Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

13/07/2023, 09:08

230713-k4cbvaga39 1

13/07/2023, 09:05

230713-k2pjdsgh7x 1

Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2023, 09:05

General

  • Target

    http://tinyurl.com/yvwyrusv

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://tinyurl.com/yvwyrusv
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3584
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb3ef09758,0x7ffb3ef09768,0x7ffb3ef09778
      2⤵
        PID:2932
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:2
        2⤵
          PID:4964
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:8
          2⤵
            PID:5076
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:1
            2⤵
              PID:4904
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:1
              2⤵
                PID:4820
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:8
                2⤵
                  PID:5044
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4748 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:1
                  2⤵
                    PID:2140
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5040 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:8
                    2⤵
                      PID:4132
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:8
                      2⤵
                        PID:4860
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:8
                        2⤵
                          PID:3976
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5188 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:1
                          2⤵
                            PID:4436
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5488 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:1
                            2⤵
                              PID:1540
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5408 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:1
                              2⤵
                                PID:1660
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5876 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:1
                                2⤵
                                  PID:1740
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5884 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:1
                                  2⤵
                                    PID:1428
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5692 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:1
                                    2⤵
                                      PID:2200
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5136 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:1
                                      2⤵
                                        PID:4052
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=6396 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:1
                                        2⤵
                                          PID:5200
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1880,i,15277857628439481023,15460773381001780462,131072 /prefetch:2
                                          2⤵
                                          • Suspicious behavior: EnumeratesProcesses
                                          PID:2020
                                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                        1⤵
                                          PID:452

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\8ed93555-ac43-47c4-87ed-d4619b11be23.tmp

                                          Filesize

                                          15KB

                                          MD5

                                          0eb4f66018eaccb151eb35f6f6a96e71

                                          SHA1

                                          2cee7ea26a250f667d2ce6567ced356d10eba46b

                                          SHA256

                                          717485563c33f66a5d4b18cd09d58825fffce91dbf314a47cc64783d2425d7e4

                                          SHA512

                                          010f33538ea45cd9ff3e3eeefe74f6fafd9693dbbaf34edc355001124e4ae08f61a13d61f0cf00c1bced5dbc232d9e84a4aac47622b3d2003f738dd630c34c4d

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                          Filesize

                                          408B

                                          MD5

                                          5583e2b7d08891b72ba879a076ec8419

                                          SHA1

                                          859353bd80a26cc802a44b8e444dbb20310acb69

                                          SHA256

                                          3e9433be6b39599c02eab4cb0f8753f10b8fab6f13fde68f3edfa60dd7e4abb0

                                          SHA512

                                          744f7ccdf24691b43670a7c582fa8a06a7cc3279ab7c1233570677f6b124e48fbd58cce873278781fe5c7f9dbde26d9717703f311d519601755aef21530dca20

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_register.sirennnow.com_0.indexeddb.leveldb\CURRENT

                                          Filesize

                                          16B

                                          MD5

                                          46295cac801e5d4857d09837238a6394

                                          SHA1

                                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                                          SHA256

                                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                                          SHA512

                                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                          Filesize

                                          7KB

                                          MD5

                                          b902674d8857a6b893454d1696f65fb9

                                          SHA1

                                          ecdd045f1600d4fdb618af9c56dd609ab0750123

                                          SHA256

                                          f7fd6e646259ade6ef5051d0168447172e9127c73eb8366d8d3fed2118fb0a06

                                          SHA512

                                          b75b29348fe8db28b5370e1cfd73f138b165ba93999fc434a739d2216ee544119ef7869d32385cdeeb506a02424574ae24be61390fa239721429a91cfe534a05

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          2KB

                                          MD5

                                          70799a06a7f7fab8bd1746f763eeb5b5

                                          SHA1

                                          b41b226c06fec4ce75a129c3e3348d053b15f707

                                          SHA256

                                          7a56e72e68a56637ef8b0aad1145508e90cb2b395aa3ba72ee3b9634990b37ae

                                          SHA512

                                          9ffb934f9f7799eafe8ae2f9e38ecbad6670aeb268abea1b106a3799cb3403f81fa2a600b179ad1d065c731e7c1eb95afb40f816a86f8e89b674e96ede6fcdf5

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          2KB

                                          MD5

                                          9e8ce14aa8b76ccbcecb2e1f7076f93b

                                          SHA1

                                          9553320eb5812e457d288faa08f81c87558d7901

                                          SHA256

                                          fcbd5a7ac0438a681e932c4d26527f25bf7e760a31e80b378b366c705728f434

                                          SHA512

                                          41c2a32c1c5ddd8a8abaf26cc1925a4096df8736e69c6cd22660b79f62be08659f005dc577a006f93728ca890e7bdf2997cac494ed927055d62091425e02a1df

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          ec093cda44d266513c39837aa09e0c63

                                          SHA1

                                          10272bfe2103775d77f23e9c0beab4b7ceda1155

                                          SHA256

                                          13f7e3ff47de1bb15ba4810822ed299932133a116620367cc6e0769483e4b21d

                                          SHA512

                                          0c46f2fbee8829d3d94635e1135b7fc2d6b5f0e4fb2b5752e4307569c56b1381a0b34b6047df89bbe3e11a666e9fa0b06cee8b6032f1905bccb15bcea2da448b

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          dbb8eb05c684c1b71aef25fa58b0eba8

                                          SHA1

                                          232fec044e6cb51652a8e0ee98c674beebd6bbee

                                          SHA256

                                          9d1cce6f0a36eb0d87da21c8640def89c2e9fc894592c150896f3feee72c90e4

                                          SHA512

                                          9725c00b6186f4018c3e484c8af6d259c05fa104280433154531ce12fc2c156f523a5893900858022ec3a9120212067d0cd741f6d07447e415b066bf120776f1

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          7KB

                                          MD5

                                          a47a052169f3ed029885235402443fdc

                                          SHA1

                                          4f3bee4faa406679a295dd202913e0f1445877a7

                                          SHA256

                                          f72dface570652e208979214c92fdda147fef08ec31922dd805d6697d6569325

                                          SHA512

                                          b880b4cba470f8308637f6351974b4ec7388dab13d78d123c8a75533a0eb2c015a8dc0636399d8f79735c244c215de257c7e90ba6194fe15a6864b4c626057f3

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                          Filesize

                                          96B

                                          MD5

                                          b95083c646aceed6b3a450e11aee8209

                                          SHA1

                                          7f8017ed0eb8baf446f90389263ec1a7ca568642

                                          SHA256

                                          e313668e5e431cf664a9df5c97e5ec50f83f5cc4b951e4a0c5cad80f8ff22a5d

                                          SHA512

                                          6cb92c444f92d8dc9f4671e830f7094fbde0bf6d7df73fc61a00747382c36127c791179f9c6c9afffbae6dea364a8bee9ba87077a27e15c1fc7ae85329cbbaf5

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5806e1.TMP

                                          Filesize

                                          48B

                                          MD5

                                          bbea14d6d2453ed7f551a3d6fb07cff1

                                          SHA1

                                          021b3c63399b79fedaa18581b818e28ccf5183d3

                                          SHA256

                                          a0d943812fde4396214e6da3f6ac9f1cb309d2c7ba2ab1fa935b20f5051625dc

                                          SHA512

                                          0a04aa5fe600769da3c7520d104c7e51ff8b797e742dddd04879e3ba5e1cdc92dbb83f2a94ac594accf10a978f2e873819cd3ab680ae4b28e22f3ca0a31389da

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          173KB

                                          MD5

                                          c4b807f6e1a297bdcb30d625e715a78f

                                          SHA1

                                          bb51c49c9c71abc8b76d7878360603ce699c223d

                                          SHA256

                                          5343c7c819ebd54db0dee9b486b5c6cc52959f991477be2886e822823382a02d

                                          SHA512

                                          a97e13924765e26d68cda7610a3f93fef3381d44f3282539d6b0a7b22782da1b3c887299712d9c179e142befa012630d761eae12cd3437a0e7f2995218f2869f

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          173KB

                                          MD5

                                          1cd849610e29934872d63e2c1240e3f4

                                          SHA1

                                          96436df34073c9921a44438026c2dd53dfc1715f

                                          SHA256

                                          07ad776ea552d295194a401054a9568112c72f87dac9d8b81a6ef1b40eb682cc

                                          SHA512

                                          010dc14626c68e0fd2ae04d57d433bb489bb825f9479550deaa4b43d38062890e85cd9c572ea0b0dd2cbea1c9105b02418b90879a7570509fe55a017871728e4

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          173KB

                                          MD5

                                          3ba7c43020426c44d9c6bcebcf5a4965

                                          SHA1

                                          e4374e14cee5402ac49b2437befe84fd5acc3564

                                          SHA256

                                          38becad6781518c0b3faab08197ff196447db72b5951abbc534034da4efcbd4c

                                          SHA512

                                          d9a1ec7503b112c34eed89cc41b6c2f9875ba4ae7baa5d39c538c79fd54a53e470a443f6ad2ee2091f860cfb8884c2ee83936eaf360c5f1bc4f42f08c920d376

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                          Filesize

                                          2B

                                          MD5

                                          99914b932bd37a50b983c5e7c90ae93b

                                          SHA1

                                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                          SHA256

                                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                          SHA512

                                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd