xODRjZjdmMS1mNmE5LTYyYWMtM2UxZC1lNTBmZjc4NTYzMDImaW5zaWQ9NTE2NA&ptn=3&hsh=3&fclid=184cf7f1-f6a9-62ac-3e1d-e50ff7856302&u=a1aHR0cHM6Ly9leGZhbXVlYmxlcy5jb20uYXIv##c2xlYmxldUoBldm9sZW5g0aGVuhbHRoLmiNvbQ==
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3052
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ff9b2fe9758,0x7ff9b2fe9768,0x7ff9b2fe9778
      2⤵
        PID:5012
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:2
        2⤵
          PID:3472
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:8
          2⤵
            PID:1856
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:8
            2⤵
              PID:620
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3216 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:1
              2⤵
                PID:3728
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3196 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:1
                2⤵
                  PID:4220
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:8
                  2⤵
                    PID:444
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4844 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:8
                    2⤵
                      PID:1780
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4792 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:8
                      2⤵
                        PID:2704
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4852 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:8
                        2⤵
                          PID:764
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5020 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:8
                          2⤵
                            PID:900
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4764 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:8
                            2⤵
                              PID:3412
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4908 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:8
                              2⤵
                                PID:4424
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5124 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:1
                                2⤵
                                  PID:432
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1816,i,8239465394884144145,11665195644453497404,131072 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3984
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                1⤵
                                  PID:1424

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3e3dd32c-e06b-499a-9cd9-140aac1348b8.tmp

                                  Filesize

                                  6KB

                                  MD5

                                  283b1851ba553058050e0c2012511a25

                                  SHA1

                                  3bb7aec9f44b27990b5c6fbc6e41d8a2fd42db87

                                  SHA256

                                  b3b204c4209879086c723b7f327c847b4a00577bfc830dbfe361f7f0a5e3fe16

                                  SHA512

                                  c1c1f718220f122b5b2cf4ea3d1e2e706113bc29b6693038647b3b2ffb6eca661c2606b37f95062428e9937b8282199c7ac53fdc6153f4a6b085c14d97781fa8

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\_locales\en_CA\messages.json

                                  Filesize

                                  851B

                                  MD5

                                  07ffbe5f24ca348723ff8c6c488abfb8

                                  SHA1

                                  6dc2851e39b2ee38f88cf5c35a90171dbea5b690

                                  SHA256

                                  6895648577286002f1dc9c3366f558484eb7020d52bbf64a296406e61d09599c

                                  SHA512

                                  7ed2c8db851a84f614d5daf1d5fe633bd70301fd7ff8a6723430f05f642ceb3b1ad0a40de65b224661c782ffcec69d996ebe3e5bb6b2f478181e9a07d8cd41f6

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.62.0_0\dasherSettingSchema.json

                                  Filesize

                                  854B

                                  MD5

                                  4ec1df2da46182103d2ffc3b92d20ca5

                                  SHA1

                                  fb9d1ba3710cf31a87165317c6edc110e98994ce

                                  SHA256

                                  6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6

                                  SHA512

                                  939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  282d857c59370e9cf9487e82c4f94a5b

                                  SHA1

                                  85b0301d2f8e95f8c91c3c313d5e4f605993b997

                                  SHA256

                                  26456509424562b2c0ffb3c4b2384cd690c9fc17d1157da79dc3bbc37f833df7

                                  SHA512

                                  89832620178d8850414d503d63ee640139fe4e2218c879e18b0fd7065951dedcdee09e6cf7b6ec9468afef3a8df14296c9b69827fd8c0db09805b1e4e0a09cfc

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  4def4f131ec3a089489f781dd169bc6a

                                  SHA1

                                  1fe35c8caee02c8eba32fe5c8303b1c2ee5438a0

                                  SHA256

                                  cd70f4d0928e2d98be9c57ed2cde5b1a8e115e9f9358b817eca7445960129263

                                  SHA512

                                  2127bf15919b3c22cf7c12b78654ead005dc102fc0e9db7c382f038f883eebccb5ace8a462e040e6cdeb96878f72a525efddb22a8f29b814946294dafb89896b

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                  Filesize

                                  15KB

                                  MD5

                                  324675d14d7331b7bf6fa611b2bda2e2

                                  SHA1

                                  87c45915f7b14b5a3d05c7ad64f2243aabd974f1

                                  SHA256

                                  07d5e646023942470a59f107aa91a1f9cfe6f5d18be46da864e908e5d49a0d14

                                  SHA512

                                  cec10d28a3d68316e1702388716f50f97084d103bb23138b095e33733bb43f2332d7d82043bc7d1136b90996d15f1ddb17ae5d2d2aaf24e37d6cf86ad7190ab6

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  159KB

                                  MD5

                                  21afec306ec01e9cb242dd50e48fac18

                                  SHA1

                                  15cdff2959438444fe4e711920fc14b9837fd817

                                  SHA256

                                  c78fd733ec5f752d6b1c53c76a160becdae488d8d389a0b6d3909dcbe4a6c1ee

                                  SHA512

                                  164ccb6fa8b27d9bf605b15109aacf8905c18d4fd9c8d0e60afc02887ef20f4488a053a391abc41cb216c72ced993b803cac5eee7e0ba1720e23bfd9e157a183

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                • C:\Users\Admin\AppData\Local\Temp\scoped_dir3052_2143395642\CRX_INSTALL\_locales\en_CA\messages.json

                                  Filesize

                                  711B

                                  MD5

                                  558659936250e03cc14b60ebf648aa09

                                  SHA1

                                  32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825

                                  SHA256

                                  2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b

                                  SHA512

                                  1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727

                                • C:\Users\Admin\AppData\Local\Temp\scoped_dir3052_2143395642\a5aa0b27-c86e-400f-9867-7df9e8d81532.tmp

                                  Filesize

                                  88KB

                                  MD5

                                  2cc86b681f2cd1d9f095584fd3153a61

                                  SHA1

                                  2a0ac7262fb88908a453bc125c5c3fc72b8d490e

                                  SHA256

                                  d412fbbeb84e2a6882b2f0267b058f2ceb97f501e440fe3f9f70fac5c2277b9c

                                  SHA512

                                  14ba32c3cd5b1faf100d06f78981deebbbb673299a355b6eaec88e6cb5543725242c850235a541afa8abba4a609bb2ec26e4a0526c6b198016b08d8af868b986