Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    69s
  • max time network
    163s
  • platform
    windows7_x64
  • resource
    win7-20231023-en
  • resource tags

    arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
  • submitted
    24/11/2023, 19:47

General

  • Target

    Nightmare Demon Castle.exe

  • Size

    99.3MB

  • MD5

    9f22aa5c19af4f7fd4d8f0fc38a5e88a

  • SHA1

    84ee006b052df05e7a014a3e25de0354abf47ef6

  • SHA256

    28ca10ccb477c38815a1348c2a58145e02d8a51bcff27e27ce68f6385e9df67b

  • SHA512

    db009d16544be880bcb4107fdc0629a2228b345e629add97b4a8d7dfce77105d96a698330b8d1d44ab78c3fdced9c622c6ae11b7de63a9d5738ef13339840b8c

  • SSDEEP

    786432:wpNBUoGjHskz7LPY97RIJYg/bYGc2RvAygikPccHpuS:uTUoIHskz7Lg97+6g8/2Jda0S

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 39 IoCs
  • Suspicious use of SendNotifyMessage 35 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Nightmare Demon Castle.exe
    "C:\Users\Admin\AppData\Local\Temp\Nightmare Demon Castle.exe"
    1⤵
      PID:1516
    • C:\Program Files\VideoLAN\VLC\vlc.exe
      "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RequestWatch.MTS"
      1⤵
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2752
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2852
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef5db9758,0x7fef5db9768,0x7fef5db9778
        2⤵
          PID:1056
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1588 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:8
          2⤵
            PID:1828
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1436 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:8
            2⤵
              PID:1960
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:2
              2⤵
                PID:1920
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2316 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:1
                2⤵
                  PID:1948
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1584 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:1
                  2⤵
                    PID:776
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1496 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:2
                    2⤵
                      PID:1544
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1268 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:1
                      2⤵
                        PID:1476
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1288 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:8
                        2⤵
                          PID:1576
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2632 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:8
                          2⤵
                            PID:1780
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3712 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:1
                            2⤵
                              PID:2080
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3456 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:8
                              2⤵
                                PID:2632
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3644 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:1
                                2⤵
                                  PID:2592
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3728 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:1
                                  2⤵
                                    PID:1140
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3576 --field-trial-handle=1476,i,3012860605533751034,2114412737869611414,131072 /prefetch:1
                                    2⤵
                                      PID:1952
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:2736

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      344B

                                      MD5

                                      5079ac91d41c5a49b9603977829f9ee7

                                      SHA1

                                      f4a2859dbda3009f828ae731955c7b62fcc2a377

                                      SHA256

                                      920448601dd8811b15e40a0d6ce31021795a67bd487a2271078041db17e4fc58

                                      SHA512

                                      7868e4277d779b22a57a7c2d5a4f339fe6733d7741567aa82e910ce8bddfb8e1c556f610da23f085a02e5e691dbfdd73fc6594f92f1b45ea69f67469f4d10467

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                      Filesize

                                      344B

                                      MD5

                                      45b8efe26ba5760ff78a981401f7c919

                                      SHA1

                                      8eab2df0d90446aa354118c58d1ee9f5fcbf7320

                                      SHA256

                                      9a9fd568e6fbb290f9f879d07b2c0cd952ef606b0533b0c1e59834b4f85cd4e5

                                      SHA512

                                      dffe8a6bce1f3a71ad4cb25b49357247b679ead8c3ad7cd627bbea5912f613a0f3257c489cb5bf5675077ad4f70a3bc91740bc9c3bc238b4aa1c7e53f66b8b7c

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

                                      Filesize

                                      85KB

                                      MD5

                                      f97ff9f2fc4160549c9d8aefb80570c3

                                      SHA1

                                      02afa33339e1f35279f084cb62189f82934323b3

                                      SHA256

                                      076b12a774b8114a77c6b406e9e65a4496f7f28dd392642602619e4430c0c152

                                      SHA512

                                      cd83f3d112fa41a46d495487fdb5f4f05b08722c6fa048f8916a7b1f5c82794489787258031cd9d272911f5cc4d437e1254cd13fb6b13edd689debbb8799ace5

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000f

                                      Filesize

                                      80KB

                                      MD5

                                      64a7548628717106d5d50c2328ed2de5

                                      SHA1

                                      bf25a7801268ad6f7f8e406d1b8e71c5ff790ab9

                                      SHA256

                                      63a409fea6a81838b53432c15b55ee979bb2da86117b089fdd633a4b81f3f731

                                      SHA512

                                      d4bd075c50aa311fc4e6ad04a17301c3a371063a6dca086115c917776b006e8e19bd6089b69a84d840f4837712b1066184ddc42a7b45b91e774bd52de240f01e

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      168B

                                      MD5

                                      1f7323099b7fdd516f757e738c221d72

                                      SHA1

                                      c3ae574ad5b9149c3ff7e67e051970a986c068b1

                                      SHA256

                                      4078ec36ae9905ff9c852b9af23ce0540156b39c758d947dcd4b7df70e4395b2

                                      SHA512

                                      a1b3a8d25ebae91b31b7795a564d805d39cd4963162b27fe649a5ef1cfb31e79ae016855c69a867d8696b14d6acdc10e8f23beb0a00727a6a80535665acdf518

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                      Filesize

                                      264KB

                                      MD5

                                      f50f89a0a91564d0b8a211f8921aa7de

                                      SHA1

                                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                                      SHA256

                                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                      SHA512

                                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      527B

                                      MD5

                                      d9593bab0068b505febbcfc50aff9e67

                                      SHA1

                                      a3ea2a9b40b66a0a9b323c1934e0594844d6886f

                                      SHA256

                                      b7cace7e7bbddaf333e4a47c4888215499fdf26c318714e322dd14dbdf36a710

                                      SHA512

                                      366433fd05b70d3f267bc3f63006850026c804acc76f060859789837bc627712df4c74a47ae3234d00518f0721c42f26b7ef642da63fd97f4d3882e0fd2953f5

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      4KB

                                      MD5

                                      cee1a876fb6305b28ca2f7f3ced37923

                                      SHA1

                                      1aa8645edaffaf19a087510df9c56aa2fe26b783

                                      SHA256

                                      7b834cc7725ff2f5689e5ea7ccf1aceeb5aabad19c0e77c1d3b68fc9ad3631f7

                                      SHA512

                                      fac35ffc69fba873a4c1dedf38713c834bf4d1b78e029092f13af11f71534ef9c915abbcf6ff528ea7e2618fde404f8e4de68babd11fcfef07677ad9dc6a2d12

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      4KB

                                      MD5

                                      f7a3729a29672a3413f3c4223b674cbe

                                      SHA1

                                      733029859764d18fd6d53800d58978b3b0cf7b39

                                      SHA256

                                      c936971cfff48996296b9f95ecbfe612c49ef12625114e7c2d670f5ddf2c22c0

                                      SHA512

                                      d0947a393b14531c526fbecf6d0a6b85d9301312ea0a807c985913c2770151d2122f27407c6ff71e0c77089ad09d9f7caecf7e6754657ddeb185c7ef69c38790

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      4KB

                                      MD5

                                      3f956fbdfafab0f4e6fed716df93078c

                                      SHA1

                                      40e756300274fa0827d274f25de971051977bb39

                                      SHA256

                                      81321c9d9efbea06a5b2394a9fb83150a7dfc6ca41754a3ca93b8b3dad96b07a

                                      SHA512

                                      af7169df2827854c30cc8391aa96fbff8c1aa334933630196ea797818a59bdba8fb0cbecfbb2d37293752dd53f3372ef149064043dbc2e9dfc52092db0636fa4

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

                                      Filesize

                                      16B

                                      MD5

                                      18e723571b00fb1694a3bad6c78e4054

                                      SHA1

                                      afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                      SHA256

                                      8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                      SHA512

                                      43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                    • C:\Users\Admin\AppData\Local\Temp\CabB270.tmp

                                      Filesize

                                      61KB

                                      MD5

                                      f3441b8572aae8801c04f3060b550443

                                      SHA1

                                      4ef0a35436125d6821831ef36c28ffaf196cda15

                                      SHA256

                                      6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

                                      SHA512

                                      5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

                                    • C:\Users\Admin\AppData\Local\Temp\TarB63A.tmp

                                      Filesize

                                      163KB

                                      MD5

                                      9441737383d21192400eca82fda910ec

                                      SHA1

                                      725e0d606a4fc9ba44aa8ffde65bed15e65367e4

                                      SHA256

                                      bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

                                      SHA512

                                      7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

                                    • memory/2752-7-0x000007FEF68C0000-0x000007FEF68D1000-memory.dmp

                                      Filesize

                                      68KB

                                    • memory/2752-8-0x000007FEF5900000-0x000007FEF591D000-memory.dmp

                                      Filesize

                                      116KB

                                    • memory/2752-22-0x000007FEF45C0000-0x000007FEF566B000-memory.dmp

                                      Filesize

                                      16.7MB

                                    • memory/2752-23-0x000007FEF5AE0000-0x000007FEF5D94000-memory.dmp

                                      Filesize

                                      2.7MB

                                    • memory/2752-21-0x000007FEF5DA0000-0x000007FEF5DD4000-memory.dmp

                                      Filesize

                                      208KB

                                    • memory/2752-19-0x000000013F280000-0x000000013F378000-memory.dmp

                                      Filesize

                                      992KB

                                    • memory/2752-14-0x000007FEF58E0000-0x000007FEF58F1000-memory.dmp

                                      Filesize

                                      68KB

                                    • memory/2752-26-0x000007FEF3A20000-0x000007FEF3B32000-memory.dmp

                                      Filesize

                                      1.1MB

                                    • memory/2752-0-0x000000013F280000-0x000000013F378000-memory.dmp

                                      Filesize

                                      992KB

                                    • memory/2752-6-0x000007FEF7890000-0x000007FEF78A7000-memory.dmp

                                      Filesize

                                      92KB

                                    • memory/2752-5-0x000007FEFB1F0000-0x000007FEFB201000-memory.dmp

                                      Filesize

                                      68KB

                                    • memory/2752-4-0x000007FEFB380000-0x000007FEFB397000-memory.dmp

                                      Filesize

                                      92KB

                                    • memory/2752-3-0x000007FEFB4D0000-0x000007FEFB4E8000-memory.dmp

                                      Filesize

                                      96KB

                                    • memory/2752-2-0x000007FEF5AE0000-0x000007FEF5D94000-memory.dmp

                                      Filesize

                                      2.7MB

                                    • memory/2752-1-0x000007FEF5DA0000-0x000007FEF5DD4000-memory.dmp

                                      Filesize

                                      208KB