Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

26/08/2023, 06:34

230826-hbvllsae2w 1

26/08/2023, 06:33

230826-hblnpsae2v 1

26/08/2023, 06:11

230826-gxxgnagf62 1

26/08/2023, 05:46

230826-ggexnsad41 1

26/08/2023, 05:36

230826-gawa3sge98 1

26/08/2023, 05:27

230826-f5eq5sad2v 1

Analysis

  • max time kernel
    300s
  • max time network
    297s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/08/2023, 05:36

General

  • Target

    https://0kxvv.mjt.lu/lnk/CAAABA254gcAAAAAAAAAALMf3T4AAYCsEZgAAAAAACHN5ABkUOOLCGnV-r3DRBueDA-xSegS1QAfv6g/1/EQ8sQrAgVxiNoiCJdN1azQ/aHR0cHM6Ly9lMjAuYXBwLmxpbmsvZm9ybT8kZGVlcGxpbmtfcGF0aD1vcGVuJTJGZm9ybSUzRmMlM0Q1YWU1YzllY2EyYmIwMTQ2MzJjNWY2YWMlMjZmJTNESW85R0dQM0E5OFhuSjdnTUdYcG8lMjZzJTNEUlk4TVFKWWRWYno5YjBoWGNiaUM

Score
1/10

Malware Config

Signatures

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://0kxvv.mjt.lu/lnk/CAAABA254gcAAAAAAAAAALMf3T4AAYCsEZgAAAAAACHN5ABkUOOLCGnV-r3DRBueDA-xSegS1QAfv6g/1/EQ8sQrAgVxiNoiCJdN1azQ/aHR0cHM6Ly9lMjAuYXBwLmxpbmsvZm9ybT8kZGVlcGxpbmtfcGF0aD1vcGVuJTJGZm9ybSUzRmMlM0Q1YWU1YzllY2EyYmIwMTQ2MzJjNWY2YWMlMjZmJTNESW85R0dQM0E5OFhuSjdnTUdYcG8lMjZzJTNEUlk4TVFKWWRWYno5YjBoWGNiaUM
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3860
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdcff39758,0x7ffdcff39768,0x7ffdcff39778
      2⤵
        PID:4720
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1868,i,8787692768137561458,3762922660253698272,131072 /prefetch:2
        2⤵
          PID:1568
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1868,i,8787692768137561458,3762922660253698272,131072 /prefetch:8
          2⤵
            PID:4760
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1868,i,8787692768137561458,3762922660253698272,131072 /prefetch:8
            2⤵
              PID:1028
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1868,i,8787692768137561458,3762922660253698272,131072 /prefetch:1
              2⤵
                PID:4540
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1868,i,8787692768137561458,3762922660253698272,131072 /prefetch:1
                2⤵
                  PID:5072
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4684 --field-trial-handle=1868,i,8787692768137561458,3762922660253698272,131072 /prefetch:1
                  2⤵
                    PID:3628
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1868,i,8787692768137561458,3762922660253698272,131072 /prefetch:8
                    2⤵
                      PID:2268
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1868,i,8787692768137561458,3762922660253698272,131072 /prefetch:8
                      2⤵
                        PID:4128
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 --field-trial-handle=1868,i,8787692768137561458,3762922660253698272,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2484
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:4092

                      Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        288B

                        MD5

                        6bcfbe93462c7a80cc420fb1f134518d

                        SHA1

                        663181d684cdafac0baab0d937269acf635bad36

                        SHA256

                        ec2808ac1b7050263fdeba434b7cb6bd53abc2534fe342cca98545e4d44cd285

                        SHA512

                        84150666718cc71d15fefaa209b687e4de3dfdaae6282eae5f6ad5424b5ea41df87cdeed6ea8a540702021927d2ec0e00dcbd4c7c6caa89fad5c772d71bf8bf0

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        d7660409f07dc3e61c57839210d28768

                        SHA1

                        68d4d7e326294d283f492052eb01f43c0058565f

                        SHA256

                        a37dcfcfe710a390e71a859f75fe5de097c50c6d8ad94d1854f95cbea80728ca

                        SHA512

                        33d267fbc651b61a06b883f9d55ec8338aaa3d8ea0f69cf289cbdc34a813adde0df9bcba4b87d3a391a3db21076eec8256b42386f8714558442a4a9f1a7f4c41

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        8a6403ba363b6df61f55aedac4b37340

                        SHA1

                        d6727cd1e0f21631319043932f71618379915d16

                        SHA256

                        daf95a1de40a48e54af8f6a65240955f9bbd7b8c53791aad4fab923d3899cf83

                        SHA512

                        7b7e501be5254943b53fb9d2108a45b3c249dea47a535d2caa116c15e3ba5d7527dcccacc185832bd91b7d18c12ea5b3dd18f1ebc2e6aef22355c8c23fd9829b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        c834457256e1879ae0628e30650678b9

                        SHA1

                        ec0f9a2212f6f58e5f9131c92f2f4da16f3af4ec

                        SHA256

                        ed8e5034744d428c62da8435d44f3bea1e87ec16edd35f9d77ffc87f4bf1fa92

                        SHA512

                        28cc420f08a85c3bc3a07426183033a65997f32c19f4bb015e1e9a508e171a758d0afd0f3ee18a02358e91ae9cc561546b8afdcee3eae297beadf9d62ca7c927

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        f600ca837817bc145d44703eb428c5f4

                        SHA1

                        7966a188bdf59fa55cccadafa34c08e653693ec3

                        SHA256

                        3bf325a5e5cb7396e0b8cce1e4c231c410bab659761748e3d9c581c8073a795f

                        SHA512

                        6ae872a54af6ef60fc5d9013d2f3247f34b722d64357ef7b8d8868a3b93db2c60956efbf15adf890c1f1d46712cca9112d6476d001aa8bb30cddeae0bfa18cf2

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        39e670e36dc21c9f870671ec4b8f2eae

                        SHA1

                        6b9acf6df09798c60d5f562a4fca5fccd832b92b

                        SHA256

                        cdeb554fe23f89200e721acb7a66c57078e46d27bcb2c7b2a2ca55ae5d7b320d

                        SHA512

                        5329bfd2b986bbfdb9c818df063237aebf5153f5f18969d8e754085349925353b3174949b07a4a4eb57835f4d19f33a9d831d911c53736f7a6bd230299050a94

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        def8eeb1b4c7bbc84d86da04161438ab

                        SHA1

                        2fb12a2c451595f5a7484130f953191d0891f71f

                        SHA256

                        bc388dbba0d5c4824a7bc7ba63361e429aefd0faa05ae3b4aa438fc1a4fcd6fb

                        SHA512

                        d5f05adf093ad65569edcc7377ac559f9a258855382c027a340e28356868f794e6c782c1322185d572756436c64efad8cb5cd9909cf8de0dc709d35203e42acd

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        c4d7a4412da18fe87051c24a37beb051

                        SHA1

                        74458ef8d694d5cfd224b9a0d696f313928c1331

                        SHA256

                        0bc86c0f8080c9964e59ee93bece5e32e2d042de15a439cad65d8a6f2b2df706

                        SHA512

                        963014bed95597ab73cce54e581e9961761a8fd04b3de9e072ce498abc9d9ff3d7a106f68a08a2b671641e7c203dda8ea6c5bdc89ff93741619cbfdbcccef196

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        87KB

                        MD5

                        3ed4707a3d6a296b480df7f5383773f5

                        SHA1

                        500fe256b45247457e436b4854656a7c1c11042b

                        SHA256

                        52bea01a19953635e003bcbbc01842ab0ad19659df11c36d7f460320b543e5cc

                        SHA512

                        5e15938dd167f6c1180cd930921930a2fd09a2c7cdb92466f9f78dd0d446633608831d9cd9edccbfec7417eb9f16c4132d88a1ac7018b15d3efbe4880204ca97

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd