Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    611s
  • max time network
    624s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 11:17

General

  • Target

    https://docs.google.com/spreadsheets/d/1zn422HuZpf-9pbq3r6Vs9ztBgoByt9ySu5nphQnnRFU/edit#gid=0

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/spreadsheets/d/1zn422HuZpf-9pbq3r6Vs9ztBgoByt9ySu5nphQnnRFU/edit#gid=0
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4544
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7b109758,0x7ffc7b109768,0x7ffc7b109778
      2⤵
        PID:1508
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1244,i,999331670594497969,9244998363220350292,131072 /prefetch:2
        2⤵
          PID:3504
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1244,i,999331670594497969,9244998363220350292,131072 /prefetch:8
          2⤵
            PID:1144
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1244,i,999331670594497969,9244998363220350292,131072 /prefetch:8
            2⤵
              PID:4352
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2844 --field-trial-handle=1244,i,999331670594497969,9244998363220350292,131072 /prefetch:1
              2⤵
                PID:3680
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1244,i,999331670594497969,9244998363220350292,131072 /prefetch:1
                2⤵
                  PID:5000
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5008 --field-trial-handle=1244,i,999331670594497969,9244998363220350292,131072 /prefetch:8
                  2⤵
                    PID:4064
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 --field-trial-handle=1244,i,999331670594497969,9244998363220350292,131072 /prefetch:8
                    2⤵
                      PID:572
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4676 --field-trial-handle=1244,i,999331670594497969,9244998363220350292,131072 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2832
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:1640

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      1KB

                      MD5

                      a0df74b1a2bf8b42ebc8d365858c6fe9

                      SHA1

                      24d5767160bace1d3fa9410faf1b65b48efd64a5

                      SHA256

                      647b0ee7f0e9e5e2fc26600c4fdd4d0a67d845fab29b512691c81f94ce3c48f0

                      SHA512

                      0f55be0c277b2469c4aba271ff53580ebf0d2ef8469bb36aa70cb6a61bafb2c8392665222a7dcd413e9553309cf83a9202f32f3176b3a2222a451559edbbc354

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      1KB

                      MD5

                      838c6acbf7af2184db49ff78ff2d4970

                      SHA1

                      b996270aeb493638b1ff586ac6ba8a073a25a80c

                      SHA256

                      5aeb86548de3e56b732570f596780ef2b91e80542546384b85894042e5af7d21

                      SHA512

                      e447b4c725c5c97156bd7e5d8cc030876bf49088ee9c90cc0f45f624a86993402378fb8b8ef681bdfcac0b167e74264548f6c852778f3ddb2e042593f0f0de5c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      4KB

                      MD5

                      7dab22ec80061b1b13a3276e9372423e

                      SHA1

                      c606c78e0240ab61a81a30ffec521ab36f6f682e

                      SHA256

                      0731a7d573700a257eadf35ea8ad110e96ab1bec3fd8bfb96a9eba9d4a2f2619

                      SHA512

                      2b7bec30ace12539c4f8cae966f531ae4bae7f6da3cabfbb211f0c9d3662c7d6b61e1ca73b65fd825de7a6085594a411e48fcd7155ce15d066e9589104ced865

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      4KB

                      MD5

                      5abf8e914f974d25a93a35733de38401

                      SHA1

                      663d96707a6c379a123c765c6f712caae6a56c82

                      SHA256

                      0067da03af543a5160309d6499e7ec5d1c9a8ce39c688dda3a16c275e9a19916

                      SHA512

                      42e97a6a6eaa888c65ed7e0790b2e948d900360a59168223a58b3ce32190cae17d2f46ab39a23b388dcc6f48bf825490343166c8d473866bffd4b3396d5c95ab

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      3KB

                      MD5

                      97353a201ccb3f3693aae1ea9070c2f4

                      SHA1

                      20a40e3a763963790589b5f6d9d9735195ed9d38

                      SHA256

                      428fdba3799ef37e22a84b3e4987283f078f5f42dc3703c88a0f1ab63d65ad25

                      SHA512

                      a6e88fa651ab4dfb9cd26d7ea95f10d7b02e05bfc6899b47f0040e580073968b2eaa5b251008d254cf7c2ce117e15a0c88c8ed6e83311a28a4526c287b3072a2

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      3KB

                      MD5

                      7a6895ad3d2fd2310bd53de1d26238bf

                      SHA1

                      8a2262603bf97553be6f29d9947528c5eb522339

                      SHA256

                      c5c7269dc56538b09d09e085713edcc93c54e58b63ddffb656610bbd4704d167

                      SHA512

                      f43b9bfaeedc6385632f2db106e7d270e7f7b45115ff280fd1d8d31507b7af21953741647b60df95ea11cda47f0c1dbfed1f7fd343c005acbea7abbef896a7dc

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      4KB

                      MD5

                      d409b587c0c3698c1eee0389e4f59b00

                      SHA1

                      8ae857cb999fa6e8eba8ad12ad09aa13ca10c269

                      SHA256

                      7aa3845b2b0f39d549f77903cdca0951d1a7b9c4a6bb67fd666b61e2aa434523

                      SHA512

                      66d1c4d4d48e1f663b25cda5d5f978fcf7bb026f3fc3a9dc8d0e219d2c3ff9238593b7da01d79d2acfa3ffbef16ded7e2b6cdc97de8ac3c26478be50bc49a458

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      3KB

                      MD5

                      0f5c25811cfa43c64484cb5e507a23c4

                      SHA1

                      980f2696358f3ca4e7dfaf26b9d782c633d15d9d

                      SHA256

                      af61d0c3122dc709766b3e8da8eb981618062ed5b933dc868c5422be0d476316

                      SHA512

                      fdad92faa0a55cc780fb028651ec4d8e72a3f42cb30c2bcb05b394bea234c2b4bf62c648716c4a1d9f44e1bff0e1412b65ad02949f33de2188dded44a594b7d6

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      03fea145c49748dfeeb1448d1032ae87

                      SHA1

                      12168d26d046a8c589b8c9b56d759942cfd3da8f

                      SHA256

                      b6356e2af723e46992d290a378d31244ca995673d802adc7c1422c513fe94c2e

                      SHA512

                      476dbb2d26b0535847e9ec8e9c98c563dd70ad29b095be1b0203ed27807d8961c9097b2bed462acb0c741d8de6f168be50217cb6bf78e45e1499bb31577b53ae

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      706B

                      MD5

                      7983e4e93a17d2a7f95bd8739256692e

                      SHA1

                      77f9f97b77eb8319957295480195f6251db77376

                      SHA256

                      570435dec5d456a90d5ce04259e2c372dfacc2b6c9b07ef22d980b226329c139

                      SHA512

                      5ea85aa02d143b875d0eac50eade93bc225cd2b022fc402dea7e39dea474b432e624acfa51378726e7349555c1de2e3e01766c88e84d9e22c8c58ffc09964b6f

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      8f3894e10438d2848a6745b05e01b08b

                      SHA1

                      dee8a70814c3cd7f03bd52f846ba00437131140f

                      SHA256

                      0bce261dc01a6ed54ccb9ec87d0efb17aeb025a39d2225d16b45549f0cd8a3ba

                      SHA512

                      975afc8ee21935b13bd4f886817e93a0241625864b25478ea858e41785ad929c41a713c6a9664a09fe17ff528726decd9f70ba83f0e9058375317b7feb04c446

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      9c64d8c188d007017075c792988abced

                      SHA1

                      ffd8e6114e9453d3a3cf7504b39345da3e478db2

                      SHA256

                      320c2c5b1c34fac3c238d23eb89cf7faa9cb8be1bdcc5a3fd29a3dbc03dcb99f

                      SHA512

                      306e8574c6fcac884cf4d4a0dbaf05400f5965f58279c7212a9e6a32dcb8eb613df3b0aa3840c0c24165d34db59fa659eaa0640f07c71ee7881e60940946131a

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      8980467fffe95f959bab2b9eb2fd7370

                      SHA1

                      c717074f29a53ba6a1c3b75004a6a6db62a8c983

                      SHA256

                      91fa2b0acba5d5d0bd26fc96d898a2b31883ca09f6bf057bfa1cfdb6234b8100

                      SHA512

                      770bd1c01f5dfe89dd0cdf0a193267cd255efe6f1fc77469100a217353410c3673fb95609ff8e55de382f422b286dbaf0a2b497d40090b6c4576e37b20d55dc5

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      5KB

                      MD5

                      bb1f1d774927d41ef8a0eb32a182f12f

                      SHA1

                      04f5176aaeb91942f36f4ad541161f8f2a6adf83

                      SHA256

                      9c58bc64ca642096dcb765c60c61ee5aa528f58dcc17091157f2e6aec6ee92ae

                      SHA512

                      7571307b04cc9dde408d7a0dcfdc1a4d13d459d32d3fc7e6ad172a10857fd0e241584a3246dfa02fa9c0c50211df2e3f88e545eb0c65919981d217bf47a3f5d9

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      f0ad3bd6de3fd9d6c6b5255e0b5b54a8

                      SHA1

                      a169cb8bcf5e305ff2f4374afc89be1c6ce63123

                      SHA256

                      58d2288cd7089c2b16ad98eca4318210144a9a28ba6a09a2e6ed5ceef2dfbfe2

                      SHA512

                      8b20cf14c3407023dd5e0575e8b407b2e5d35f69ee6618c1481028dda7ba9f876345f81d29997ebba2a9d2888a3bc2fda3d0eeba2042db4a4d880551bc19757c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      101KB

                      MD5

                      22aea9c85053359631da0b8116794aee

                      SHA1

                      8d7f59f7040c3f30667da2797eb6da58f1560f56

                      SHA256

                      07a6b049a57bed5bb2b6f7d258a5f710c6eab686645d0c022d93846eb7ff5112

                      SHA512

                      7c770200b1aeb0cc36d02faf4b0472d027a9a911458cb298155750d683dea0535eceef9cebb6587e1332ae4e43b723614c3cf270edee6983aa28762589e69037

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\faf7923c-01b8-4df6-b439-62428dd51c85.tmp

                      Filesize

                      2B

                      MD5

                      99914b932bd37a50b983c5e7c90ae93b

                      SHA1

                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                      SHA256

                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                      SHA512

                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd