Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

19/09/2023, 16:53

230919-vd4nhsaf6x 1

19/09/2023, 16:43

230919-t8bqjsaf5s 1

Analysis

  • max time kernel
    600s
  • max time network
    491s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/09/2023, 16:53

General

  • Target

    http://occupationcomplimentsenjoyment.com:443

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://occupationcomplimentsenjoyment.com:443
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1064
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f7369758,0x7ff9f7369768,0x7ff9f7369778
      2⤵
        PID:3528
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:2
        2⤵
          PID:452
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:8
          2⤵
            PID:1904
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:8
            2⤵
              PID:4616
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:1
              2⤵
                PID:2212
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:1
                2⤵
                  PID:3712
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4452 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:8
                  2⤵
                    PID:3876
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:8
                    2⤵
                      PID:3820
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:8
                      2⤵
                        PID:4568
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:8
                        2⤵
                          PID:408
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:8
                          2⤵
                            PID:4344
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3256
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:3052

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            0f61d47dc9de4ca4741196b9f131f32f

                            SHA1

                            0684497753ed2fcfd659d71bf9ab67c9e06b9a6e

                            SHA256

                            47c83c0d8b6d15a095989f70c548ce821a03146a8800dd8cb31ec1725a1cbad9

                            SHA512

                            9f18af09230ba93edf9a49a42e66dfe45aa0208d8f7c902a37a4f78fdf945dd0dde32e22b9e3745590910b3be23947506dd728e2ac150c86d03057953e57c0a1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            3f08d04476430fe15e9ec39c27820cdc

                            SHA1

                            fba53465aadfd94540df22c3c74880434bac7f17

                            SHA256

                            49a2444946261c6971055fdccc2ecb58c0113d4ce835dfa4d56f8a1412277624

                            SHA512

                            2afdc6acbc4d2454327b9ab28cee136964c9cc3b64b069f2c86904ad6a5adc3c9d887a223863627893f10dcb7ae119a43013df1ecf0cc16c1f3b0ac900eacb4e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            56974a0e72bb5667f28639ea2006b487

                            SHA1

                            0bd498fed9e3b867ea8b27981bf4b2c0ca61e7e5

                            SHA256

                            75d3f2184b715741ef5fc96764b92a13cd7f4fa87af8e8fc02596cdde0ade8b2

                            SHA512

                            425a2ecf1dba0651d19f70537958845a2228bc5e40f246eac798c9c7b067fa33f4f6d555e40f1f87988b214362dc0d24a60f110ee83e473c4402a4a9c41a15cc

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            122KB

                            MD5

                            ccd1c156c58063dbd63c6192e0488e79

                            SHA1

                            7ab69cb2c4a6e45542688536387ca9cceb5c0ca2

                            SHA256

                            0fdf2232706181037edb0425cc99e594f112a5155c0864d50a411e35f1902111

                            SHA512

                            319e9275d559e55b7746f8e3717926f5eba550e1de04dc36b371d61ceddacd801eaa8452808df667e63eaf004fb2b6a45eff0958ebf086c61bd0ea1bc4facab2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            103KB

                            MD5

                            e56dca09fd14f847346c3ada9937c047

                            SHA1

                            7d070d3380b6451989e98d7f13c7cb59b64fa63b

                            SHA256

                            c7dc724f0335fd9bf3eeea693ff6ef332265f4b951345d09adb78b6b5dd1683a

                            SHA512

                            cc17c4bb044e852d80bc03ec3901cf1345e0b8114609d569db153e5dbc96843f5bf4073e693e57f1f556167b01e9c804e4a05df5c3cfce6695aa3654c9fa113f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            103KB

                            MD5

                            7cacb0e26b34f11d13a3a6a8a1b33a8e

                            SHA1

                            567a63204b2cf50d9a4fead3c60c39725f7e37e6

                            SHA256

                            6cf3160105fc82f46f39fa34921d0d382eae378a98b77c2f9e77c549399ec23a

                            SHA512

                            efef0525b74dfb1d40bc79a7716cd28f9a2934664703a8a77375aacf8052b8fd77e4c71ced546b6b1d6a15662abc4fd504370216d85dd9851ebeb1f6130297ad

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            104KB

                            MD5

                            baa497bad8f85ac5ab3d90d71e35673b

                            SHA1

                            75f2852ff29c45cc5a7105a2ebeb18c6dce59055

                            SHA256

                            b7a297f6940b03a7b49700fadb5add69e41088814760ac872f97ee2c6858f98f

                            SHA512

                            d0608c17712db95fcd5d9bd43e1846c2ab5426155e2907e0975ec4cd64665a2519f3f52de9cf0a104fd0d4e4133920b5b87cc077fe48afb4370d67db96a42032

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            121KB

                            MD5

                            c337d7d22552e7b3353b58ac0b33851b

                            SHA1

                            c65b176b3f9cc3945eed487119782c33fd4483c2

                            SHA256

                            56d1bab46df22e335a0c9a01482f80df5c1b79251a22561a7776aa245102c4f4

                            SHA512

                            0bf20bc5945e089edda61bde069260a7eb4dc74308446f38c6169329229a91422af12ecb65f42b757bdaab9af358b12357115bc3eeea7ae2b50dacf01111f9b5

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                            Filesize

                            97KB

                            MD5

                            56fb0b750f91ff83885c117bf9d72f61

                            SHA1

                            baf0fa756b4ec59fb32b3f482829d46597d2b612

                            SHA256

                            052179d45ce254e5c6edd18aaef5356d89bc2ad5e06636584ccf5d01f846ddd1

                            SHA512

                            a508d0234feace02c54f2abf62ada6850b1f3f6514cc7a0c5b808f8843e261e4695baa8a685c8c258be59b5d9ef393c5d6f96c98a4ebe9e8959da7cf2813e94e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58d695.TMP

                            Filesize

                            95KB

                            MD5

                            10829f20ed89296198367a695aaeb729

                            SHA1

                            fc49c7f0eefdb82f3265a5a994ee0c6be1176f4e

                            SHA256

                            042001e36c7ba11bf6e7e689a913599acbbcb79f801f34bbb8e954e818af6744

                            SHA512

                            fe29c69b020799aefa33b4353d7e745c3ed3b975b58f3775e57d75866bff452f69b689052d81d1e91cbdb27d0269dbf1b69a4f66128aa1148dba8692f00706fb

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd