Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    299s
  • max time network
    275s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/10/2023, 10:00

General

  • Target

    https://egyptmineaction.com//organisation//organise//lasenassss//amFjaW50by5jYXZlc3RhbnlAZXZvbHV0aW8uY29t

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://egyptmineaction.com//organisation//organise//lasenassss//amFjaW50by5jYXZlc3RhbnlAZXZvbHV0aW8uY29t
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb06049758,0x7ffb06049768,0x7ffb06049778
      2⤵
        PID:2412
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:2
        2⤵
          PID:4872
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:8
          2⤵
            PID:1756
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:8
            2⤵
              PID:4272
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:1
              2⤵
                PID:2340
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:1
                2⤵
                  PID:5072
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:8
                  2⤵
                    PID:2536
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4644 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:1
                    2⤵
                      PID:4984
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:8
                      2⤵
                        PID:2348
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5524 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:1
                        2⤵
                          PID:4360
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5344 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:1
                          2⤵
                            PID:3160
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5336 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2600
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:1892

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            192B

                            MD5

                            9af228502da22ca25e07ed314b10948f

                            SHA1

                            2f47957fda5b79a442ec64aa4279079445497131

                            SHA256

                            36187a390f29607dec63fd1638f039b21c4d7a980ddf3548f51ec814247b0345

                            SHA512

                            afa2fbbc8407d753746e176608f82206c7189e4e76e616942526caa61f3d59f620ac87fc721e1037695ee28dccba91600b28026b130adeffd4274ef86a748ab3

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            fe43ac5d4f37850bf09bd60d76457fc4

                            SHA1

                            444e5e2a995748adf8c9b029a084243b8d450242

                            SHA256

                            7cbfa5edcadfaf52ab496f468130b5adc7f13191fa1873219f3e2376c9a5a589

                            SHA512

                            65a7b9402375124e351f658f9791fb668e84e794a98639ab303456011e2cc5ecb3eea88deed3907c965269b0565734275f04e731dfc65b93b5fd90cae587c70a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            42c315afb53ce32daedaa56916f06265

                            SHA1

                            f565213b5d255e2aea6a6143e0525b35788a91ea

                            SHA256

                            c34b1ff1a7c5cc7601d209a68298eafb8ed19a59a4346ff63c3c588cf17c076b

                            SHA512

                            6b6f407b2f3ab7851d1582a584cbc2215bdfbd99747578b98ebdc11db6dd2b8eef1ed61af228bd80742f6303458696f57eccfdd2b660b460a176d7ecf7f3cb64

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            4e2306043462736deb5318063b382a36

                            SHA1

                            bf81e63bfd7818cb448802a70d388df18693813a

                            SHA256

                            b84241b72237571357861e63f809293e72fb32914733f9b8e7f2c63a911c5aed

                            SHA512

                            0ab07743757ad2a5df9bfc4feb21751771a6d4ba419779ba7ebdd38a88cbee46b45bd5923679b0c80d882e4f128225d6eb20bfe206f80440b9dbb42afe0915e2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            047e856425a2a895605e70a3a507e605

                            SHA1

                            5c184453a2a4b69aefde70544ef003c7e155fff4

                            SHA256

                            f0f9e2f1d1a6f58fa0166a40b88016696e3503fe13f24569dcefd806093fbcbe

                            SHA512

                            f68939d787cd12dd0485a81eb284223edfe6ecc15165cf638a0a6db8ee43d9b626a65ea4fd8f4c65ddc00d816492248d67af06e2ee87d3ba0f3d61e5e2a7e0a5

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            46778c9de3a8b46d4d2e12f90b985a51

                            SHA1

                            dd8a15b8804df2f0d4a59bd8371619c29dcbaf08

                            SHA256

                            31ba05ad16ceffbd3a45eaa4e1fd4066f5845d6b6b8b2f312e656e81cfe79823

                            SHA512

                            b52cb02b3245d956d07ae0b3d9c04a6cf5bf40a1edbf5a5cf6ab47df4114963093d8cb0c9939a091ead48ff4c3e91def903c0168ed99ca4d96b200c56d76feab

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            eae985babf19ef1e1206de538ef5a0a1

                            SHA1

                            a9f930cea5eae56b2af3276951fe11f26c12af0a

                            SHA256

                            0a1d38057696e3419b8407fad8fab186eb6c8adb398104008d6e81bf600e2341

                            SHA512

                            3e4af5ba05b94f69ac62f9d4e07411349745923cb9209e87cd630d5abe78c3b673cf9ef69807b57d4da65de6eda4b943722cd67a61ec8e5540cd392cdfc3bc92

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            109KB

                            MD5

                            68de546e552d0089b9dc3ebf43b28b64

                            SHA1

                            c4c1962fdb7921d64830a21d39020f84bf643bb2

                            SHA256

                            5e994c45a773776cdd3028a8a9aee3fba5c3fe04e070cb0ecd4b3077cc1dfe08

                            SHA512

                            8171fe750b8a7cec17becdcbaabae8c49d0a5cf16ef3d57181312213d244db382c4120336bb958ea22f4c76e883cb88c1247abdf252672d9b85d7bb33745d33d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd