Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    305s
  • max time network
    308s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/09/2023, 17:24

General

  • Target

    https://mpago.la/2vmuqj9

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mpago.la/2vmuqj9
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:768
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff699f9758,0x7fff699f9768,0x7fff699f9778
      2⤵
        PID:2036
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:2
        2⤵
          PID:2948
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:8
          2⤵
            PID:3592
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:8
            2⤵
              PID:3564
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:1
              2⤵
                PID:3840
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:1
                2⤵
                  PID:3792
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3752 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:1
                  2⤵
                    PID:4408
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5420 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:1
                    2⤵
                      PID:2964
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5500 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:8
                      2⤵
                      • Modifies registry class
                      PID:5080
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5528 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:8
                      2⤵
                        PID:3216
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4928 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:1
                        2⤵
                          PID:2388
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6116 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:8
                          2⤵
                            PID:976
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:8
                            2⤵
                              PID:1964
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3840 --field-trial-handle=1876,i,13830995343144317983,767076921558057760,131072 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3880
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:3452

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

                              Filesize

                              182KB

                              MD5

                              b7b32caebb74387f0942190535df09a8

                              SHA1

                              25a1d8b7f987c900bb4303d05da879a8e078d0f0

                              SHA256

                              49dd9152e760c9598cd7da1caee7cf223c52b766deb421bea9ea9e9e03368e3b

                              SHA512

                              cf7728ab8ef798384fd9711909ce92237395366bc94040007ff06f4fb1c7a3dce02b438d28097dd0955271f633331e3591786c9c4c470062352230d99abe7d10

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              528B

                              MD5

                              4a9211c4495b2d38e4286d6da971b3fa

                              SHA1

                              4fe1e16946ce2d41132f89878c593f0f55afdf09

                              SHA256

                              8eff0212988f4504464d0d6277d6f505523748da619d5f6e9cee797b1c836006

                              SHA512

                              46fe359225a6908734fff1419ba8450f86a8dd5fa4158a5190d5e7bc9f1cc9fecbdd35a9d10e1ad6a11bf2925d742874559cdea5bb6a651b0a3bb24ec0b6dc9f

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              4KB

                              MD5

                              0a21fbc2dee03215ddec86d0ffdfa8d6

                              SHA1

                              0ac5a569922fec37b01e2a6965dddb04bff1d6e2

                              SHA256

                              faa11fd41e21a7c94cffcff8ef75e32fbc89bf9bd2e8f80a216bab7e79bb6032

                              SHA512

                              58d5d3eb512ae9500b26ec5c1515e06f4f1bfac19751f3d32cc51a3cb1bf39cb3807a422313bfa32d153f5eca89a5ae114ef3cf9db9fd2dd1e9e8c1afb47af64

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              4KB

                              MD5

                              342411d0168064bf696e4bee64de4284

                              SHA1

                              2fa265296829dbe30c283bc710a98fee2f736efe

                              SHA256

                              46db2721e590bcb34adac6a43ec8010f0c44afe56ad66abbd4d1af146f1371ae

                              SHA512

                              17ff3bfc6a7d91a3ebb7d0d442910a171560462cc35915f78c1f7a6064948c616566395af2c2db8d9284a48a6361f69d635cbbbab571f8742410f1b63d358bf4

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              4KB

                              MD5

                              0c62e7419e1ffa1ee90a32903d3ffbd7

                              SHA1

                              6fd5663ec64ddb5b7e53a44d77aa7426a27cc94e

                              SHA256

                              95e20e9c4055f8a52e0913f704f34a27fc0dd8501cbed67307f7fbcb00146245

                              SHA512

                              623e5cfe7b67368471a4aad5de7dabf09124fec9e0c5b2a3666d88985dde59cb68bb8a7d26de886ea49288e159b4ec89bd0dfa94c0d1a68acc12dfab1b247108

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              874B

                              MD5

                              667fe1a521488dad7d56f56b95bb5868

                              SHA1

                              d36d29761fbea49dba06d19f740262ef4334f1d5

                              SHA256

                              7cf412e748a7e10b31b8be080825ce77e1a79fe0dc30f49b1902013d5692a1f6

                              SHA512

                              12bcc7622b58fd21e57e6b3a91b7f2556f9faefb4368d56a824370e03d1a9057e9c8cbcac4177e1908bd0d4dd849b65b9f21956b0195d05109965af3e9939635

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              770bb7dd0918748a54e3886dbc0e3947

                              SHA1

                              0b163be02e8194c4868bde2bc773f47c97190350

                              SHA256

                              31123c82dbd9f8334721686662d812b5c5d9e8e7fbe0a44c9621bcaf6576d796

                              SHA512

                              5d37d301ea30a02938e6d7cf48f0d94f66a52875ba26a52cee52e601e93e7716ffb1bc7045a63c0db67c7e8981b2056589e32ff8826d34ec7a17f6998d258f09

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              43bfc591ad0c2bc915f5d81fa9dab233

                              SHA1

                              f06c7a4d9006f2e04bd0bccaf007a13e8ed211b8

                              SHA256

                              e2b1533899c19b8d27a1c2a70c00d9f7e81d666594a4c307b502edb4ecdc7ab1

                              SHA512

                              5591c525be9564d9e95427edb9b1ead38b9d030c414275a6621e33af8767d0fc98dfe46272a879c65be055fa124e8f7b666adf294467db16fcaf567c7a5ec0d3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              51269e8f5f11ba88339ccc4d7d090674

                              SHA1

                              367ea1e439a9cd1fdc3e49d8aaf0db26cee583ad

                              SHA256

                              fd16a9d6b008713d8c5027d5e4ec4e122eefd3659366226149e43a27109b2bb4

                              SHA512

                              a167ff1e0394d4540c3d430cbf898fa90977b5029f58d79028d3be73300b1257a17272ffd346e9b8b9a386088a93f55da39635be24bea386418dd555b26bd85c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              946d2aea992787c41dd29268ddad816f

                              SHA1

                              d1b00dc36a96065b99b32a506109efb145023c78

                              SHA256

                              0887289e453798b03e15c9024d4c5358f8f4a6549cac0b67db03760f4fc23b00

                              SHA512

                              8415b7045e3d60a39b57ec7c30ad62226d03e978d11af25779f4fc8eb62e3932e2c7d7be7035a289ef87522a77649b155e26dcd2a9eaf45bf2645df387ec6acd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              102KB

                              MD5

                              a8f024aa98f33afac8a81150be78367b

                              SHA1

                              2d137f476048f060643ed3de876d5e714677a61b

                              SHA256

                              90e39c73dcc29dad4500c01b82d935dcd6392b87e7a6067246e69262db936a52

                              SHA512

                              c245e5ad72a798e3b6436b7d0aae728ff5c48f4567fb7328df1f69c56e3f376bba833b089bd0491a3f520f3f265158a608fa93d9f0b3c9ac0f8b6cdf4f4c6796

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd