Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    112s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/08/2023, 14:26

General

  • Target

    https://www.loom.com/share/27477072db57461ea313119829dbcdb1

Score
1/10

Malware Config

Signatures

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.loom.com/share/27477072db57461ea313119829dbcdb1
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3340
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff987c29758,0x7ff987c29768,0x7ff987c29778
      2⤵
        PID:4928
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:2
        2⤵
          PID:220
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:8
          2⤵
            PID:2908
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:8
            2⤵
              PID:3776
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:1
              2⤵
                PID:3856
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:1
                2⤵
                  PID:4892
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5104 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:8
                  2⤵
                    PID:664
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:8
                    2⤵
                      PID:4540
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:8
                      2⤵
                        PID:2752
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:1776
                      • C:\Windows\system32\AUDIODG.EXE
                        C:\Windows\system32\AUDIODG.EXE 0x368 0x3c4
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4496

                      Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        1KB

                        MD5

                        7691942daf4da0384fcf2c0e27e87218

                        SHA1

                        8ab812b9fd56ce35eb812ecb472a790ebb8ce9c2

                        SHA256

                        563dbaf26e3fcdf4b45cb8ba5db17e222580f208f786f579c3b9aa0758357097

                        SHA512

                        53b43ef140be7ea379928abbbd54450aad5903fe1c679913144009aff72597cfe37a9870caa929eaf2c9e7dc738d303fbc01cd828ea6e5264a4d49d098a57524

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        4e322c2c3eb8fecca44e3578ed923cba

                        SHA1

                        a4b6d1f75c77689beaff9ecf0c6d5626b0b328b9

                        SHA256

                        7e838537005b113df8df5c54964bfb0787547f19a0ba9dda0fbf1ec575631445

                        SHA512

                        97b5fc0533a2880ab641eeae80a9e56236773ee3034de89d4d2122e957d672a5a360b2d4224c13675bca0e9df09fc2b6c6c479dcd49b3bc2a1b2c37c3ab1de14

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        3447b7cd5d66cf5cd8354026f9030062

                        SHA1

                        09aa47f84d02eaa42b6a0ec4703da130855c27a1

                        SHA256

                        50127b36c47c995c75b919af4f1664ef967b1cc1672da89ee5c274c4d0e023aa

                        SHA512

                        15bfb2418fee560de62ed98c5bc94de241aa377c63bbdde5aeb348f7accd5a52eb73ab0f9bce3afe49a3e388e55c97b0354cb011548af87a58271329ff64e67a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        f671cb6c76cfa7649f83ea0a39226109

                        SHA1

                        ffea43a34fbfd2f4e6b55ce73c68b70a0273ad53

                        SHA256

                        96331d7084e182f7fd4aa5ddf88432cf1bda45f42a53da22a185a29662974250

                        SHA512

                        76cda3e656fc915b6920e132522bfda1a22e7d4fe446db142cbb4b6b5e8e9851242c3098046f91429ed71cb591f5b5aefa7d8d717b6e67d10e18e41a16573676

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        e0eefe29d50f2bd6f6a81022b02c1409

                        SHA1

                        67cdeac574611ef855d1f513c2ce8fa6c90e3d65

                        SHA256

                        003384b5ae1ef3cab05584201c94f9a00573be97c3fc7609f62d647dd67ace6f

                        SHA512

                        ed62425c489059a4cc58f89c9c515ff28d96db36a26024313d567992a063a96626dc4136faeb40b3e6f5cc46b9f0ee8697018f0c60741954c7f35d0c3bf2a532

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        b4ec2c2d6a3ebad32e456ea837f97c31

                        SHA1

                        2f8f885c80b5e319e34e35f90c9dc86d184aa050

                        SHA256

                        c4c05d9c929f6e27f26ae0b8b2411853f6ea81d49d5590f80d0dc76975a1df51

                        SHA512

                        2552135afdb4bf42993e997b3799ef14448d7619b3c00cc76e7b66338ed65e34543efd35ae4c4a23fb6b0508f29195bdfd859be49ac83c38d18538f2b5d7f3cb

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        690018e94d8de7c48d1d9c775f3461c1

                        SHA1

                        a1fcef53bd8ad07fc57c12d6ba507269678f759e

                        SHA256

                        5c6ab8e9583cd987fa2862ab5f68ccf948964d0e8e4ceae138e0461931c25afc

                        SHA512

                        4be3a3c28f01066878b37c5f766b1be9effc8eea57ca24a5ab6410d7087fe01c5ad7cc73e64875847e5d6e5340b6223ad5dea331856c2a7c5fb6141797474b7e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        52071a42593db772366c30c5eb75c30f

                        SHA1

                        7a75c2bdea9eb1c09806ac0d1156fa4ccfdbbfbb

                        SHA256

                        8f25c3742a5de5bcb46a6b1301c161c1e253516dd538c842cffef946850aa7e9

                        SHA512

                        2757ab9488facfe5512a5b8c494ab0198fd4b810d1c3ac6313c77ae355537b72bb38decbb3204c93789778dce7402931c6f94d84411e5c28109aea9a661ebb35

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        f03478ea64dee7cb6939d51baae19e86

                        SHA1

                        e5543691d710321519fd3992b25d8e5611fb1dfd

                        SHA256

                        7fbc6ebe0f48cf0ade9ac6cfdaa189f94f1de8039b1f2d8fd603c7f639481d5c

                        SHA512

                        b12739e838696aee223abf21058449f03d70ca99bb81d0381d43a276d2962018c70854022f80266fdd09fe58341a4e784cb0ed6f81023a48ec4d6cb2edbab2b4

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        f3e71ffdb05f11f7b5eee439d8ec5860

                        SHA1

                        4ea9b5a36f6e2f0a83ee396f729c28c011dec345

                        SHA256

                        7fa4235fee2155085d06cd59a49a930d7a4f623d186e180cbb87cb879f6259b4

                        SHA512

                        c8b95e556b34d2784f9ff7b847d849802eb4e0084b286363bc418a604a94babb7c39b20561ce527c22c21f0658d56deca528c29fdf0e5bde3ddabbf638b2dcb9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        b71fbc0c079157d31e9d0c901d044579

                        SHA1

                        2def54324a76a76b03e8d915af5c6871437382c2

                        SHA256

                        00904bca7e4a7ad6c169365d4ba8a881fea3df4198466e2543ab48edc5a9ccea

                        SHA512

                        a4f4b88497553a6563148db1edaf1bfebd60c332786792e2b092a9b016ddbcefdadb281e9e0aa06e332ddb410461a8e6bb4c2cee5560a03bf57606b53910e493

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        5134bb757404db79916991f59aaa0ffa

                        SHA1

                        88932924cefbd5f51bc2e3f3cebc5baa221bddf7

                        SHA256

                        e864f390aa152f2d49ff483b7ef9550789d57e4077c7083fa2001f8fdf2a578d

                        SHA512

                        fee4c6dec00afbcec83dd7b5da6ca99602c2f5564beb86a1481721d3bc17714efc3cddb2ba342d717f12131ce7d8e059a95bdc9c16cc250725c5d68e4ed4bed4

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c90c7f89-2246-42cc-b5b1-6f0cd9c51d28.tmp

                        Filesize

                        6KB

                        MD5

                        1ea043fc10020ff9940b9bb694982410

                        SHA1

                        f5caa8be0f0a04b8de29de99c7591896c13da116

                        SHA256

                        7035762a27815b3b7c8eb2765a4def64f8bf356624fab6d2be8f2ad1d9e8a731

                        SHA512

                        c15a4b3dc9f988d42fd56d87ef7c4fea051622f5d2506063bc1fd98efb33e83516adcbb1c552c49477865be74c74e20c89dbe201af3e57e21509d773ee6ab706

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        87KB

                        MD5

                        a764839a7d4cf0f6092f0f93a40ad073

                        SHA1

                        4989abb3ab939ae25415c894a798df1135c989ef

                        SHA256

                        2fc0455ea8e542bae8cd1d7c9ed1747e1814bcb992813f127ec8fd1a6924afa3

                        SHA512

                        32191ea4f487825b4a4065c5d61599f3f17ef8ea0ed768549d5eb58f056a74ef422cfa0b3d1af0cfa180279bf98a5ef37baa5f26f660410d10dbb9a9f710eb61

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd