Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    173s
  • max time network
    179s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/11/2023, 17:58

General

  • Target

    https://www.virustotal.com/gui/file/38c88eddfbc88ce8efd34e16c9fc9008ac20b066925c31ef04f78979e966d762

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.virustotal.com/gui/file/38c88eddfbc88ce8efd34e16c9fc9008ac20b066925c31ef04f78979e966d762
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3632
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf2799758,0x7ffdf2799768,0x7ffdf2799778
      2⤵
        PID:2688
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:2
        2⤵
          PID:4464
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:8
          2⤵
            PID:1508
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:1
            2⤵
              PID:840
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:1
              2⤵
                PID:2496
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:8
                2⤵
                  PID:3700
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:8
                  2⤵
                    PID:3084
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5568 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:1
                    2⤵
                      PID:1620
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:8
                      2⤵
                        PID:2476
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2204
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:3052

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000019

                        Filesize

                        184KB

                        MD5

                        990324ce59f0281c7b36fb9889e8887f

                        SHA1

                        35abc926cbea649385d104b1fd2963055454bf27

                        SHA256

                        67bcedd3040fc55d968bbe21df05c02b731181541aff4ae72b9205300a4a3ecc

                        SHA512

                        31e83da1ac217d25be6e7f35a041881b926f731fff69db6f144e4fe99b696a31f9ab7766ca22cf5a482743c2a2d00a699ca2c2d67837a86c471a2dd3bed9ea1f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        1KB

                        MD5

                        7e1290cb433b39a96bd7fe080276a473

                        SHA1

                        6bcf16708ae26d54bb6bba148d0c55ddc2b71d46

                        SHA256

                        e37765a631632474e1370b13c3a5e93e156bfa03e84c99d60fae933c663cfb91

                        SHA512

                        d9ba8e3796da042383caf32babee58fa7a594cf96f124d65e5cc24ffc506fad496920b5057c9ba86fbb9ba05f7ee25bc7ffcfce53ad939f5c3236dacd081237f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        29e2243d0e1b27792adfe63f6ae0019b

                        SHA1

                        97c0d694ccaa9a861c4c3383400be37c99f12175

                        SHA256

                        80faaa16943e63d1c30fc5899bfd065b782fa3c20069c54f386c80be07e06e01

                        SHA512

                        000bac8a7cad220033151a0166b6e0262f92c1e0761fc7dffe4c1c971e0e1621ca816f8f219d2ea69bcff04a731ceb0ce8dc0470e13b0c270b827903e3341e6b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        873B

                        MD5

                        a199fe9642c1ed0c640473c591326e9c

                        SHA1

                        4d970bb771b9eef741d8db5b328334046b74eb6a

                        SHA256

                        f9c6965ed10c893f05c4ca53bca24266275ceebe6a87e14d2a3f2ce6830a0591

                        SHA512

                        b0e3d7cdefa53517a12ba592d8b44d517da10b7f42fdf23e1da166afbdb4def26a87b72a5157eb5164a9c6252eb9b70523b9415ad415d31c28c1fb64b35b898e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        4592060a1b5dc80ef278b0c61b7bdf15

                        SHA1

                        df7fd7e370d61a5727061731ae4c13b42a713888

                        SHA256

                        8a0c5ead2a1e56a1d30df148785273a8e3446728061a03c874fec959394596ec

                        SHA512

                        de55e77ab70854cb07d1f1d1ba58c4c65a7d466a4d2140e18e140bc3424349ae3d05ad804e28fb6921e686201063ab4c8b6645b4d0ca4f05fb05a646d29f2703

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        582d3438f23d0241a90afdce3a2fb4b3

                        SHA1

                        7a73cd343345f0a7c57fced1568365b88d2169f3

                        SHA256

                        1f115e7d896f03196e39adc682d415e8f15a7ffe673e3e6aa28409f15803f95e

                        SHA512

                        1566b52dad5511f8c45597f5907634892b71f61bc6b5c315bff38ab852e4c9c91fc300bbde86ee12f4907c0725e0976f63be70915bd8f17ff0dd048d52554374

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                        Filesize

                        72B

                        MD5

                        dce1c862fbbba61942b96db5378c5ca7

                        SHA1

                        e8575c0089294e4e5a929c09f09dbbbb4988967b

                        SHA256

                        7c149849a9af3ecb38da5f64dfe67db7783dc7a1d6535e1ab601cc72b45d6b0b

                        SHA512

                        b96db5c69b60e172fa5d938ce2251469543bb5320bf0757fcc6c06c75c5f4352b8031de03fec5b71031043ac286aba0fd0a6af88ff991427bb5bfdb63964953b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58be69.TMP

                        Filesize

                        48B

                        MD5

                        0bcd4d0ae11d973f13a5d0f9f7756e45

                        SHA1

                        fb27dd6899e10c3a807a72d4a43016129f870528

                        SHA256

                        975217bd0e4c7c051741376e119609081ee8fa707e71585e6d61414034fe804c

                        SHA512

                        1bbfc8a28694e4803c3069d1c576789f7ea484288a327205e84adfebbbe3479f840814dad25f8f7355f6f2ba12c3f4c1ae709a2a100dbc9f8dae334e4f56401d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e2c288d0-9a4d-4e86-9213-80464fb0e186.tmp

                        Filesize

                        109KB

                        MD5

                        edc2b65b07c9065c0bd7b04b747a17dc

                        SHA1

                        35408dd6919d43ed6e05654c6cb08a321e205182

                        SHA256

                        b8c5285e96399dcbce142d822365721160a071fc1d82041ba6a38c343c94a283

                        SHA512

                        d456180e52037c5269d8106bb85fd5c6f12e6aa54b0db713f31187df852ed7bf26cdd4564d30ca996dbd48dd857f4fcf37c26e1deeb885e960d8971558c616af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd