Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/09/2023, 06:34

General

  • Target

    https://fonts.googleapis.com/css2?family=3DSora&display=3Dswap

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fonts.googleapis.com/css2?family=3DSora&display=3Dswap
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbdae49758,0x7ffbdae49768,0x7ffbdae49778
      2⤵
        PID:2300
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1896,i,4822461711120182042,5512973550017876198,131072 /prefetch:2
        2⤵
          PID:64
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1896,i,4822461711120182042,5512973550017876198,131072 /prefetch:8
          2⤵
            PID:4208
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1896,i,4822461711120182042,5512973550017876198,131072 /prefetch:8
            2⤵
              PID:4628
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1896,i,4822461711120182042,5512973550017876198,131072 /prefetch:1
              2⤵
                PID:3964
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1896,i,4822461711120182042,5512973550017876198,131072 /prefetch:1
                2⤵
                  PID:4188
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4508 --field-trial-handle=1896,i,4822461711120182042,5512973550017876198,131072 /prefetch:1
                  2⤵
                    PID:4704
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4832 --field-trial-handle=1896,i,4822461711120182042,5512973550017876198,131072 /prefetch:1
                    2⤵
                      PID:3584
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3412 --field-trial-handle=1896,i,4822461711120182042,5512973550017876198,131072 /prefetch:1
                      2⤵
                        PID:3784
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5432 --field-trial-handle=1896,i,4822461711120182042,5512973550017876198,131072 /prefetch:8
                        2⤵
                          PID:2020
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1896,i,4822461711120182042,5512973550017876198,131072 /prefetch:8
                          2⤵
                            PID:1420
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3240 --field-trial-handle=1896,i,4822461711120182042,5512973550017876198,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4992
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:4564

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            840B

                            MD5

                            835f27d4d08c0461449e5a78171efd09

                            SHA1

                            44ecf4fe4b71453cd063a2d37b9c4fd452e1e2ab

                            SHA256

                            3b0f9e294eb0ee6afdd52500361e80bfcc8bca7f33b921585f87098a251ebc5b

                            SHA512

                            5fbbb46eef3c8e1a572c900ef6ce81408030876a51b1ccfe97458db9513e6f201906182958fd515c43536803d9832168a3168d9a54a6c85411c752defdff5029

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_developers.google.com_0.indexeddb.leveldb\CURRENT

                            Filesize

                            16B

                            MD5

                            46295cac801e5d4857d09837238a6394

                            SHA1

                            44e0fa1b517dbf802b18faf0785eeea6ac51594b

                            SHA256

                            0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                            SHA512

                            8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            3KB

                            MD5

                            011c2eec0a0200ff49fe8da23ac51f73

                            SHA1

                            26c4243f29c2a07b12cbec988371c9b45c408c1a

                            SHA256

                            09abee4a3bf16a48b377cabcba55df15c811db19706dcf4f2eec7bbb1fc96e20

                            SHA512

                            260293ec8c5777bf7565e3cfd896d010926206390491e920255dd7af26bc204a53b1de58352bcc46f10643223473c5f55ce90bb455b1829ba93741c4fbefae96

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            b5ae38860656c02aa423e6bbabfa0da3

                            SHA1

                            3e6e7c5c83c70e299a2445c88ec3a882e45ac18e

                            SHA256

                            931a5c2cb9cd358df9b3f72fc540e217732112645d794021aa188070aa5edb99

                            SHA512

                            acd242fe29f7713e2b0ae1f872ea131fa6f7b01513bcda46702961ed94465c022be97118428cb12b951cdafeb1ccb2eab62d847448b5ea36ac2d12b81f1a4382

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            702B

                            MD5

                            4417d6e76f161d1af99a8401245e9eab

                            SHA1

                            d7917ed70f5f1266a2eb1fe94fe8109fcb18c23c

                            SHA256

                            7bb81cf47ce8f2d220208c06421f09a616ccb51afd772e323f1b4505c1c42f7c

                            SHA512

                            2333c394619ab8cfe5c08344d61be0c386f9d1c8a570ecdaee49b8742bf5a35cb3277f7e868d78075a2e9a485c9d4bfaccf96b7135877c80814eb4ee5af58f88

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            7KB

                            MD5

                            305d109cd08d0b67ee70b3dbc6ab3aae

                            SHA1

                            b8cec56cf396eceda285c5b011638cfc185c831a

                            SHA256

                            0d9ad92be4c5e5e7e6222c020d11139b4cac964656c3c771255ce8b3f8efbe73

                            SHA512

                            423552c7faf020efeaf0b54285ee4774d3515041ac79c7d50c4a07ddec3e77bea50df2647a7e86eae160d8d90f14ba77b2943287dad1f7bfa778ab8c26a2cfa6

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            7584306d73092cc40f6b394ac1cb9c97

                            SHA1

                            867bbc184c1413c7937bb6af755b320e5535dbdf

                            SHA256

                            9336fa14ea11e5c9f30320671a75f8d5d0a7b84592ce82b4ea9347228753e124

                            SHA512

                            b0520ef304fcae4e44e87b50f0c49ecef45fca60ca8eecb67535c7ec7c8aa0462cde2533602f9a2a86342304135ebe4dd9dde3841a66c978356d8a602b4b0479

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5ce50966647b163092d864b9f37d981f5bccd871\bb7dfe29-85da-4867-a2cf-77fce4d03094\index-dir\the-real-index

                            Filesize

                            1KB

                            MD5

                            af0f548d3ec974398c3af07ee771886d

                            SHA1

                            704ac89a0a28dcd49be61c1b25623daebe2760f4

                            SHA256

                            1d3e24a75e4b32dd6bb09d7f17c63029a662217a979b7bac134759d203de23ad

                            SHA512

                            9d099bc703e593f0f095a3b09d23c83c3263aa86ad0466498791c5069853eff9a781f74f4534646ef2c4c5da7fe4d210141779666a34ea5fd59a20f4a5f70a80

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5ce50966647b163092d864b9f37d981f5bccd871\bb7dfe29-85da-4867-a2cf-77fce4d03094\index-dir\the-real-index~RFe57ecd1.TMP

                            Filesize

                            48B

                            MD5

                            99c55453f1e19c869ceb9f52b411a2f0

                            SHA1

                            a563ef64cdfdc4ea79af6126e4148977033b2815

                            SHA256

                            d78fda830924ea168674bedea2972e38f929b5b9ecd071c14502c572e44ad39b

                            SHA512

                            826c597270defaaa6af3798913218e641c5624d5ee5b5cc2b0e683acbf8b19ee9d39ee2a4ff365be0b4de1e2b6a44e6ffa5bde7620cda695543f9a82372638c6

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5ce50966647b163092d864b9f37d981f5bccd871\index.txt

                            Filesize

                            147B

                            MD5

                            49cfc7b47979f51fd2a381d0e60e0203

                            SHA1

                            6fea68c0466d69b604df70898e6222367f4d31df

                            SHA256

                            1f8cf1503fa931e06443e0956a384d096a815e4971e5387070c4cd2d23efe39a

                            SHA512

                            d5075d35c1cc0b4113c99eac7296bf4882309d55b6c5acb43b78253459a6d31b79ce54698c899edd4cfc52d49c21da4d906fade932370816929765e448ef660a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\5ce50966647b163092d864b9f37d981f5bccd871\index.txt~RFe57ed0f.TMP

                            Filesize

                            147B

                            MD5

                            9c6083102c42bfc3b3a63db1e2bc2663

                            SHA1

                            77c47e1f31e209196f5554f1e960325614c672b3

                            SHA256

                            2010230f81c8adbe28b2307901874c908e6c31c939ff7e4fcc458b7011f96d58

                            SHA512

                            58cbb303d4c739a01ca2bec46fc52707d80b15658943c5cd596ddbb635ed3fc721de8053fda42714bc571c2664fae30549889fab3a094e849ada239d4308b9de

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                            Filesize

                            72B

                            MD5

                            16d8cadc87fd39660294eb19b74ce777

                            SHA1

                            a4e0b614acfd9d74d38b375db7d83c286e9db6b4

                            SHA256

                            ddfe2abc1a2664df354a465c84549f11b04ea3dbaf7b29bd79f796e3eb0f9f4e

                            SHA512

                            a3363d6eda51ed4e2725c1d70b62cd733d23fffe3ac656395bf084b22c88928bf5dcdbc8e4fba8c3b7638874a5ec08c194b0473fdc2027ee068edb04ee2a9cac

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57e687.TMP

                            Filesize

                            48B

                            MD5

                            3e94c03cec5fb707179feb52609d8969

                            SHA1

                            bee7658b164666f8d00d603c72b16f2150c0528b

                            SHA256

                            95abf5ee07662fd388fe3d7c42343e47a892d6fa22a8b6f5ec0108b531f4d332

                            SHA512

                            f371c8402acdc92d50033fb944aed9e83a0e940052b416554a959969deda2daaee4a3f6ecc14e22371a962aeea0c113d2925e30308563b1a15bb828414123a49

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            102KB

                            MD5

                            7a96fd3f079881bc2e5ff5d3338714a1

                            SHA1

                            eb74bf1a1a6cdb55e4766604bc441d58bde21596

                            SHA256

                            6c107780a4c5a36c9e1198da7bb936ef2d251f31dc1bccad0552e74eaa397bf3

                            SHA512

                            c2642324ee2cf0461cdbb0ed613336a64c847d438ebfdb9e9e97a2c5d4593d7bdfa4bbb478842f7bb771eb5ac147dd2bbea3489bd622d2b4affba59d5d712d0a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd