Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1802s
  • max time network
    1698s
  • platform
    windows10-1703_x64
  • resource
    win10-20230915-en
  • resource tags

    arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06/10/2023, 15:14

General

  • Target

    apex-legends-1000-apex-coins.html

  • Size

    82KB

  • MD5

    3a0685ec81eca4c7114bf3ea043f982f

  • SHA1

    0efcaa9b0ae21cfa9ba2dc12a1bd4a92ce6c9cf1

  • SHA256

    9601b58a0ab717218a0ced26d48017b6c85f2c0e44474713fe06adf429449479

  • SHA512

    212f846f28b2b8733c405da454ae2c703a3c3fb6d9f32d3f47d2f4ddace7520f8963339aa29cf9df54b640067f68db32f279c245e5f309d6187895dbc3ae5d05

  • SSDEEP

    1536:rv7C3kAyq3JM+r3LKzubICFmxKesvxbyyZ6UQ4NwrU2YFVLd5QUShaU8x+tf6mIj:rDjA93yU3LKicCFm7U26lPQUYyx+kmWv

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\apex-legends-1000-apex-coins.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3256
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa35be9758,0x7ffa35be9768,0x7ffa35be9778
      2⤵
        PID:2088
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1836 --field-trial-handle=1812,i,326918151889364828,15627077684621259926,131072 /prefetch:8
        2⤵
          PID:4568
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1812,i,326918151889364828,15627077684621259926,131072 /prefetch:2
          2⤵
            PID:3924
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1328 --field-trial-handle=1812,i,326918151889364828,15627077684621259926,131072 /prefetch:8
            2⤵
              PID:5092
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2832 --field-trial-handle=1812,i,326918151889364828,15627077684621259926,131072 /prefetch:1
              2⤵
                PID:4364
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2824 --field-trial-handle=1812,i,326918151889364828,15627077684621259926,131072 /prefetch:1
                2⤵
                  PID:5108
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4484 --field-trial-handle=1812,i,326918151889364828,15627077684621259926,131072 /prefetch:8
                  2⤵
                    PID:4288
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4132 --field-trial-handle=1812,i,326918151889364828,15627077684621259926,131072 /prefetch:8
                    2⤵
                      PID:5044
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4252 --field-trial-handle=1812,i,326918151889364828,15627077684621259926,131072 /prefetch:8
                      2⤵
                        PID:3356
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4132 --field-trial-handle=1812,i,326918151889364828,15627077684621259926,131072 /prefetch:8
                        2⤵
                          PID:1148
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4356 --field-trial-handle=1812,i,326918151889364828,15627077684621259926,131072 /prefetch:8
                          2⤵
                            PID:4352
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1564 --field-trial-handle=1812,i,326918151889364828,15627077684621259926,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2468
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:4884

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            bd318989648cb47235acd154bbf0e803

                            SHA1

                            d80fef70e5eac385bb433c84df1e291070dddef9

                            SHA256

                            2f64cd0ac600b760779544ccaaa29d270601e5a8e6d07562a1d3efff6a341c9c

                            SHA512

                            05ed2b72f7b00159b12156768beada6f4a029c65b0b1c860dd9a5dc21336295226218bd42489870092327de010e7960598e6b95d0c7bc16406c6be9372631143

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            04fc4ebfba3eaa9df910bc05053fc79e

                            SHA1

                            2a64cac1288d61901d50708cdc607c904fb6c40a

                            SHA256

                            f1e610a501a2dd13afea25e7e0709393ec8caebeb5cb1dde964ac48dc3760c7d

                            SHA512

                            a55fd85f2754b60b4baadb71bb08260677887cc75980288b0eaea333e2791c986dd8278de16471af9b723430ef85a7798d9443881621308959318bcbd5a6691c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            b24237b8e14ffe973afac69ccb7400ab

                            SHA1

                            83f1707fecc784e615dc01523d2f8781be5d392a

                            SHA256

                            8c0dc5965c700e0d77fb27f0316d385faead94feb9b7df324ced7583dc0ccc53

                            SHA512

                            bfd845efeb06a736877c110191eaaad48bd6336e627faf7119efd8568850ff1daab7b9ac6f83ccec9ec8577ca26d3a702b39820d225cd8c147dd6f36a8c3211d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            104KB

                            MD5

                            8c8aa500e0a64422c26e02ee852fe410

                            SHA1

                            4cefa3bb401bae173791d8824b178e84a17cb797

                            SHA256

                            70a4281e971166cb60609c957604f8db3457f2e9c0f3fc6c786f9485f67c9636

                            SHA512

                            b7b9b768cb3fe7a9500994742d202a77e0e4a0ac9f0e35d40fdf79678548b86de0dcf7a5fa4d02dc4f15efcf32bebf6bd02011133212d066eea4c84b19919995

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            103KB

                            MD5

                            c6f01bd0a58d0091606e39f1c17a870e

                            SHA1

                            4189cb45417c5720848bb5e5a88258537a1b36d8

                            SHA256

                            64729056dac9b8f061518bad566460db7482a7c0587104d9b64c7d2a56f18099

                            SHA512

                            620ea156e9d8171fa5c071eaebcdb43e7a4e5f3bde8cc2551dbee4feb3d0e94baf5abd45dc9ddd537769842073dbd6f0e1c084a1e7b878026918453387f05684

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            103KB

                            MD5

                            513c11a501005c9188fc12df45d24310

                            SHA1

                            ae79bab998a6b916fd1c0f8113fef935b3bc423b

                            SHA256

                            623e23fa608a4c6892786bc9c17bee4b501f9a633f34763fbed8457ba1391387

                            SHA512

                            301d6ea54155331c6248ae1e59b2c5f7edec9c86bb27fa1557cdc8e658ee81d989750812812414f79ed572089d831d5972fcfb02e74dbc6852d55bf854072e63

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            122KB

                            MD5

                            bd5354b939f8268fdb364bc7d92a6e62

                            SHA1

                            e0608ed65b1da07636ba8b9a49d98196eb6f570c

                            SHA256

                            0a81095b3d4ce490f81ee5f8dd1f0a2090601c885a98a288c50c85c0aacbcfb6

                            SHA512

                            06cd0651fc2f24783931bf6e98ae98c214c59f6fdac4f4c74358357587d61e7880139a330108d94885ef3c5e4c4466bb6ae0290768f531d1f24cfb1c19b8720e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                            Filesize

                            93KB

                            MD5

                            024a152117ea4961c104c24a673367df

                            SHA1

                            b5b209024bb62f84078f70e93f9c73bb1125e606

                            SHA256

                            9df0baa316cd5134e0a34d20a898585f05872359c5a772f328927f414044245b

                            SHA512

                            9b5f058548fef4cac81abbcd19761b42e0022dc3307de45d3c50fa63cc1bc5513e89fc772e2151fc2585c6b7644c9d8bfb55e87d5e41216851611f3662242a28

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe58d5ba.TMP

                            Filesize

                            91KB

                            MD5

                            0438ff20df7bad6d00ecdddb273595e2

                            SHA1

                            fef7b2f13c71e3b4c5ea67ed2997c4774fc0024d

                            SHA256

                            783b81ecd8c1143dc5fa8359d9cd5c30e86691e57875e2cf93ee4fbb04abd1e5

                            SHA512

                            89f40bcbe9af13d94b801f835b6f8c285ce310cc5ebcee2ebe60ab066ea985ac62b9032b85ca9bf8352c1f90a0fecf8c6890eb7dd944118d81603226df75040e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd