Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    60s
  • max time network
    55s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    13/07/2023, 14:50

General

  • Target

    http://shredder-us.osi.office.net/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://shredder-us.osi.office.net/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5092
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc71bb9758,0x7ffc71bb9768,0x7ffc71bb9778
      2⤵
        PID:5008
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2008 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:8
        2⤵
          PID:4040
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:8
          2⤵
            PID:4468
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2704 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:1
            2⤵
              PID:3840
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2696 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:1
              2⤵
                PID:3704
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:2
                2⤵
                  PID:4892
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4448 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:1
                  2⤵
                    PID:3980
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4568 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:1
                    2⤵
                      PID:3800
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:8
                      2⤵
                        PID:2084
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:8
                        2⤵
                          PID:2984
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:204

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          288B

                          MD5

                          1384973408865b25ec116585e4c6c3c2

                          SHA1

                          ba8786e1c6cb271f160e2ecd42593109892c6200

                          SHA256

                          ec77a9bd91059f140895abfb8d5c69c698cd055efe069c1e4e304a5bf3ed1a07

                          SHA512

                          72edecffcffc2777be12732327d58dbc28e79f18eadda4be4e5be7f271b32d135a4a1c29d8a35092e71b589b90e8e2f1fe382faa3dcbbe372db9fb65307469e6

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\LOG.old

                          Filesize

                          347B

                          MD5

                          0cf82bd8d238b27e48846499f7f2ecf1

                          SHA1

                          0cc17e72d56daf954b373bf847b811fbfc3f202f

                          SHA256

                          99f3f6192e3084f268443fa7dc8afc053a0d506b16808b6c7f7564037a452bf0

                          SHA512

                          dd3535d23d8fca76b6e967a638e4e09ecfb8079b7f7ae2ed2f4f115b0af3dcd93cc4d63346534da091377cde9c2f8a2d32e0a18b1cf6c5be67a0ad7359b16acd

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\MANIFEST-000001

                          Filesize

                          23B

                          MD5

                          3fd11ff447c1ee23538dc4d9724427a3

                          SHA1

                          1335e6f71cc4e3cf7025233523b4760f8893e9c9

                          SHA256

                          720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed

                          SHA512

                          10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          e9684e8ca01d39c345f08add283fc5cd

                          SHA1

                          d35b7af02b0824b39f7d99c595b9750bcc6a4d23

                          SHA256

                          77f911ead03d5eda3d1ea7adc234001f8d9c50332735d578245f934ed42900f4

                          SHA512

                          390c3a6dd8a89ff6492fef5c80d4d0152cf5ff918ea82f58eda56a6d6075021d6085052b003b2baffca10528b25604ce58311e8ef145cea8b78ce44b8bce1de1

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          cad9d9f8aa6a78308a4d48bc8dd9e136

                          SHA1

                          e55497235861f41be134db0d55a798aeea63f2e1

                          SHA256

                          f8d2ea56c04745ccc4d795aef02b8eda079f0dabd76e2b9c795ab42b414c973b

                          SHA512

                          da6fc616272ee683206e574ecd74abac44adc331c7b7d97795e349c747bdab3ab6f15c8853de06c42b06c502ee126f5117b40d32213a998f9e1e061fbaa1f8c5

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          78ec412679b226253959a44b0da2e817

                          SHA1

                          0f75eb6d3866fe6b40dcff90c2696fb4737ea7ff

                          SHA256

                          1f77ba6191863ede4aad8f4c4e8a8f281f066f1e26c07e2fbc000da84d68ed98

                          SHA512

                          e9e0dde06ba62433fe5896d326fe5e964fbf9d86685968afc5736d793d6a2587ff6e8d5c2a537e9e4906ee0a710ef25329b543faa6ddae7598e469794eb7605a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          8b6a0697a85b1017b1b5da9919fe3eea

                          SHA1

                          63898d5b329041609726815a54707507f27b8162

                          SHA256

                          7382ed2f83925f374e5a54fba8b807e02727c619e5239e33d21a5dc31ee5479e

                          SHA512

                          a9687b440775e218a584f7bc0566912d63705f76188667ecbfcd34d1bd60938281440ab5ecc3daf3e0a69dd65fc0a6444b4dc6aa1fbb1353d14bb00d1a1dc3e0

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT

                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                          Filesize

                          240B

                          MD5

                          5d1c7219a2ae8cdad0416c3496d1e214

                          SHA1

                          85c1daa3c4e964fd19bbe8a00f06b8a8115b3038

                          SHA256

                          93923b44a9345ea15370cbe3f1c8eb9ca1be31ab0f65103f0f9556919181d58b

                          SHA512

                          d29b989c02bd7b5d0c5c5ff960103bd7d19052d8ba52615c22519101ffcda9825ccffd7407d1fcc58be90a64f23bf0b6b4a2f29fb8abde02ddc7c87289086aae

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585261.TMP

                          Filesize

                          48B

                          MD5

                          1430372d2e113cc10821c99be34c0065

                          SHA1

                          11217058e5c40ca3d0360e59b2777a1b82c1cb36

                          SHA256

                          590956c3a5dc40217c865c32db4fa298e9f2ca1f4a498e2208c44298328e091c

                          SHA512

                          f1e58b08ab314de02950862aa3c5a2cde4956c5250cad4c337aad1f1be28682f37bd261a740f0a861d8f87a0443db3c2b4d9bc5f60697cf95b0c08199dcf402b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          173KB

                          MD5

                          de7199fa88919e5f0d6db34ed17fa5fd

                          SHA1

                          fecace298a414c4dd5fdbce53a4d8f33f4f8195a

                          SHA256

                          a54a594413fc84d4219b3f466fd0486f2256fa49000e3fd9d711a87c874e6ca8

                          SHA512

                          eb9e9e477326d74ab1ef11c93d2744cfc79a96d2ff956e019b49e9c34aaf87a9e87186f97636daafd1865d266952c2e76368fdd60fea7434099ed1ca310bfef3

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd