Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

02/08/2023, 15:21

230802-srqygagd8z 8

02/08/2023, 14:37

230802-rzc6xagc2t 8

Analysis

  • max time kernel
    300s
  • max time network
    284s
  • platform
    windows10-1703_x64
  • resource
    win10-20230703-en
  • resource tags

    arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02/08/2023, 14:37

General

  • Target

    https://d.hodes.com/r/tp2?e=se&tv=pixel_tracker&p=web&aid=humanacrm&se_ca=email_unsub&se_ac=unsubscribe&se_la=12171&se_pr=5006&se_va=1923131&tr_id=&tr_af=9402&u=http://rand5.ianmatteson.com/#[email protected]

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://d.hodes.com/r/tp2?e=se&tv=pixel_tracker&p=web&aid=humanacrm&se_ca=email_unsub&se_ac=unsubscribe&se_la=12171&se_pr=5006&se_va=1923131&tr_id=&tr_af=9402&u=http://rand5.ianmatteson.com/#[email protected]
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3716
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffadd769758,0x7ffadd769768,0x7ffadd769778
      2⤵
        PID:1632
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 --field-trial-handle=1596,i,12572593181899759419,4506480868315924607,131072 /prefetch:8
        2⤵
          PID:5116
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1596,i,12572593181899759419,4506480868315924607,131072 /prefetch:8
          2⤵
            PID:4336
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1596,i,12572593181899759419,4506480868315924607,131072 /prefetch:2
            2⤵
              PID:4572
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2816 --field-trial-handle=1596,i,12572593181899759419,4506480868315924607,131072 /prefetch:1
              2⤵
                PID:2692
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2808 --field-trial-handle=1596,i,12572593181899759419,4506480868315924607,131072 /prefetch:1
                2⤵
                  PID:2100
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4552 --field-trial-handle=1596,i,12572593181899759419,4506480868315924607,131072 /prefetch:1
                  2⤵
                    PID:212
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4652 --field-trial-handle=1596,i,12572593181899759419,4506480868315924607,131072 /prefetch:1
                    2⤵
                      PID:1448
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2940 --field-trial-handle=1596,i,12572593181899759419,4506480868315924607,131072 /prefetch:8
                      2⤵
                        PID:4860
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1596,i,12572593181899759419,4506480868315924607,131072 /prefetch:8
                        2⤵
                          PID:2272
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4512 --field-trial-handle=1596,i,12572593181899759419,4506480868315924607,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3816
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4440 --field-trial-handle=1596,i,12572593181899759419,4506480868315924607,131072 /prefetch:1
                          2⤵
                            PID:4464
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3668 --field-trial-handle=1596,i,12572593181899759419,4506480868315924607,131072 /prefetch:1
                            2⤵
                              PID:2496
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:4456

                            Network

                            MITRE ATT&CK Matrix

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              96B

                              MD5

                              e3de9fedd2d226c479b05f071e957d4b

                              SHA1

                              c6eafb926ed37664406e549a1c1a0625b6254c31

                              SHA256

                              5e746189e1bcdd0a878ea635c1ac5640b5abaebfb8a39ea953533a4205d13efe

                              SHA512

                              80f3370dc1ec33a65403dcd895e384e638aa66f439c1e82fda09eea04755da0679a7f0a8e4cbb32278fc4a4250b3f2ab1a164dec711f22246623c64853d012eb

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              168B

                              MD5

                              c8b2b20b23b25a04d1cf17b3690216b7

                              SHA1

                              05ef6fd6afd18c5dbd8e98b031bbcf0a1e78c839

                              SHA256

                              7696ea86af0ef749eab83f06fd6ff8d010823d582bc34a6e22fdb4e4566700ed

                              SHA512

                              5499770d9115f5ba0b05520f7697fff3eec53ae86fd8df07ecdf7be1c8e3eaba6d50d4b1759382a55f0a5aa57be8f4dceba25be7fbff244f4dbda1202595b64d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              72B

                              MD5

                              ea93f940e346328ca8256bac691d10a2

                              SHA1

                              3d6b71e8897fa6d9f2c1871e16645c6fe1ac6ce3

                              SHA256

                              cb7667ff75e1dddfa78d200c9a767017af9d65825f7811568412ebafa57441cd

                              SHA512

                              fdd7e293b67935150d3790f1dcc8fb8535b3598eccc154f676d9635800403f8619db652e1cc1ee928fa07b6d1d738975c3269d1e25ebcffee67b31ba8c6bb8d5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6d0d7845-cf33-47b3-b1bf-509cd9df5a5e.tmp

                              Filesize

                              1KB

                              MD5

                              0e3b32c48b5a7289c39164dd174e97f5

                              SHA1

                              e96028f6ec0747f67016b320b00843acd95919cd

                              SHA256

                              efc9d0b1a51ec3b75044fa139e1018830457bbf6d3d783dab00a28f31a6b7405

                              SHA512

                              c5041755a4b7967decf0d6864deaeb0ece943b322bd87e9a35a959246e9fc845d9b70b40e3e52f06619bdbccf71be7b7985c5e0f8a7f004b0ec6386850eb181e

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              893B

                              MD5

                              c8621e011100678d1b90692fbcbab1d0

                              SHA1

                              333e6db6127ff261965d30c84ca826fe62036104

                              SHA256

                              a8532433551fce8db0cab92f41c3cd3baa38f7abd70a9943c77aa9a0817cdefb

                              SHA512

                              74a2fa09ac71305ab6dbb3c0d0f8d1963ae8334c337aa5f8034387a86659d8319d839a862dcff8cdabd9080180f01af4144b5f36e6dac3eab233b34955dbe167

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              893B

                              MD5

                              db5a8e71e97cbd378f7c4c50dbf50471

                              SHA1

                              55ecc5545b12343a0036c5291b076804f6427754

                              SHA256

                              6c77bc821e1940782f889cea1e55da20c4adb75c0be6d78b1dd3bd0bd0270a92

                              SHA512

                              3832eefb3655b53b608490450c8b48ecaca9892f0599d289d2dab3dd29d51cb7ed5a113c79889b1446028b68239960dc1699039b35b9c8a4accf70a6909b5a29

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              f1ddee80f7bc9aef2282910b32f30018

                              SHA1

                              5ea63f54eaa9a19852828b45a871977f623162a1

                              SHA256

                              120ca5d6bcf46c4446c4fdc3918f8db312fed5bcea7456f75b902f71ddc18b67

                              SHA512

                              0d0baedfeeb754a50abcd406f4a1594350ad44cb79e42a811bfa0712683f6a5ea9bea8f19a34af26abb6f4f1a5d536f2f6e549c669b3bb1319fa0f832db8e853

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              538B

                              MD5

                              249e608031a32a2e791f2fe898f7c84e

                              SHA1

                              65270db40422098b24c1cfdba35e21bfcddbba67

                              SHA256

                              c56c193b61fd9cd3c2e88976bb7b67a7727cac38a5a3d033b01c632563e02b7f

                              SHA512

                              350f7e81484dae618c4f61c5a05ef32085e3f20a820e6878ecddb3e79d08c9c349bbc62f613d1e1b894e04957826dd165b31b322838ac744ccb9d700f0caabf5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              b494cfdc754587984279cc29576267ea

                              SHA1

                              2a8c78ffe6910938aeb4c7971b41803102afaf28

                              SHA256

                              cdcc8a1ddd31453d5e7ac15906adcb31052e1db43a7ef97e563d660ec7cbe607

                              SHA512

                              59542559b920fa658e6ad9717562880ad55dd8b2d66da646e68bae1fdad284f8a705ea70fb72b6b1252675d6235526dfe68071a31b00f355237f13028533a1b4

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              56218c8d77c9c020c19c7aec4f007401

                              SHA1

                              78131cb9b7c18bf7fd3689ffbb3a3d5948524bd4

                              SHA256

                              f499aeb6c058570291764e1df76766c2ca314c10bc60be5adb430de587405663

                              SHA512

                              17643a2f599b365c9c2da3156d270bcd146d463be8ac9b6ceeabb4838e2efa221c1c9ef16bf13ea4f1fa292c0e1c013a9feadd152466026b7c58823fa315de39

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              991f883aceae030948657f13d0519086

                              SHA1

                              24db3caa713aabffb3252731f5ca8c85feac0ad0

                              SHA256

                              b41cf09aa8abeaf1d2324bfc2a9c76e0518d2d6c7f61423517c6ed96cb0b6224

                              SHA512

                              4f639f2052849836081c048eb1d950c023a224457dfb68a79689a51b35ec7662e627c1a991c86c7a80af6c8f071e6a901e471234d207565f4368d5111d6972bd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              258c23324e1ed397449919e680d06948

                              SHA1

                              b859ddcfd87a830424660205069d36f98031e4bf

                              SHA256

                              c06c04f9775536778a2f70cdd0de81608358953cfc2b96e14943400cf208dc95

                              SHA512

                              8bf345fb6e5b6e34972f59c9432158b971b6af2335636c7a4afff75a797beecfd44ba69cf3f8fa20035c8f3f499df16a9f14269cb193d20d039fe52b2890d2da

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              1a84f24be5d32508d7247442e67ae8ac

                              SHA1

                              068a82f068d4924b8aab46758f79cfe8168658de

                              SHA256

                              8659d177b670f526d16ca5f771abcc612dfe921cd16996567a23bc2a00680a4c

                              SHA512

                              82d07f9df5b3060803eaafb8ec48e685c4e1e1d5a76ec50d046b096647c89eb49f7bde574f001c606fdf7d41eca8f54b27c55c8c1b7b8a298d7bc59fc484c663

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              f50f436545b043263a7d5b46a5110a05

                              SHA1

                              81ef9d7d810724cfde8a7d9487c0821628cc23dc

                              SHA256

                              a8efe6468febe33e287feb4d29c307a0495aa1bb9610f749417e62e745e39e67

                              SHA512

                              096887592ad23e6a8c06cae9de29db4e1aa6bd9e941be29be32a6ded65ca1cff0fa46ff65800ee0a1947a197afb9347379361aab9ae1d991cfc16929a025ceb4

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              87KB

                              MD5

                              5d0f91feabcd0090fb2080136a8bdf67

                              SHA1

                              adb0da12fc099b3a723fa2658976e3a9be780492

                              SHA256

                              35c0c65ceba4c21e7f542896f718085b654287e2b5c826155dc391e39e61b62b

                              SHA512

                              79becd58bf87e1853da284e33ea5b4842f3702a50610e7dac8ecf443f458fbed4c0b84ca099d67ffbb135e4d18c23a4eae791c339388dbc77600a52ff44482ab

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd