Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230621-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/06/2023, 23:54

General

  • Target

    https://wisepops.net

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://wisepops.net
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffabf0a9758,0x7ffabf0a9768,0x7ffabf0a9778
      2⤵
        PID:2812
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:2
        2⤵
          PID:3388
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:8
          2⤵
            PID:2592
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:8
            2⤵
              PID:224
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3200 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:1
              2⤵
                PID:1704
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:1
                2⤵
                  PID:4784
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4528 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:1
                  2⤵
                    PID:1628
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3244 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:1
                    2⤵
                      PID:4388
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:8
                      2⤵
                        PID:3236
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4620 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:1
                        2⤵
                          PID:3524
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:8
                          2⤵
                            PID:560
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:8
                            2⤵
                              PID:4384
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:8
                              2⤵
                                PID:4924
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:2
                                2⤵
                                • Suspicious behavior: EnumeratesProcesses
                                PID:716
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:4788

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                9a3ec57140aceadf8b43f9aabe850bd5

                                SHA1

                                bca18b74567d43436e2f272c94fd4260feb0d0e4

                                SHA256

                                ba79a0384a5087118695f461d9caa0addd9b645af643d2877752c31bf0d9b647

                                SHA512

                                5f875a06b6ee9c38dd0821f65c36b1089c4597b48ea84fd5365c6c47d1db7c3eb207059ad32dd16b706644b1e0fe8f7f75f0591f6e4cff4b2c178cfdc5b9a18c

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                9bcc5b4e0a431fa93d0756625477b977

                                SHA1

                                0c9f6e704e63726c7443b690c787a68288966eac

                                SHA256

                                4d5652b8ea016d06ad4378cc2c0be95646dcae952c709f9356d35a342d08b6b9

                                SHA512

                                b489d4b007f62c2a4c374ddffc1f22fb1e1e2270602bb61edf46e07d6c94d007bc481a4c21df12bc5dfcf5ae8dfa75d32b1149cf079f3838ec2e0c32296a8a79

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                fe0560865b7b707e1ddb499c25d48370

                                SHA1

                                39df382c9412ff72fab95ffb0c52325eb4516bd6

                                SHA256

                                688b0deb3fb5ab4a7438a4bee577d867f3aa0245e6cf7810c5aeeb934b66e8d6

                                SHA512

                                35a873869f50868fb8cd96a33277d60f183b9bc8628494286bf747139d54caf3a3dcdb9b578aa4ef1f4fd9d25e2b7f6ebf57610eeed8af5e41ab7c6a0bbc803c

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                66946a6f7f46fc1fc1bda776d76753e0

                                SHA1

                                f3cceaf96b7f2b1e1dc28412cad8a212bf571be7

                                SHA256

                                29b56a83c4e5661a7740246d39c6404e83c940a603160d15ae4e21f7ea644b56

                                SHA512

                                e9d96716ca1eb10c432136258e7e936112d2d8d0a48d46664cfcaf1042a043a10ba2168f2a48e54f01675c5028efed85e79582dd677179cac0299a65b5e77c18

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                88KB

                                MD5

                                79629c4d84b7567a63a9e396112a0b3a

                                SHA1

                                4459acefc39a3cc2c106bb6944da34d84cd73d40

                                SHA256

                                131e23691a30938c543560a1d55aa0eb157751e41e35e087725ccac5c9b42e10

                                SHA512

                                5046eec3e258e648cdfc8c2a024a4960c3f999971cda648da330a434e57625ee8b33d46200e2ee9350da0125c366d100bd84328a156209263f13ab8ecbaa9347

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                174KB

                                MD5

                                cab89f8c303d54d4a31f0711a530f882

                                SHA1

                                0ebc9e10c3fa00a0c75dabf8a01a3a49652ca123

                                SHA256

                                7d53caccac0265877e3d6c651bb18bdd1bd13737fb0754c2ab14edf4a74bf2da

                                SHA512

                                3afb1b8be03f123c354a25dfdbc8d3966c164baf7752e392596a72771504205ef3b7ed2fdfe94d1272c42a3c95a16f989cb189a55f5418acca72f8b74bd18326

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                174KB

                                MD5

                                9944fd28b005d241c1489bae41b4b29b

                                SHA1

                                41a413f11c11b7dea6326b7e7326ac7793cc5e86

                                SHA256

                                8efbd2d063aba7731b456eb247b14256132b71eb0abf1b0c415a9cfc6c5145f5

                                SHA512

                                49485c10d0648bfd045fffc7d3ad90545dc801ba1808ee1bb0625de1c09f9f291ff3e1128344e02abf09c110bf2f5f04a8c578c3826b12f26a98f4653914f4cb

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd