Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2023, 16:18

General

  • Target

    https://mautic.avicennaresearch.com/r/82f5ee9148850ad42c9172ef9?ct=YTo1OntzOjY6InNvdXJjZSI7YToyOntpOjA7czoxNDoiY2FtcGFpZ24uZXZlbnQiO2k6MTtpOjIwNzt9czo1OiJlbWFpbCI7aTozMDtzOjQ6InN0YXQiO3M6MjI6IjY1MWVjMWUwMTdjZWQ3MjE0MTMyMzYiO3M6NDoibGVhZCI7czo2OiIxNDg2NjQiO3M6NzoiY2hhbm5lbCI7YToxOntzOjU6ImVtYWlsIjtpOjMwO319&

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mautic.avicennaresearch.com/r/82f5ee9148850ad42c9172ef9?ct=YTo1OntzOjY6InNvdXJjZSI7YToyOntpOjA7czoxNDoiY2FtcGFpZ24uZXZlbnQiO2k6MTtpOjIwNzt9czo1OiJlbWFpbCI7aTozMDtzOjQ6InN0YXQiO3M6MjI6IjY1MWVjMWUwMTdjZWQ3MjE0MTMyMzYiO3M6NDoibGVhZCI7czo2OiIxNDg2NjQiO3M6NzoiY2hhbm5lbCI7YToxOntzOjU6ImVtYWlsIjtpOjMwO319&
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbca759758,0x7ffbca759768,0x7ffbca759778
      2⤵
        PID:1772
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:2
        2⤵
          PID:3344
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:8
          2⤵
            PID:3832
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:8
            2⤵
              PID:3864
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:1
              2⤵
                PID:2664
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:1
                2⤵
                  PID:3728
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4720 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:1
                  2⤵
                    PID:4792
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5004 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:8
                    2⤵
                      PID:4292
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5028 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:8
                      2⤵
                        PID:4208
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4688 --field-trial-handle=1876,i,16785670014396441933,6106816106888216586,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3416
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:1448

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        528B

                        MD5

                        f40450716bdc8222287714776b6ac5d8

                        SHA1

                        8ccdfab2f901037310c9d5b6ae016b5942f128c8

                        SHA256

                        2cbcf17c9476f17dd57abb431b17eed9a4deef5b4d8cae35c80736d094be6436

                        SHA512

                        23f336ec7f49230e3c6248edcf4255b100f8d949b3edb11cef2935cafed29628d7ebb1e32940687ab1e230e536ea6d8b2832b0a5b46edbb94fb645cc927b9b9f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        79c9bc9ffe222fe7a3265e04778c931e

                        SHA1

                        31249a83521f1eb73fe16188246e649ff709745f

                        SHA256

                        e1f6aa3d44e962496f6dd68c8c384b59af190751dc262dc4ae4e07c070f6f1b5

                        SHA512

                        4e1495d56d969a9c59f6b20a7833a61494a79e8969adf20695377247bfb6e983d815e5ab44dd59f0bdda14252c103bf03d3e996e21ca302f93a385308586e4ab

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        ab351b6a005c4ea1c76f1170bc238395

                        SHA1

                        a85dad543a61120d5c9cf473d4b8265fb9c6da87

                        SHA256

                        c14c712c5a6a1e365dc6f094c2b683b4f68ed3990f9fc3a57f3637c54d0454a6

                        SHA512

                        d2d741af6800740acd70e59206d8589ac68d58292a1b050c2e28f4ba0140beb7333563d8ea72556843de4cd68b73ac1bdf21a4599a743b6e0bb80d6df92fa5e5

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        864B

                        MD5

                        1c661ee60ce504b8263705fbc98a0361

                        SHA1

                        0046caf22080d7399502c0491bdea157dfe82bf4

                        SHA256

                        107ce1d92d0b4c6a0249c4308a34261414cecf8f25c548986d2c34747fa1479e

                        SHA512

                        b930e2d6b9ea0a3489ae0a13c100fbcf45270abb77168f38a7814a9d8315e4128db55e68d5da7c4e070663a2ede786950fa52e828890f92492ded85f0bb018b3

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        cf0536f0044e03ac33e3cfc21cb2d602

                        SHA1

                        a0e289de44a1e415f8636b4a4e73271c704a0d5f

                        SHA256

                        708b606b666bb463e5b7996bf84ea8a0639ac145f897c84e07b008f9c9634fbb

                        SHA512

                        c7a0ab29f76160f75551fe0c327cc83b3c98a0e86636849bc0352f000fae8cd6c166d313f266f3332e94df56f36e05e57376713a96b2a5042a7efa0d9264729b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        f7afa6a2ba6a7f79eed8b0fa84a7b2e4

                        SHA1

                        85baeb48b828e52ce2887f07b932902d26d1d7af

                        SHA256

                        63b8dad74fdfa1f9eea9edf5d28154c74c1f62ecc2fe19c958b7477448a12bb2

                        SHA512

                        69fdc343e11c085e5ed5aaaa1f9c205aa3b6a42ee695e8b29988ab40999684831f4d460c12bdc9ad4ed92a354b6017fb1c42b23323c53245e6a5565197d53293

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        101KB

                        MD5

                        e6e5ad021e5eeadb2ae89c1952becc7a

                        SHA1

                        30e73d8869da664725fd3bd933c553c2130ede57

                        SHA256

                        6086a211bd0cf572c48a93cf0f2a13a12daf2c22b0a72dae7c47ae99cfc0becc

                        SHA512

                        aee600f2f8182df38b9f4804a51c3dd42623ae686e423ab44e59a1d02466b3529439cda8e0550c94595b9948f530bebaa51555fc194d0e31f96a4f1836031d25

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd