Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    600s
  • max time network
    593s
  • platform
    windows10-1703_x64
  • resource
    win10-20231023-en
  • resource tags

    arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
  • submitted
    19/11/2023, 17:26

General

  • Target

    https://bit.ly/40AeH0R

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bit.ly/40AeH0R
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:820
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xcc,0xdc,0x7ff9fb129758,0x7ff9fb129768,0x7ff9fb129778
      2⤵
        PID:2672
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:8
        2⤵
          PID:4796
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=228 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:2
          2⤵
            PID:4964
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2068 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:8
            2⤵
              PID:912
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:1
              2⤵
                PID:4712
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:1
                2⤵
                  PID:3588
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4384 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:1
                  2⤵
                    PID:948
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4720 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:1
                    2⤵
                      PID:504
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4928 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:1
                      2⤵
                        PID:4424
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4728 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:1
                        2⤵
                          PID:2156
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2860 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:1
                          2⤵
                            PID:4452
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:8
                            2⤵
                              PID:2584
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:8
                              2⤵
                                PID:2564
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:8
                                2⤵
                                  PID:5072
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:8
                                  2⤵
                                    PID:1516
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5280 --field-trial-handle=1768,i,9476993673629119883,5370331983444644308,131072 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:4420
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:4288

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    216B

                                    MD5

                                    a7e4361c3025f381ac54073af7f02ed0

                                    SHA1

                                    f7ca164437d5d70035dc0d30a0a9eac8118d25a3

                                    SHA256

                                    c8dbfe2cd8db9aa9549dfc7eb5a2a916866219a1b194644efdd05b6344b69983

                                    SHA512

                                    5975045d24492065e48ada8b2e69a995bea6e16b3f6727cdb2bfd2a2c552ea59915b2e75d7ddd80048f27621432017abaa57f75053ab54c6b06b77c0419e570a

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    2KB

                                    MD5

                                    9b86e98aaacbcdbf9458e6b4ed5a6395

                                    SHA1

                                    8727ced7b8e2f2c94c4e77dc906ecb6da8bb4e57

                                    SHA256

                                    1a8af6f1aa2876302cd7637972c66ff519aebbf6d28fc3a6c9d3a81d9573c5c9

                                    SHA512

                                    7fcdc3e28e31229699a24b3a2b09a1d80d9fbc816c87b944fb124b41449ae7ad65300368056133a85ff63cf3695ab6c944167c0dcc32bc7c8c4144d048dc03cf

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    a2f9b69fe86fd96b6a48b4440b9068b7

                                    SHA1

                                    fbd9260e6cce219062c18781a90edb4b16a0cd4e

                                    SHA256

                                    4e7502a484cffb40c6a08dd93117e77078bb44d1049ce42f8e6c48dd7d706c6e

                                    SHA512

                                    f3638c516e237bf52862346d3605a39d7a36dcf9b364ace2aa0a2b7baf2485907d1ffcda814ac982a13cadf0965c49b8393d8f0a0f9cdcb48b90c053283c69b3

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    331da56a570cedd7b137f3308b689353

                                    SHA1

                                    23776520df5ed77597fb1639e20fa61324d39e73

                                    SHA256

                                    1542a3220248906e5021145de99ba2013414e524e454cc53ab3646f9bf0437ab

                                    SHA512

                                    0acfea73a7b18b24d6ca7bbdf4bbeb5c04488971eccdb823cbe46ca5f0144908ce4e62fb21d283ca32b125ec9e0bcc19a662ce16aa87a94d68ae1ae4563942d6

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    539B

                                    MD5

                                    7d088d605bb0c6487498f65a25bfc77b

                                    SHA1

                                    10288d4063382ab7b187370895a4c2ef5a54b14d

                                    SHA256

                                    b70c82a199dbc0ef9cbb1cd9d1b6cb832040e47661a3e88d71b16ab20c34d553

                                    SHA512

                                    cf5a6f51ee728160929116fea6a2c8c7fcd0a5caa6aed0076a076593c6c4226713f9eb289236d78a74d3180662ec02926caddd7d9302d73f54e0cafd277efe50

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    ab6d56a47853c8f47b02142a6437d855

                                    SHA1

                                    10bf25a445caa7e0e23da87814c2b2a3c8b92e04

                                    SHA256

                                    3a5467d1537404e2a2622b1c4a1f3b602bbe495dee7c278cc86fdac29f2455dc

                                    SHA512

                                    2494cce83bd151ffa713f625931d73c3e1aa584796c4d2acd67f91008284fdbb7fedef10a30a4511194d2212396cd3c05c35b9505e2007cefd582a18f03b5860

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    148KB

                                    MD5

                                    e7eef44a0c9e3ff16d165d6731d5a80a

                                    SHA1

                                    d26e59a8d7d7faf1a6e306a368da7c82974c0f6a

                                    SHA256

                                    34c078f0f5eaf6634982ad6ecc8c5c8cee6f61ef3f41e6bf927115b3aa02030a

                                    SHA512

                                    a0a19ee9ac896c953e1590d1a9f68e3f528605633429c451f3123fc241c0e07e1cd0679b67d4dc24b063897bdb9acb97d56990147242e96cb0ea1bd7442dcb9e

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    110KB

                                    MD5

                                    aeaf5f1050eb4cbb9f0249d400c59262

                                    SHA1

                                    28931912b3c7d0419cb27af7a48662d5e630b926

                                    SHA256

                                    91f05cc9a71587515bc190389a67a58d5d493347f730b94ae6e1862db1f41b08

                                    SHA512

                                    0884a2498e371ff358e0786b2f35d45b2aea8e769d14f3ac746deead35d45cd1910ab9b16c4003d6817fb7252fc5d62a54b4e6aa0e3ff2951fbbbdec72621959

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    111KB

                                    MD5

                                    0e3888d54a889d7153a4a89cbedf6052

                                    SHA1

                                    7ec17e55e06295130a15b50240928fb12a7a7b84

                                    SHA256

                                    ef6000660715bf8bec14b146f65980bb1b917d18b875281715641f0571dc7039

                                    SHA512

                                    0219a117b4d8e72c6d56e38e7efd4bd5fd01f4e87df69e5feaf48bc555e047556fa383f978796723cf539f16cb391e1575513743020d2a46554e846ce719b1a2

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    110KB

                                    MD5

                                    96cb5589a48905afa359c8d298f6c71f

                                    SHA1

                                    310460274aded6af2d096f89edebcb842292dac0

                                    SHA256

                                    3ade3e774994bcc1bb505ea5c24ad08c2ce1a8046c42a0140502bef17cfada48

                                    SHA512

                                    1425977060509b92bc02e6a50a7506b7bc3d7f50be9311da066d83e64092c388ac2b8f1568858f36ce43b21ad9c888273e9aa9c711f69ed34b93b6156f90dc2d

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                    Filesize

                                    2B

                                    MD5

                                    99914b932bd37a50b983c5e7c90ae93b

                                    SHA1

                                    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                    SHA256

                                    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                    SHA512

                                    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd