Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

12/07/2023, 18:34

230712-w7yvssfd3w 8

12/07/2023, 18:27

230712-w3xryafc9z 8

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/07/2023, 18:34

General

  • Target

    https://www.google.com/amp/s/dvdcdduplicators.com%2Fpn%2Fflmswwmb%2F%2F%[email protected]

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.google.com/amp/s/dvdcdduplicators.com%2Fpn%2Fflmswwmb%2F%2F%[email protected]
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1232
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa454c9758,0x7ffa454c9768,0x7ffa454c9778
      2⤵
        PID:312
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:2
        2⤵
          PID:2324
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:8
          2⤵
            PID:4648
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2272 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:8
            2⤵
              PID:3780
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:1
              2⤵
                PID:1244
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:1
                2⤵
                  PID:3356
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4476 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:1
                  2⤵
                    PID:1812
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4916 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:8
                    2⤵
                      PID:2956
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:8
                      2⤵
                        PID:2768
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:8
                        2⤵
                          PID:3120
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3840 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:1
                          2⤵
                            PID:1136
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3872 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:1
                            2⤵
                              PID:3500
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:8
                              2⤵
                                PID:3720
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:8
                                2⤵
                                  PID:3876
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3724 --field-trial-handle=1908,i,1277300368613667639,9449366733874766897,131072 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:1716
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                1⤵
                                  PID:1004

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  648B

                                  MD5

                                  4d10fae801026ad00c25f6e11d47d66d

                                  SHA1

                                  95c4f1d935d8ffe0590c820444b9dfcdbe99152e

                                  SHA256

                                  5d2787a0efbee9e961b2a82d9fae4f5e9853ed636139d778c3221527f98c2f38

                                  SHA512

                                  8050a638bc83d023ce485bd99bd2d0ac1468fa807bf2aed1c1a9a919a0c29597329a5fbdab7c555b31068855ede6de9f5ec18af236cf0ec605a7f1542159076e

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  54b079506b5b57377cf1b7efad8df493

                                  SHA1

                                  3583f5d29c3d22e9b8a8619424909fc9402b39ac

                                  SHA256

                                  ef742c2e2e2c7987aec38e3c35a8ca45bd850e2df40577628808a323f310c75d

                                  SHA512

                                  efebe97370d157f45528828fa71a34985bcf9c9d8aef7d5ef17fa33efbcc80698ffdf58e62e25c561493ad744f41a4b1ebadd47b29d711d14da9b69182e0d339

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                  Filesize

                                  2KB

                                  MD5

                                  fadc557271c39d822516c7c7060b2a83

                                  SHA1

                                  9b32fe0b762ba574d500c9ebba76a0cb713e47df

                                  SHA256

                                  bbcb5d2207ab901c185ba8e262411251cd010400bf2f77a76053aecb459987be

                                  SHA512

                                  43be93e8dfda0adfb0e48b6a0d4293861392afb1d8d3b88c13eb7c251a5b7ba79d942b37e610fa3e22d39b2ada5e44c23d1accb70ada6f0bf89ae83ed8324bab

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  d4b93987169849ecd714213ad61ece8b

                                  SHA1

                                  42e8712f4351e5961ce485d046460519d232f6b3

                                  SHA256

                                  b5fbce8a9683f9dfa85def392d997b52f79baec8593bed55638de4d455522c6f

                                  SHA512

                                  5137f8c60dec86a6d6a052a7de501f503cadaeeefb938e436f88665180e4b660a990c2a58612e4dbbe0ffa04f8c0ea34485fccf69922c0590954684f4e151663

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  2KB

                                  MD5

                                  23f42edf9536d98c25149ba69215d072

                                  SHA1

                                  981dd72933dbdee554e98b4ec985a96fcc406fd5

                                  SHA256

                                  86e8db4d03a0f5dcdc0d494833ca183abab7b1c8f9ad8643225a49ac3cb40236

                                  SHA512

                                  9b50de3044fcf8a82738ad6875763be0c2b4f05c7655da5ec3fe1e33fabb9bc556a9d8ea0558c7b8cca524edfe8b170a84e743dd45e314d7dee8f51ec3d46dc8

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  2KB

                                  MD5

                                  5fb9190184ad630e996b0b569c3940c0

                                  SHA1

                                  0c1b9de9e7a7eab901fbe8bf96c0abedd10b0860

                                  SHA256

                                  fdefe577aa367dde3d9596776d06e3e81f9d6e20affe8d8b170bbec40979a33c

                                  SHA512

                                  4ea03d054b8765bb073fcc09c0023037e3dd04322ceda1559758961f2f909b75517e62c1172567b3cd0a23c7399938aa58f37c5f9585b825d6ab1f217092a9b9

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  2KB

                                  MD5

                                  30755d8c99f79e970bc3314c7e34b158

                                  SHA1

                                  c132f9f0642baef870578a17b269f86b2e9ba397

                                  SHA256

                                  167286e71edc1c982987f23128dd5ea94e690fe51f4ff5d6bcb66b01a05f0552

                                  SHA512

                                  ebe2e159e250143d47ac0c7febf75b3108a6e9697d36dc03bc25162345f39d3f34f5979ccc1bc2e9149eafbd3532d0798410e170bfa22148e27009813434c46d

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  2KB

                                  MD5

                                  fd49a57350d86ba7a0b1a79dafe2365a

                                  SHA1

                                  a829e36a4b7094cd31a926813a00f6b98c94671b

                                  SHA256

                                  81e0f5dccf91f3e8429722e466d2d9a2e794be47a67402d5ae00429b7438ac49

                                  SHA512

                                  01e29c9e2386175facf552733be72c766ad1eeb9f0a4fb4ed3cb87470012b265b8432043b78ce53598785c1d31a9578f590cff7103dd64711e93c7ade9dffb68

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  864B

                                  MD5

                                  07e4e0f48a7136dd69c089cd84a206dd

                                  SHA1

                                  a84940876c4ef02ac3498f9dee2e05bacd0c64ca

                                  SHA256

                                  cfe2f73fc0b0c045b384aededd048aa4b16ea64f7fbdd3e236f3ca17dde3aa81

                                  SHA512

                                  0a2c3646a9346c6c6bdda4afc8975a28574bb19e2b0813d1f288ec1cdd99222d45e95be5bb5575e9800f37f277e0cc2de6b933fd5b5aa5d266c930f0b90563b6

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  7KB

                                  MD5

                                  2e65e0aef67f69f82ab9ea9c06cc6f4c

                                  SHA1

                                  a15986f3f4339068f8d1cb5f594a710ea1d1b8ea

                                  SHA256

                                  3890b1729136f91fb700264dc2da919b3cfa1b3baf4299a67c93ded9ea8b09bf

                                  SHA512

                                  8d3fa5e5d6a83b6ab1d247cac2fa9915aea6e46ff3c11761a4adec67bf05a979397d973ae2c68e8635f60ae43cfa2db2e79ecdbbd92f551d7bbcfd88b6de5093

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                  Filesize

                                  15KB

                                  MD5

                                  34c7d825bb74cab01b9ad43085ed34b1

                                  SHA1

                                  96e7832368ce6e9c514d78a1c189004da5caf761

                                  SHA256

                                  43337aee8077b21f097749512ea00c0de19cce3f617e4d04eb0b9b20c90d5ea2

                                  SHA512

                                  ba863fb0ddc2baac8ed93a7d20c88684a9140f882a4020ef0725cbffb2f001784317e15e91ad942774155ee84422f8a8f3a98e54c0b2317899700dd7506fff3b

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  175KB

                                  MD5

                                  4571c0929f5765dd2bfbc7812c5e2dcc

                                  SHA1

                                  85ef8e5e31937d104b5db69071ff9bc6b9d09061

                                  SHA256

                                  4f3f76441fc03c21ec9d7f26de2268b568599420eb583e4ad555ce7825e9af12

                                  SHA512

                                  8553a8f8a70d61adcffc98bc078596393edb2cff6e9820f7086b789278944582774d7e90e70ae2f089e1c643ec167f00503e0f0e58daa577352528e50848b1a7

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  218KB

                                  MD5

                                  030a634c7e7f04d9adba513b94aaafce

                                  SHA1

                                  522cbca8c9ba21ef9b838800f4ad2147c362c8ae

                                  SHA256

                                  69dcf836687114930cf3a8645490ab0024f9eb8939937e682f215a6466994da0

                                  SHA512

                                  11d5bd67c1cd50bb854d2d7f2cde5ca291b759743912fb43a338e503b9341af71b76996919c0239f022b585c2468886bd0b0db0d27c91331f6dd086931617386

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  89KB

                                  MD5

                                  be5f2f00bf7c4aa4d98bd53c5412a7fa

                                  SHA1

                                  a5092c8c39bcd1788a2204bde88bc28d77c71d11

                                  SHA256

                                  e258140bcedd128452216b583a8f6b0f11625934a3c097d4235d5946caf03977

                                  SHA512

                                  86b13b387f2e08181e6f7b4631619dff9c52a870311e48c1c889d9637a7e9520a32cf2e3eb250068fa02723dc97f715f1432b2e05da7d5a47dc37b1c35049f10

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  175KB

                                  MD5

                                  cb7a2c06a13e891be3f17341af2c1c48

                                  SHA1

                                  c315acd05b136f5bebce6e5b2364ecd9cae187a1

                                  SHA256

                                  f7b409fe89e33673258c4af9344a35b2c949e1446d4c0d15b7caa63390294150

                                  SHA512

                                  ffa8646a17d8702e776729f0f67b3a213c48d55d028b8f7dec81006ef424b555b2b1f619e26755dab59b15551f811cb577d0674213380d3fe857880392891f6e

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd