Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231020-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/11/2023, 12:03

General

  • Target

    https://295222458573650.shopeka.ae/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://295222458573650.shopeka.ae/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4708
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae1ec9758,0x7ffae1ec9768,0x7ffae1ec9778
      2⤵
        PID:4812
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:2
        2⤵
          PID:1724
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:8
          2⤵
            PID:4596
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:8
            2⤵
              PID:1200
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:1
              2⤵
                PID:3360
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:1
                2⤵
                  PID:1820
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:8
                  2⤵
                    PID:4932
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:8
                    2⤵
                      PID:1964
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4880 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:1
                      2⤵
                        PID:992
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2600 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5764
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:2392

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        168B

                        MD5

                        6f7746397a02abf38b90a9a68e175c8b

                        SHA1

                        1648a765229ebb57c67d02858a55f84a3f6d09a7

                        SHA256

                        34adbefd5896d8629e9d75cff0309d9dae3ef8cebb5b6ddc0facdcb74d54d7ef

                        SHA512

                        1aadbb45c5affccea5ae7d734aca9fa2380c0918477d2500a65233fa54e922417d03813694d6379f9024f148c372f5448651b09e9d3b73715c82ccda68de72ed

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        e628c68a507bdd01ba2f765633395096

                        SHA1

                        618bb88b6968d19112d71b4c29d8f4dd2f774636

                        SHA256

                        246dede2c600fa8e7875f1b2608ebe3e4d4eaa5dbe794264ec57b8d8f6c5cfe8

                        SHA512

                        5de17c5068641423a8bd1e04f829bd3e15f2ba5f56125265e1cd76b1cb16ffea795dd8413cb1f6bea9033b849bf0473cf5fd4289f6e6138257228fcfaaa6311a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        48491ea4b1d8d47176da515928b42799

                        SHA1

                        6d57c471703e1ad861bbe3f797c8cf9e4c19f936

                        SHA256

                        1178109153c7bbe3ced5e272cd2c846a28b09062c591fac01963f183786f7907

                        SHA512

                        19c6794e030ee6b5493f68aaaa4ae0100105fe9a8817f9bd3d5253f916c7c2aa149374c2f53d6b2c1771b58ba20bdbc5984eac326f85c086551ac08d9b6b2e91

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        d075659d2175f15c60f119f3191bbf5d

                        SHA1

                        5029b85b9fdef87ccb9f33d65dd762d7684d9352

                        SHA256

                        678cb486f73c8b19cd85604e3ab7e8d13c4c339ecf2f160f1927fd9e81c3e87c

                        SHA512

                        7b37ab8de38dcc0a1097488deaff6fbc8d6cef2a31b85a84ade86d2deb7f8da870403aa21ce4155520f9be1c5aa3345cb58a8bc972288221962d2ef7b8360974

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        0d1b9534abc2c1da3e282da684f0475c

                        SHA1

                        4953da5b6168d0b9e7130ed698dcc9fdb851921b

                        SHA256

                        72c1fa149f07d6fd84fa95a906723184ab4f34393f1466734f6b1374ad5404ae

                        SHA512

                        3f6289101b78295bc41c3471823303bc46fcee47b910ad704c60d8782cd6198b41dafdf7afadaf8c7388de664abf161be483dc3344d58d9fa64c49be95598043

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        0b6ceba7d0fc160a302758fec4dca073

                        SHA1

                        56f9ab8f60adb92bee65682da218a10311f99fef

                        SHA256

                        ed96f1dc3c3860ab6e5d4937f8569987ccad8c6bdd20c87f9be483419d17ed79

                        SHA512

                        82ad475f76804c9f34df59a6fc97da985dc83d7b49d970d4f72a8ee19308837277254a546648a8e27c835901240270c56b8f81a95413aded02c391f166a1e8f7

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        f2f852e02d8c94bb876761451236e230

                        SHA1

                        3a1d2b864c6f0ccb3471c8887b10995cc6a20b34

                        SHA256

                        2578d2f101ee277b6888a7a1535f802c6130fb64b48a316ff16bc2bf307ca7a4

                        SHA512

                        b8030f4272a626155f5fad774af6587b99df2072e4618652034944945bb9875dce00ed96ee937d98e065d73d015bec31e78dca844cc5692204a2f5f4c0517a72

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        109KB

                        MD5

                        8dc2869563c689cc6d17af129520e292

                        SHA1

                        78557d4cb82b302552d50339848b2e518117a5b5

                        SHA256

                        1e7a626ef362186eb00c832ae5387f27b5061e1e2d43fb7b9cc40f7399e42568

                        SHA512

                        a1718506fae105f12bdbb71928c0c9c7123045b335b7f4e5c54b599af133412e2a0255c975bee021ecc97eb9667f26082c7e3b87088e7c33f71bc9ce64ac4a90

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd