Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230824-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230824-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/08/2023, 09:16

General

  • Target

    http://url8795.enlyft-protection.com/ls/click?upn=bNf5wLhVtbyKnBBOBl-2BDW05mgldRma0vRrEYiLdT5Rkhp9dD-2BhV2IjDsyK2FPf8-2BDgp6n2aYv-2FU18KrrXXgSpst7BANI7d6MQW-2BO133ZrU5soOSmzCKU3XMQEthalJ14iKn8_AAEI00EOYWNMur3FLQGVFIljUOle7tFhiI-2F5aEllNB3hCHMNa3yl8szXKZRV124-2ByHWV24KHuK3waAfH-2B49U6qiZC1bqwEfxWU71kJGbh2v1lC6ouHVbML4-2BjQa1c4ggDH5sGW5heG-2B2YniotU5wu5cYG07WvV7LKmcT8h-2F602GkCroAU8HkkBuQUzh6V51jjjDKf21el1ZtgYB6-2BDn7QQ-3D-3D

Score
3/10

Malware Config

Signatures

  • Program crash 1 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url8795.enlyft-protection.com/ls/click?upn=bNf5wLhVtbyKnBBOBl-2BDW05mgldRma0vRrEYiLdT5Rkhp9dD-2BhV2IjDsyK2FPf8-2BDgp6n2aYv-2FU18KrrXXgSpst7BANI7d6MQW-2BO133ZrU5soOSmzCKU3XMQEthalJ14iKn8_AAEI00EOYWNMur3FLQGVFIljUOle7tFhiI-2F5aEllNB3hCHMNa3yl8szXKZRV124-2ByHWV24KHuK3waAfH-2B49U6qiZC1bqwEfxWU71kJGbh2v1lC6ouHVbML4-2BjQa1c4ggDH5sGW5heG-2B2YniotU5wu5cYG07WvV7LKmcT8h-2F602GkCroAU8HkkBuQUzh6V51jjjDKf21el1ZtgYB6-2BDn7QQ-3D-3D
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3556
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7f0c9758,0x7ffa7f0c9768,0x7ffa7f0c9778
      2⤵
        PID:1016
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1560 --field-trial-handle=1836,i,16768611512020380471,4677764527859860762,131072 /prefetch:2
        2⤵
          PID:4672
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1836,i,16768611512020380471,4677764527859860762,131072 /prefetch:8
          2⤵
            PID:3188
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1836,i,16768611512020380471,4677764527859860762,131072 /prefetch:8
            2⤵
              PID:4784
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1836,i,16768611512020380471,4677764527859860762,131072 /prefetch:1
              2⤵
                PID:2668
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1836,i,16768611512020380471,4677764527859860762,131072 /prefetch:1
                2⤵
                  PID:3576
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4564 --field-trial-handle=1836,i,16768611512020380471,4677764527859860762,131072 /prefetch:1
                  2⤵
                    PID:972
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3748 --field-trial-handle=1836,i,16768611512020380471,4677764527859860762,131072 /prefetch:1
                    2⤵
                      PID:4240
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 --field-trial-handle=1836,i,16768611512020380471,4677764527859860762,131072 /prefetch:8
                      2⤵
                        PID:4236
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5296 --field-trial-handle=1836,i,16768611512020380471,4677764527859860762,131072 /prefetch:8
                        2⤵
                          PID:2532
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2316 --field-trial-handle=1836,i,16768611512020380471,4677764527859860762,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1836
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:4180
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 452 -p 3820 -ip 3820
                          1⤵
                            PID:3872
                          • C:\Windows\system32\WerFault.exe
                            C:\Windows\system32\WerFault.exe -u -p 3820 -s 2200
                            1⤵
                            • Program crash
                            PID:4636

                          Network

                          MITRE ATT&CK Matrix

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

                            Filesize

                            180KB

                            MD5

                            497835d373e12af4cd257487dd5d3612

                            SHA1

                            425950e9427926ac0aa7940c4a18a44ab59df47a

                            SHA256

                            e11ff08dff0a884b311133e2469146b2a54319cf60094511e098df0c3677c4e0

                            SHA512

                            aa05611f56185e02289345f9c286ca98f96d5e1d24c8d152605e866e60013dc2945fc60f826e81459003ca9c2b7d439c0f6fdd173cbee57cd751ee51b18d2bf7

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

                            Filesize

                            432B

                            MD5

                            ac24408b5b5abea4f417a297a80c09c7

                            SHA1

                            cac8ac778e8e12157a0f2096babb601326e4eddf

                            SHA256

                            555262c33b519fbb0166b56cfefbe1f803960cfbdb13efef35736d7a68907258

                            SHA512

                            6dd3212888baa72ad46caf41103a2bec63646d9b9546dd521b8601e59044bf41a141134e2a4053e2212b7773874b5f9e39c3a32754f37f3b30e483d339a37492

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            648B

                            MD5

                            336f86d45a0740ff4a4de4ceb5d0b373

                            SHA1

                            dc887efa70bb1e56fab2b854862425f36696cdf0

                            SHA256

                            5e8b6782a09ff97e81edfe7bffe00c55075fd87967833b43777073ae11d5207a

                            SHA512

                            aa11a78ce5c4f915f596acc9114793679398a0f0e39200195e45c2931f6dea6c52d41437815499b83ec26004d9789c2a72bc324d7ca93ff83f0ceb1d899b1261

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            4KB

                            MD5

                            0113256df436c994d99a09edb00029bb

                            SHA1

                            0e2cd3111ef68d558722c6bd5bc60b66b330ad7f

                            SHA256

                            c39f57fa48c1792feb8016c8be537315e22fb16d7f24c72d067d0a2018373cae

                            SHA512

                            4e7f3bdaa9af0750e916fbefb45020fc09c849990ca442ed437b0820fbda4d9d866385bf36e030b42ebbda17185518de46dfdaf25da4de7dc5d136ee60f1dfa7

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            4KB

                            MD5

                            49bf797302a5374cb959d60ca7127f8e

                            SHA1

                            3af3853e5cc5e938ff0a013085f60c878451b33c

                            SHA256

                            bd6366e7e0e1477112322b511796d93f6326b63829600d33e349cc8df91d983b

                            SHA512

                            51ae4c96f6f38c84e391d3ddb384886bb8c84ef18076614d29758e16b94c20d925e1cdbfc59f5e925393030657b9d0cb478104c1f6ce5cb8c080e550e0d4c885

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            8ea4354acd9b1d7d38852ca5f6c94140

                            SHA1

                            ff17f44da01e3ff9e29932556c2ceae872d8372e

                            SHA256

                            e122d8cc409c0b2e070ae14321bbd476d82d1b6e33d114ce5fa554ae28d65418

                            SHA512

                            2808e2f43078bd9d6bc6922833de9c17c7285c983bee3f2d70ab133dc3b79dc67fab31bc5d833279de07b40367b2c758a4eef6d0a8a5523b9533cd133e731695

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            1cb0c7b3363931471c718539bb505166

                            SHA1

                            db590c657c03bbf3c06ccce272e918333f182efa

                            SHA256

                            e42be91ae72fa645dbd730b8236c590d5fb9a904c7e6f3d0d2c5471605c8049f

                            SHA512

                            a5a8aa1f408872e4b2026f7f0ab31b8667b640b28f6d636b2059616d9ced7bddf8c14119f362f40aa19f5df84a159415827cce9f2947076bdb0ce57b7cbbb270

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            951cb625ea68d2d417e24fc36e69a0f5

                            SHA1

                            d91f7292c6d5f7a123e8251d5b0c5b889ab2c079

                            SHA256

                            63149d19bf0b1b4a844f5285b3e2d1299f0cf15edd5b8e61a45980c498c51262

                            SHA512

                            daa4cfc833f99ca7ae1b1216dfad6aac0adc1fe01176a4b2b6fd089af90d13460dd855dbf772d0d5aa42ee5e90bf49ff823b4f0bc280ae85f385a187efb7c5d2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            f5fda14357147599eaf7c5f980ee8c0a

                            SHA1

                            a0d949a2dad692d0b626a831f4232a3688485a89

                            SHA256

                            a81b7410976f8dbf664a5dddc3a7ed89852d05e6831ccf4ba00e9099bc667cb0

                            SHA512

                            7fb2b2a9d4958ada6cc5765c42d63b81f34dc4ace27a44340b5354fd036271c4c6868fee848b69384f13c576426a56b2dcb2c1737d04fb12906b8a27becffef4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            29cbecd937536f99e0b3350da17f416e

                            SHA1

                            e05c5040b9d9c9bab8486a79894a653821c36e84

                            SHA256

                            3f88b72f911eaff28c38452c4656313f53fc51909123a0be493c515076d2aebf

                            SHA512

                            5c44eccef997c0338b5091db9801359529f4b5271cada29e06c01337096022447657f305ee7b2c2b9c6491695ae3b7ab99a39489fd336867a78f6c6a38541417

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            2a420e35c374555a87e5683124480d2f

                            SHA1

                            00b520fae7c9a576767dd97ef4a64f417a03a7b2

                            SHA256

                            b1485ccaa84c5f94845ff9d9e8a3b103c62df0993054669fbf33403201137c5d

                            SHA512

                            a7f6e441a7e2e9bb8ac67dc0ad7bfb8512a1b91a4ba74df90da2a1c0daea301f981489505537cdcd4f0c995e57287e6b52a31946aa610466e32a921acd5726d3

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            285a02c9c24469fca8e396af7e5f3f53

                            SHA1

                            bcc7188fb608942a7b3baded232f358610fa334f

                            SHA256

                            6f8cc66efbda009e339619f42ae01a2f5a534cdc694f404640cfb82a3f466bbb

                            SHA512

                            49a27d0a6d563a27baa21b8a71218832b7649ad322dae6b56fff696da9629ceb38ff98fea41ef9787db867c9e818de480b06334bc8141060076ae3a503ac91ee

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            4KB

                            MD5

                            79051bfee8bbf9764ce06625a913a7fc

                            SHA1

                            7546cffaf87ddc95feeaf8b7cb573e7ce8efeea5

                            SHA256

                            557ccbab4abf39bf593db55e7c8770195b097fe8b6e6ea2971e6816ab5a82ade

                            SHA512

                            93965b6636edd3938cfd4175fdc4e6b608d475dbae3f7c014d76527bdd8bab88e36c7efd864872786e64a59f637c88889997b0bf44fff0164b03f8873a95535e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            4KB

                            MD5

                            e4ee226d8a73b446a81802fb9714108e

                            SHA1

                            09cf5e57b33384bde85fd868cb0e48e8121ee0fe

                            SHA256

                            92b9e4d0ffdf9b6ca39489bf1c6bce037cf60ded4f3f2cc5c6516e35b9817f06

                            SHA512

                            f6ee218da7294b740f8747224d12f1b8bd4d63d2f48f64b8aa387c6320f2d2887e3f7d4d7296e917b2fe3c74a496b6b7cb4146912f059c57ef113c2d00f485ac

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            d91e67500ff713e4bd858e9a75959863

                            SHA1

                            60cff63464e179e302531826a69dec0e5c6d618e

                            SHA256

                            99f6363ff063044a0980a1e4e2aa7519845abaa200aa765b169127f64726a4f1

                            SHA512

                            1de826dc2dc3bf740281d9e637814f7c3f494728cdf216c983eba19aa2a3fffc10b13af214d6e0bf03acf3f623ecc6c78e90bf6370fcbf7bd65ef39f144f8f3c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            4KB

                            MD5

                            4f7859999b4c63eed1b2c7249f6e4a6a

                            SHA1

                            17ba7f47dbdb32c82718475cdef7cdc81c2167fd

                            SHA256

                            9afb706ccfb1805c59d3b3dcb8011e5723fdd13cb1e930b4d696f278e646ff8f

                            SHA512

                            9da13af75a85fe38258ec311f596cf57c4de3d082eb82e9f0da826bfc003463ba2f97fa9039485cc44e6fd18d5b3b4bec7141f86f6db819f0c40ae106b64edc4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            94KB

                            MD5

                            0d9acbdf912141ed41a5b0ad2bf94dcb

                            SHA1

                            2e6a38ac2b7b6d0e0563783877967dc4cf48b13a

                            SHA256

                            af1dba670838bf15148f4cae968e1051a059da2f000cf4f8397a826522d4d973

                            SHA512

                            ab49e221d6019b5d07e22cfaa9ebea1ec69680c164bb90b6a45fe1a38cf0a4da2f070dd1b5ca685d9be140ee27fcdad68e329f793ba54cd166588ea71dd12013

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd