Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

28/06/2023, 06:35

230628-hcgq5she4s 1

28/06/2023, 05:56

230628-gmz5sshd4t 1

28/06/2023, 05:45

230628-gfvlqshd3v 1

Analysis

  • max time kernel
    269s
  • max time network
    259s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2023, 06:35

General

  • Target

    https://www.unictool.com/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.unictool.com/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2740
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe56359758,0x7ffe56359768,0x7ffe56359778
      2⤵
        PID:2228
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:2
        2⤵
          PID:2796
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:8
          2⤵
            PID:4040
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:8
            2⤵
              PID:4492
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3252 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:1
              2⤵
                PID:864
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3236 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:1
                2⤵
                  PID:2256
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:8
                  2⤵
                    PID:2560
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:8
                    2⤵
                      PID:4524
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5216 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:1
                      2⤵
                        PID:2580
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:8
                        2⤵
                          PID:2672
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:8
                          2⤵
                            PID:1748
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3420 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:1
                            2⤵
                              PID:4444
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4696 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:1
                              2⤵
                                PID:1908
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4624 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:1
                                2⤵
                                  PID:5008
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4592 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:1
                                  2⤵
                                    PID:3408
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4696 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:1
                                    2⤵
                                      PID:5036
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2828 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:656
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=2828 --field-trial-handle=1852,i,11371974255081093354,6333262844958494548,131072 /prefetch:1
                                      2⤵
                                        PID:4112
                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                      1⤵
                                        PID:1748

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        480B

                                        MD5

                                        c13817041b5891a72ededf595d5d1c04

                                        SHA1

                                        f0bcdb0ea77a2707745638cafa5537d9518fd348

                                        SHA256

                                        7e106566d10d700c5c0ef334b3f813b3dc573a4c911588d6dff874c8e29a3172

                                        SHA512

                                        c7b4dc9cee407e789898320f05ea43167745dcc7f1c6d5699c0da625e423f7e0f716fd04bc64f9cc7ed041a080a99496f2b3c5473c74ecc5fda018d2e4eb6ba4

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        3KB

                                        MD5

                                        dc0eea074773028e929ae77bbbd1874e

                                        SHA1

                                        28713cb04df9166c84494474fc0322113d2152fd

                                        SHA256

                                        5953d5e3f81d56161b8571948d0c3accfba8f830ab96d01d35e1954b3d4a3f03

                                        SHA512

                                        bf613d483f41b274b9b57d134c4dc814e3743c56102f1856e352ae75bc3b7d424ca9b4a48b04c7e5f3cd2fe7c7f6bd1f85cd3a197efb41113ae9bed587cf486e

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        2KB

                                        MD5

                                        894d75b4247ea1bbb10315de9f08ac2f

                                        SHA1

                                        00d5525b8f2403138d7023ac734e864f68ec2545

                                        SHA256

                                        2621676c3a7e503c7786d6ce8f27082e0fb75ca4228097fa6d30284d5d2a2e2d

                                        SHA512

                                        c7050a62a27cf03baec5bbee77b5ac3ae0f55d1dd308d0eea1da6b792c29934ee8e5fa0861d2b073287b54a4a9d0262138495eb3c55d84ec9249faa638597560

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        3KB

                                        MD5

                                        2251753393dbcdba8e89b35b023744be

                                        SHA1

                                        4e32865f25851369d4b2edcf252a6113961fb3d5

                                        SHA256

                                        2f9e6539182241754fa5b838b84465672cee2483b2c5bfe9a630ec3d86b6d059

                                        SHA512

                                        9abc7653be0d8146725a06965620d6e66b72d76b54cb0a7679d1008dc39df20d566738a09aa658dee3d41ff831566c7ee5af0d1f579fa9b7f404b124e23112ee

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        1KB

                                        MD5

                                        e1081ff65504d2623c82ca8db1d39750

                                        SHA1

                                        714a816be4ed8bff80d4a55ccd33da934d7121ea

                                        SHA256

                                        a0ca4af903ef84ba819d10d6bf88076cc6c17707cb0e3480a91f8e35ff4ce0f7

                                        SHA512

                                        c6a4098e66d6760c28b0566a89d608b5c18a039dcfed29e762f6ebf788f7f4f7a3f893605d03dee6790664205ea56446f2df2165cb7668a9b986b2a0c82f75d7

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        1KB

                                        MD5

                                        1c89445f758139013dfe9e15420a012a

                                        SHA1

                                        7e3e69996bf03d1857725283c0b152ae2cac9586

                                        SHA256

                                        a64fed3b9463bf324376ad6cc4f7b8cce80c902bc8b9a393b0c0d7bcd1ae35b1

                                        SHA512

                                        166736bbd90b0c3e46b7d481e82de8312820690d121d4700b6158fc03059cb5ab4ba72b3e208d6b2a5f13b128d1ce9056e17155383d44a1b15de9f4357b90216

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        dd81d6d20a7e59cd671c937ec9b07dd8

                                        SHA1

                                        574bbd3a510a971eb7fddabb426b6ed772a95f6a

                                        SHA256

                                        456c727f72f6fc3c7c386f7f07fc1f123df0f3d18e03d3f0e818720414093894

                                        SHA512

                                        a885e13552b78c84f5df1ff61d986da9bd02c01ca5d8546e95f2f5bba4989f3010e3e0868588b11c42486ac83d1b11a90acac2a11b4f4f33bc7b546de140f3ac

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        b16b66648c40d7b4b6c42971a4fd8518

                                        SHA1

                                        92dabf020acb91e37ff243c356e0b01beeb3d18a

                                        SHA256

                                        119ac8f2e69bad7d11cdf4f657aa0d386c0708eacd5d08f5ef97905f544bc94d

                                        SHA512

                                        0c13ec6168ca368e272b006452555e5fc3c4b073da044200d8e8852284e1a9d2e708048ee227d2f703108b98c161dc5bc81b793e2b5d80eea6202d3d56bd57e6

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        6aad21f2e5b88286327d225ab9e2b23c

                                        SHA1

                                        288299b2b293253b6a5e0d6718a01d056e77e874

                                        SHA256

                                        0b4b87e2adf5f07704c7963ca32754a418b5d05bec0978297050307f487c0011

                                        SHA512

                                        367416b1e5d6a71d33aebb14cd433db2f9660d739059730d7c861bfc13a0a69fa74cbaaa4c9a2185279b43b023627d5d8d0258daf1835ddd5576420fc380a5c6

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                        Filesize

                                        72B

                                        MD5

                                        8354ed1bae71a16923ca9ba6b9fd2164

                                        SHA1

                                        12498db17db30d2894e0590b4b1b6ce11edc1d4f

                                        SHA256

                                        00dd564240476adb574cece17d9643044dc3336238fcf692b998ee72feb88285

                                        SHA512

                                        7f7ca19646efd236cab2d7fd04d2b1e9daabf08a3d60a5a5e0b8f831c29dfc155ec45a12508fc177ba1d53fad5a58bc48c3eb746420ee1e751a49fffdc27237c

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe573047.TMP

                                        Filesize

                                        48B

                                        MD5

                                        3a52a680d2ecefff4abf019d8e288d98

                                        SHA1

                                        5733623bb84dfd133e55342b3ad8d9bf63c4c3bb

                                        SHA256

                                        57d7ebd690bbb20b8e5224aa861954600a358b99664167c674bcdee11f88426c

                                        SHA512

                                        20222c59c03d88c22ca95abcd8050ceaf0caf3a0df2d3d02f4cd21de974ff757c6424840fed002a5ded3f1a64f06583cab61619ae9552c4b9bb6d6a06874a3b4

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        176KB

                                        MD5

                                        b723f4cda652d0cd2ead024b3d512420

                                        SHA1

                                        94ea3aa0d0a1ecdd706699b9cf9c859e8703bfce

                                        SHA256

                                        0173930928f8006df6e0783de90f2d360039a773a55a53b8b3fb4f2c31132402

                                        SHA512

                                        306e2c575bcc825b6f0a3ca449d6bf483fa05e1de8c4777c3b6cbd247a2d3cd7e69c5843bc09811738d1139399129cbe2b53019c60357956ff4f4d4f945b6bb9

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        176KB

                                        MD5

                                        78e93f9c8a41d61c6d9e1a9de05056cd

                                        SHA1

                                        fb1305d1d49eb706de3e33945be749abf6e81cff

                                        SHA256

                                        0693929752b42f46442fd1536c7180bee03729f3c814da5ba7c1ab585c1a0719

                                        SHA512

                                        d45b019c7b1789da0032441dbafe35ffd0690e432e789cddb5d751d3c9f1d78f5dbf22453ed84a6af5ffefd4ee64454158139fc756e3773da82eb085a83a060b

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        89KB

                                        MD5

                                        8a636e19ecbd0b90c6564e837aa9056f

                                        SHA1

                                        22a0da84c3a872100646bcf943e5cdaa66d91d60

                                        SHA256

                                        a80c4f082fb8ddd3488120de155a73df6e91cea79abb9d18b336477e3aedfa48

                                        SHA512

                                        92a57ecfede71d21782567257a9924d03359a7735c9c496b418ba39100952444d4b9815d3648e5421e71427e149441843de492d602e183cbcea5fe461d6dd875

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                        Filesize

                                        2B

                                        MD5

                                        99914b932bd37a50b983c5e7c90ae93b

                                        SHA1

                                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                        SHA256

                                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                        SHA512

                                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd