Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    227s
  • max time network
    231s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/07/2023, 18:10

General

  • Target

    http://www.angusj.com/resourcehacker/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 50 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 46 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://www.angusj.com/resourcehacker/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4812
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd46129758,0x7ffd46129768,0x7ffd46129778
      2⤵
        PID:1520
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1872,i,1475984884169466030,17229984197681707446,131072 /prefetch:2
        2⤵
          PID:2348
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 --field-trial-handle=1872,i,1475984884169466030,17229984197681707446,131072 /prefetch:8
          2⤵
            PID:3624
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 --field-trial-handle=1872,i,1475984884169466030,17229984197681707446,131072 /prefetch:8
            2⤵
              PID:1528
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2832 --field-trial-handle=1872,i,1475984884169466030,17229984197681707446,131072 /prefetch:1
              2⤵
                PID:4080
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1872,i,1475984884169466030,17229984197681707446,131072 /prefetch:1
                2⤵
                  PID:1356
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4832 --field-trial-handle=1872,i,1475984884169466030,17229984197681707446,131072 /prefetch:8
                  2⤵
                    PID:380
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1872,i,1475984884169466030,17229984197681707446,131072 /prefetch:8
                    2⤵
                      PID:3272
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1872,i,1475984884169466030,17229984197681707446,131072 /prefetch:8
                      2⤵
                        PID:1108
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2924 --field-trial-handle=1872,i,1475984884169466030,17229984197681707446,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:420
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1872,i,1475984884169466030,17229984197681707446,131072 /prefetch:8
                        2⤵
                          PID:2084
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1872,i,1475984884169466030,17229984197681707446,131072 /prefetch:8
                          2⤵
                            PID:3540
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=912 --field-trial-handle=1872,i,1475984884169466030,17229984197681707446,131072 /prefetch:8
                            2⤵
                              PID:2572
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:3836
                            • C:\Windows\System32\rundll32.exe
                              C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                              1⤵
                                PID:656
                              • C:\Users\Admin\Downloads\resource_hacker\ResourceHacker.exe
                                "C:\Users\Admin\Downloads\resource_hacker\ResourceHacker.exe"
                                1⤵
                                • Modifies registry class
                                • Suspicious behavior: AddClipboardFormatListener
                                • Suspicious behavior: GetForegroundWindowSpam
                                • Suspicious use of SetWindowsHookEx
                                PID:2180

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                72B

                                MD5

                                b05c2ae58435cf695aace14c9af0721d

                                SHA1

                                60f7718d33e18e5fb073ebf62e7c4b31a1c89cae

                                SHA256

                                8e1b98c25d5ad773b6d1c26829d468944627704c1783b1fffc28e47211e7bc35

                                SHA512

                                0a4c326979fc3a8b5bef5a682ae72aa8ee25ba6593f199355aa4bfe369558b70530bce80b392b042624db7f875a402896d2ac25889b1d10b8bea8c6b2913cb9a

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                4d893f746d395ad5f6d34e32e218bba3

                                SHA1

                                ba690215c416439028d9bea22d94ef20aa5a8127

                                SHA256

                                007509fcfa56849ea3e6f4f2078a3a8a6deea80f913ab84325e571bf858b6436

                                SHA512

                                521c7deb9bb60a3a97ea79e7400f286f0559a42b1eec23b3b5cd83f9d8892b2bd390fcf45ec1bf0635dde52d2678db083b7c4096cd8289eba033cd50b78eee3f

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                1fe23de56d5ea3e5b91a861153ddd92f

                                SHA1

                                67716883099867a13d030ed99c82f7799f2f5aa1

                                SHA256

                                cc6c1a1ddffed4b2efde4d2292314be9327a68629480b945dc806b27b6bf569f

                                SHA512

                                b873a9acd197515e98ba93216b2f428548e32de2e736d505cf335e074e7f857849f37496de22fde938f697caea4a9e697ea96afadfbf3b90fa8b54b167ce7c52

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                536B

                                MD5

                                706e5a6968eba42dba33c6ef305d4db0

                                SHA1

                                a11c4c3e15a653ea79b42c5e9efc92a0bf779bc2

                                SHA256

                                3519a2e0b044d32c84d575f07e0fcece2511b4ed0d03256d01a1fa4ce0bc368d

                                SHA512

                                c567b835cce81dbf63448851adfdf13996bd889e80fa04f1efa2058cc33d8d0b68b95fdb5a107e7953e9cf2d2cc1e5febaa734f1b9a601e863105be8efc71446

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                03dbd01c3a379e6ed9be7c4c65b87af8

                                SHA1

                                3c0c600bf5b6971098505ad81e406690077acc4f

                                SHA256

                                edbe2dde619f667b4872313fba0b910b2e1c2eb4720569d41f411b41c76fd67b

                                SHA512

                                4a4ca19db641ffcef3628e0ecf03f1e305114651a4c176dec3da60312929250d615c4b3516ce7f5d6be66ec404dbb7fa54fbbc9f05270c301134d1e0855e2952

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                ed1ffc9ba23a24816061ef70fbd28891

                                SHA1

                                1732079d742644395bb81dc10093ee4fd13ccef6

                                SHA256

                                d9532f529de7f92618ceb43838a6470e8036ee2deb8b4d1cd367c0741eb25ca8

                                SHA512

                                0da9bc133fbc5b4dffe32e52c280cbddec840a548952f42b77db739755920be0f4fc1579d0373029b955f0959a95543e089989dac6741880497f32801284b2a5

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                Filesize

                                15KB

                                MD5

                                557454f57bc9404d22d608417e5bde04

                                SHA1

                                9c9b97cafab772e3f37519302742eeab6ffa6c6c

                                SHA256

                                cdd98c4781aacc92e92f74fb69f30ed5fb26a4cf0d88cbc2c43ec3482f29e6c6

                                SHA512

                                e5fd382e49bd5489040bc0d649f12b723a92b93c4696227af49012cd44a945881067097d78a205fbc0783592981a258356379504b23b8c81ea583fc29e65ef4a

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                171KB

                                MD5

                                9f903f4b46fb3cdfa1794fda8314a6b4

                                SHA1

                                8eed70cf9c8f2e84b6aeba62858741c768fd4586

                                SHA256

                                1be5542bb01faa8283c1074e2accadd2c55596aa1d16399eecbb9cede418de48

                                SHA512

                                af26fd6fe353e9825364787d4660eaf93019951c08b03c20c01478e79a07d67f54fedd528ed6121b7ff5053d78e1dfddcfe58d644046c91a0312e64a768aab72

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                Filesize

                                103KB

                                MD5

                                935018035208ed8ce324bbde9747e310

                                SHA1

                                32a4152d257d20f30f14b41e8c9370749a14e201

                                SHA256

                                ea37cd844a6e1f27a8e5eef19c8ca435e771e74d510cc3882993116a1eec9b0a

                                SHA512

                                a2c4b5a65e012b4a4d1b26c67c184bb3f6b4edcb83baef2be2fcda3b08619f0e74473bc1bc7c93817e0cbdc5ddad331fc9fb151a9523d4653075efa0981ede97

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                Filesize

                                106KB

                                MD5

                                e2a07c68d8c4751940a9afb83dec95bc

                                SHA1

                                91bb6491dc55402a04ee32dfa2d680a42044fab2

                                SHA256

                                515b3d6a0801e94ff285fae1207474496e92abb60d09eb2cdc5d5a780d0559ea

                                SHA512

                                6fc4e4e122ddb35f49824dbed0a4b1e714a71cb1e69e26e115dd4818ec084d3e23b4516bbef931c6bd552654c471680be30756bb5789b154fa14678b59ec106a

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59debe.TMP

                                Filesize

                                97KB

                                MD5

                                165ba2aaa51a7a1612242b866acc1a33

                                SHA1

                                84015085b94f82fefa3a09fafedd7b3260c5cc0b

                                SHA256

                                a45d1fa5203922aab43ea6b2653bf36c4a1d954a454c7aea35b64d06e2b3c685

                                SHA512

                                07a610f950907cfedb80533dc46ea150e57e0875e36b06d3c518df31ca33570b33a318cae65ad1ca9bbc5ddde6308e76c9013d40c661e87bec8de86df2ca6fdb

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                              • C:\Users\Admin\Downloads\resource_hacker.zip.crdownload

                                Filesize

                                3.0MB

                                MD5

                                672f980eee75e8223060661227ba884f

                                SHA1

                                86fc38aed09c5a5de4f766b2eb6f5675eaa30489

                                SHA256

                                d158bebc2993cf6bebf2c23a93572a68544c2ba5ae056538f70a58075c9392d6

                                SHA512

                                bfb13c2b9a88634a9980b95e70a919de7139c49ab56903b86b88603c8ecfb7d0a0363a5c72657648622dd19b74c52b85fd59e2833de2e26fdf069774c88e8e57

                              • memory/2180-281-0x0000000002980000-0x0000000002981000-memory.dmp

                                Filesize

                                4KB

                              • memory/2180-282-0x0000000000400000-0x0000000000988000-memory.dmp

                                Filesize

                                5.5MB

                              • memory/2180-283-0x0000000000400000-0x0000000000988000-memory.dmp

                                Filesize

                                5.5MB

                              • memory/2180-284-0x0000000000400000-0x0000000000988000-memory.dmp

                                Filesize

                                5.5MB