Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

16/08/2023, 00:33

230816-awag6seb52 1

15/08/2023, 23:42

230815-3p4fwsdh77 1

Analysis

  • max time kernel
    50s
  • max time network
    56s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/08/2023, 00:33

General

  • Target

    https://t.yesware.com/tt/745049c77cf3cc37ffaf320f651a53a6686ba130/3b183871027430cdfabeb460e0ab644f/64e9f37efc40139e4af22d29fc86a23b/calendly.com/universityadvisors/tfpc

Score
1/10

Malware Config

Signatures

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t.yesware.com/tt/745049c77cf3cc37ffaf320f651a53a6686ba130/3b183871027430cdfabeb460e0ab644f/64e9f37efc40139e4af22d29fc86a23b/calendly.com/universityadvisors/tfpc
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4480
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc3c499758,0x7ffc3c499768,0x7ffc3c499778
      2⤵
        PID:2148
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:2
        2⤵
          PID:4400
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:8
          2⤵
            PID:3664
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:8
            2⤵
              PID:4752
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:1
              2⤵
                PID:1796
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3060 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:1
                2⤵
                  PID:1148
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4696 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:1
                  2⤵
                    PID:3544
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3960 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:1
                    2⤵
                      PID:868
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5180 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:1
                      2⤵
                        PID:4836
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5508 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:1
                        2⤵
                          PID:3728
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3364 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:8
                          2⤵
                            PID:1348
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5652 --field-trial-handle=1836,i,7037282279613836974,984764146566556361,131072 /prefetch:8
                            2⤵
                              PID:2292
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:5028

                            Network

                            MITRE ATT&CK Matrix

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

                              Filesize

                              175KB

                              MD5

                              2a9c0a1074358185eeb6b70954ebdfe9

                              SHA1

                              c944e4dc2d1c703937ba0c9ada25927bb3373983

                              SHA256

                              4dadc11ec68efc62c2ec5fdddca582d3f3bc413b85351b5d3d7285cf8d2f0cd4

                              SHA512

                              29c9d5895fcbdcb5999a40a5068d378b86c50a2ccda983049dcf5b9a184fb2d1162fa0a7225f1a6ae07b993fa4d251f6aefe5df008c055fe1c2fc859c135b339

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              1KB

                              MD5

                              f38389f31741e0222fe2946dbf49e810

                              SHA1

                              c916eef47d414b3f026ab6a77ccee20ed255322b

                              SHA256

                              167d4e1e5d579a6429047b339a72f4e72477ffc36a0dc3b6163f629aa0c257f1

                              SHA512

                              ddbf5b576dbfd4511126c77e42b540d9be96cfd8682d8140f77f4c0ec6407ae2f9da7b0cb938f7900be04a587a7649a17a3742e4567ecaa3123e658d1b734415

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              2KB

                              MD5

                              9a57917173e6ae8202753dd5b1d3f03e

                              SHA1

                              54fecc54802a93ecb04d0ea8b8e34914eb1d245f

                              SHA256

                              215b755f03ab2374d2518ba2cb7cb36d182d6c1d54009fd5c22053c2da115d18

                              SHA512

                              086527b0f13ce06804ae98b6cf2c594afe469b4024f6d9bc2e01c91427255f80fc05a52a8a1bc6a080562e80e486c8a941b39ed2f74f34f335e6a0b3712f5bdd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              2KB

                              MD5

                              11b7616e27749596bd40078dfa3d2f31

                              SHA1

                              d696d960306880ca7169302445fa7753b0b6e003

                              SHA256

                              7d73be0461dfc1debbfdea28c41547dfa7c1f197e294fa60fe3774c18697cf95

                              SHA512

                              04b8884562e78be70290566281429828849847150e49f5f679174b9e74553b1ec7b57b60b6223fa3ac0e357dd62f7d14bd0af24dd1ab59f446d93edd4b001135

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              2KB

                              MD5

                              6c68719ac28edc3f7c095afa3c51ed16

                              SHA1

                              0945517b431c8914c563ac03ebe23befb7422066

                              SHA256

                              b73ed51fafa245645dedd4fd97c478fff2ab0eade94fb31aaf588430d58aa6c1

                              SHA512

                              37a8a1a6714e4d200b512ef8f171ae0ef0d259aed8f060162a3e7693710ec2cee56d3e9a72f4677a72f85ff1e2f8d46acedf79bad227b91c9bf6255c731764ac

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              538b63dbdb4ee089761c1c76cfa0b529

                              SHA1

                              7137dadce7093290b33022cb648f4ef5aef50263

                              SHA256

                              c77f510dd257bb92cfdf40f73ece8cf0a0dacd78cbb09b06b7f3a74be5d6e3f4

                              SHA512

                              bcb8f318627303be0efd11a300bddbb102d5dbf2e1d3e6837ac9aa327bef6d5f39f4234a3e3494155e98069e69394e0a56466bfcd194084062159c4f770d5b56

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              b4fec2cff58d76c791e66ea84ea19c94

                              SHA1

                              10d6a5af3450169ba99c383c38dd7af13d8ae39d

                              SHA256

                              cd40257fc7f457e5087b7a864aa9d76c3d3b496c11b3d59b74219673b2718561

                              SHA512

                              b61a7e8cd4702e2a1f81519be73a1354b3fad2d0caffddb0cac65668161700c02ffc8991072603138927653e3acaf4134637025cd487fff4747c09a9057d3166

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f08f4ec3-16a3-4da6-8a8d-3db39b9920b6.tmp

                              Filesize

                              6KB

                              MD5

                              1767bc1db7b537a347f39e4551597296

                              SHA1

                              4d2dcb4c6ec6a025b39daa5195078915d70a9a66

                              SHA256

                              671e90ad003b2b96dfe52b639e281c6167de28dd7ad4bbc39c5010838c973485

                              SHA512

                              b560f16adfe39fdd70a61358eed5a4a4b33f47f2bd5e95188d93548d95180ff034bdd34b7b357d62c4468b4c888c969fae9e272aebcc40bef578a146c136e0b6

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              87KB

                              MD5

                              c154c01267df206eae8f0571a68d26b1

                              SHA1

                              db951498d6cd920bbd461f488f2654fec2dc8692

                              SHA256

                              745adb4ba7d545668e4f2d840f76e98f16452df60077a709f53556b3495806cc

                              SHA512

                              ebae9fba8c21d7040bc08247858b6a4380d1fd8071106a99d0e97093e21a19e554abea7478199bc9292e73a5fefce635cd745514808d60c8de2e515b090fd769

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd