Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/07/2023, 20:11

General

  • Target

    https://https://www.brighttalk.com/webcast/18324/588979?utm_source=ActZeroai&utm_medium=brighttalk&utm_campaign=588979

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://https://www.brighttalk.com/webcast/18324/588979?utm_source=ActZeroai&utm_medium=brighttalk&utm_campaign=588979
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba6759758,0x7ffba6759768,0x7ffba6759778
      2⤵
        PID:3368
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:2
        2⤵
          PID:3508
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:8
          2⤵
            PID:472
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:8
            2⤵
              PID:1420
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:1
              2⤵
                PID:468
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:1
                2⤵
                  PID:3636
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=1628 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:1
                  2⤵
                    PID:1720
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3944 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:1
                    2⤵
                      PID:4116
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:8
                      2⤵
                        PID:4112
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:8
                        2⤵
                          PID:1100
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3852 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:1
                          2⤵
                            PID:2976
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5088 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:1
                            2⤵
                              PID:3596
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:8
                              2⤵
                                PID:3648
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5496 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:1
                                2⤵
                                  PID:3256
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4548 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:8
                                  2⤵
                                    PID:496
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:8
                                    2⤵
                                      PID:2176
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1864,i,7613650086387221031,10870794742240971857,131072 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4976
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:5044

                                    Network

                                    MITRE ATT&CK Enterprise v6

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      816B

                                      MD5

                                      bcbab0f29586ab8ca72e6791c1be8353

                                      SHA1

                                      c1bb2ac7525d9205e03e11dd066e23d04d2615d1

                                      SHA256

                                      6325415582f9e0540c08c93b0de5d57951da2f8efa73f356a1bfb1c31a9802f8

                                      SHA512

                                      e44a609a3b462dec89c9e1f57c7266b23f12b215a2e835b1bbc310cbb4b80617fe782073704cf3130d2f9e664af9b44548c0446229d918cd0cc51cfa46aa78fb

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      3KB

                                      MD5

                                      4aa10e07c946e8bd8eca3d8f72752da7

                                      SHA1

                                      f52d415687b78210df83f15f5de762760692136c

                                      SHA256

                                      826da6aba60940d1af634434c100ef5a41076a64760a2a63e18cb06945395f64

                                      SHA512

                                      48b754a3e2328c5db8246a1dbadcdd17c69eb24cd14cf7942e01259b778ab6e40afc9e5587951537337188182d6e41a4e8253502211558991bade07a9da2a3ae

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      1KB

                                      MD5

                                      ac323447a5d043fdd33692e247463c17

                                      SHA1

                                      465a3130484215047618596043f978257ec0ea60

                                      SHA256

                                      1011ed40e4587c86f4628a89be8097ed5e9b30aae39289285819a3073515a325

                                      SHA512

                                      a325630203fcedcef582af00cdb328432a02e98c5d4124a08dacd13dcaef00c4a6fffe93a31058f3dcdf01b61df5dee5118a5b616a4d5ca7c439c202593bffd8

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      6bd18b1775759478fa88755fb17efaf0

                                      SHA1

                                      c22e52de18c9b191e3450401d0cf27651ceaf3b5

                                      SHA256

                                      6ec1f4ce00f5203407413eb9e8e7d6cb20499d70ed889f193117fdccc40b0e45

                                      SHA512

                                      d9d62b3b6453eefcac5bc396af716b96e049de8d81a16659ebdf7fc1b905d936f3d50d67322bad889e80a6e40603823fcdc6a889e7256f99f6929d88e335b254

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      5863da54f265c274299d053694715e0f

                                      SHA1

                                      6c9602e110d66576640d3010ad55bdcd5adb7549

                                      SHA256

                                      3c88a57a81333dbf041c5b1ec55e57d3a9cb7773799ea815ed7a0eb9f0152064

                                      SHA512

                                      31387b05d7dca024227adc72144d7bda17a7f49f2a642bea0a60e2c7e3488368ab63a65f55584ae7927622214307ea33fd02ad7abb1390ae625c691926e03b43

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      108KB

                                      MD5

                                      bab9c71b8b2d2e608c28b35ea280974a

                                      SHA1

                                      d79352fa53295300c3d9c84e3197c194f1b232fb

                                      SHA256

                                      672e6b8c81d147267262c1cd462e3a936788bc109b9400e92151a612f0b0b705

                                      SHA512

                                      b1a334214636bc32e723a537ffa3598814df7fea4c489d3282cd868505cc72aa396a9f9977866b2c339bbaf3ad2888d7f91065e80e2e4aee46f047e6ee610efb

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      89KB

                                      MD5

                                      10d77d821d365a242fcf322be172c873

                                      SHA1

                                      8f31c483ada836d3ea04bddef50f674c12d8a9eb

                                      SHA256

                                      ad8b4f42a4ef23ec208f8a925621ca57f20fef30b6a32f7d797b109a42a70e3d

                                      SHA512

                                      2a58750fe5343077dfeb212dc252cd9c50d323ebce67956ad9b3c7ef170152bd0ae0c0bf9229742ecfbec1f7f4eb172bc4d6c4eb67601d79e0457a0cb633cbf2

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      89KB

                                      MD5

                                      91fd435002afec9345ba6360ff98b7d3

                                      SHA1

                                      e30ae20f5328553e4aac96513e33e40fd1f1d93c

                                      SHA256

                                      08cf0544bbd45cbec5ce68bef1fd52a722c29df47809711f37d5aa7b41de13f2

                                      SHA512

                                      de913581de9ff23bcbd486ac3693dad784e2d91049d1c5281e9fdd7cefd9845224b6d46f61656f861357a502ca4dfa3637281128260a52984da51b42eaaaf6f7

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      89KB

                                      MD5

                                      cfcb652d87bea4e8efcb5f364b39d4ae

                                      SHA1

                                      91cc19f9e62c9a10edc4ab6303e2964e0f8e4e0d

                                      SHA256

                                      a8a03589c669aa4abeda17a8f29399dcff84ba2afae4909ad8db92e826527637

                                      SHA512

                                      a8392edc6339c94b1853d72d7ee8c8d6698d6a13cbd117c255bcd6d14f82f0a95305b120bf16e66619e8954cc29e96abc10ada48d6f5714d461359e5fcfa3f19

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                      Filesize

                                      101KB

                                      MD5

                                      b5432fd3e65792c1449cec15c6e40f9a

                                      SHA1

                                      efe3f0e03c4cbe1a43b4ef2f688347bcb933c5b4

                                      SHA256

                                      4973653f92779615a2364d368162a2c4a9e4be26d254e97f0714f120fb575998

                                      SHA512

                                      5aa8afa40faf5a72a4a4a1604308c6b316731d3b94f8fd9dc1a54392c2c11bc04ce469b81199e8ea91b299e5c0212eb68022188f33ede58accc906a34889f79b

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5830df.TMP

                                      Filesize

                                      97KB

                                      MD5

                                      8fe132f771ad3a24296909e653a69b80

                                      SHA1

                                      e64cb13baae5ca7d75ee3fcb224d6f5d4dfd0a5a

                                      SHA256

                                      0ab218ae2fc62275be95f61f70ab3c1c48ec98b50a2b04097b8ad13807f6d1f7

                                      SHA512

                                      189de51b26c412b6312d0a80b987a1f0b2f70399e69594cbf9060255a82889d6d00aa6899c312eeb4a7a34c716a420c03cc7cf0f6d924e4bdb4b986e819eeec2

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                      Filesize

                                      2B

                                      MD5

                                      99914b932bd37a50b983c5e7c90ae93b

                                      SHA1

                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                      SHA256

                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                      SHA512

                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd