Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

13/11/2023, 15:38

231113-s25jlsdh65 1

13/11/2023, 15:35

231113-s1ea2adh56 1

13/11/2023, 14:35

231113-ryaz6adb5s 1

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/11/2023, 14:35

General

  • Target

    https://lp.constantcontactpages.com/cu/dmXOzj7

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://lp.constantcontactpages.com/cu/dmXOzj7
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3360
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d88f9758,0x7ff9d88f9768,0x7ff9d88f9778
      2⤵
        PID:3576
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1628 --field-trial-handle=1876,i,9084486327737074665,4544416378272610093,131072 /prefetch:2
        2⤵
          PID:5052
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1876,i,9084486327737074665,4544416378272610093,131072 /prefetch:8
          2⤵
            PID:4704
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1876,i,9084486327737074665,4544416378272610093,131072 /prefetch:8
            2⤵
              PID:2556
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3180 --field-trial-handle=1876,i,9084486327737074665,4544416378272610093,131072 /prefetch:1
              2⤵
                PID:488
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3184 --field-trial-handle=1876,i,9084486327737074665,4544416378272610093,131072 /prefetch:1
                2⤵
                  PID:5112
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 --field-trial-handle=1876,i,9084486327737074665,4544416378272610093,131072 /prefetch:8
                  2⤵
                    PID:4312
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1876,i,9084486327737074665,4544416378272610093,131072 /prefetch:8
                    2⤵
                      PID:1668
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2832 --field-trial-handle=1876,i,9084486327737074665,4544416378272610093,131072 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4620
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:820

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      72B

                      MD5

                      961d4c98bc43b8db885e92f8b168de5d

                      SHA1

                      6413a1673c02a72dc5bad2a295b2943f0d7da7a2

                      SHA256

                      3b53417d5618c1120bf46fe6633281075226e36f0ffb89f4ecee2941a342311d

                      SHA512

                      a00c89599b31d36a49a424b9ac585940ad28887341b9449788d0b9e67a49fb860f24933f1f2740cefdc51a85e7e5396b367ba4630e1235532549ca21f3e571a3

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      1KB

                      MD5

                      eb044644894cd5ce5af71c008431bc5f

                      SHA1

                      27d23e3837fbb75094f2091e735a06fda7c2b37b

                      SHA256

                      12c2c89aecf0ef8f934eca0bd6c63fa846346c8bba71b75900e18d375936eb5c

                      SHA512

                      73d06770f0c57e702ba4cb815c96aa937e378ff9f62151b12219117295d4778c6c4ebcb418fb0a8c823e0a115d951094a79945956903db17c7427f0acdffa910

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      539B

                      MD5

                      97efde6414a4a1bd76ea7b42b6d491af

                      SHA1

                      56934f55eaefa78733e686c5a762e52cc79c6ee3

                      SHA256

                      5da6ffb8873057f2484a188998db370f303e41fdf350136738c678162fc1f159

                      SHA512

                      f12b1129e8820ec862487c31962be75497eba7cc7d5b51a5896c0759aa8db611330fc3abe2c2d015172fa001566b9e3e94a4cd38f46c2505c27e71413c24596d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      5KB

                      MD5

                      f99e8df28b4329c6fb8cd06f4e5a4a75

                      SHA1

                      e9494f1a36f2951b9d0a9e1d67acea820b6f965b

                      SHA256

                      56cc1f8c022a627ff55be503d6b33ce2ec8e1e17919b96c048626a6f46481c31

                      SHA512

                      413bd2dd1345780347609e476202aa8d79227549752c706b074e93618d6ccf558df456d21b71bdfa9fecc706e4c0cb6ef545aef9a477b3e0acca513e3e6d0c27

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      5KB

                      MD5

                      8c01a535c72b624107226617670f8ed7

                      SHA1

                      458dcefb69b2b66cc739978959d4dc48e8eb4b89

                      SHA256

                      c44f4c1f7e3654ecd4eef07207379a6385779548db967b05e595dc8cb7e7ebcf

                      SHA512

                      152d15b578154fe213d9cc25f63dd9154c3bd610ce8fe41a193db5ea9a36ae8175dabf661db32d4b69aa4875b3bc2a0aa210ea03ee0d132f857ca8863f141aa4

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      a0ccb76c21539f3f7e14aec848988ae2

                      SHA1

                      8b3cee85b42b8db24866acb6158368c5a544eee0

                      SHA256

                      3f7551d9d059bb91d9610c1e305516433491a826d03fa34baefdf99007ccb54a

                      SHA512

                      bb20de82bedf30161ab9398102a2c44b25281a3daf2571fc0cfbe3b756cada78eee3a430a8b0f13d4d3eeeba1df86f877910ef40ff8af76fd94037f01a667d4a

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      109KB

                      MD5

                      6ce43508c69e4ecc96661e46b2fe6788

                      SHA1

                      d9d700804772b0104a0956d0b5c5a376e9258da4

                      SHA256

                      538832ee7d60ea8153ca93496e3c20192def4e421399d69a1c4aff5d78d67bfd

                      SHA512

                      ef367728edb207b31c391316b9f62bf1ec0b2a8902e70049d5b1fd92cc54a1f0b685114567cd6cc110606ef7461d5c19ae42db9e6805edd036540748e6491e0c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                      Filesize

                      2B

                      MD5

                      99914b932bd37a50b983c5e7c90ae93b

                      SHA1

                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                      SHA256

                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                      SHA512

                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd