Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    177s
  • max time network
    184s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/11/2023, 16:29

General

  • Target

    http://napa.hn

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://napa.hn
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd84e9758,0x7ffdd84e9768,0x7ffdd84e9778
      2⤵
        PID:1132
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1900,i,9771663807393998222,74674853067930109,131072 /prefetch:2
        2⤵
          PID:4980
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1900,i,9771663807393998222,74674853067930109,131072 /prefetch:8
          2⤵
            PID:1424
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1900,i,9771663807393998222,74674853067930109,131072 /prefetch:8
            2⤵
              PID:2896
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1900,i,9771663807393998222,74674853067930109,131072 /prefetch:1
              2⤵
                PID:4940
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1900,i,9771663807393998222,74674853067930109,131072 /prefetch:1
                2⤵
                  PID:2044
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4440 --field-trial-handle=1900,i,9771663807393998222,74674853067930109,131072 /prefetch:1
                  2⤵
                    PID:1596
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4844 --field-trial-handle=1900,i,9771663807393998222,74674853067930109,131072 /prefetch:1
                    2⤵
                      PID:368
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 --field-trial-handle=1900,i,9771663807393998222,74674853067930109,131072 /prefetch:8
                      2⤵
                        PID:2972
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 --field-trial-handle=1900,i,9771663807393998222,74674853067930109,131072 /prefetch:8
                        2⤵
                          PID:3764
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5680 --field-trial-handle=1900,i,9771663807393998222,74674853067930109,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:3588
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:1660

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          744B

                          MD5

                          f36a110036686b28e444bd7bbf17499a

                          SHA1

                          693abf62e61780f4f304cb0f4cdd63e881f3021a

                          SHA256

                          d5ecc1b6813c3fa6c0b60fd823b26ab4d31e81c62e07dd0e381cff0b2490d942

                          SHA512

                          a06b7db65168d87aff32d13d6a6743e05e56c8cc9c14d954fcff0a1b9be15533e70784e359f0ac455b98702afe9109442cab6eddce4b2475479d88b8fa460159

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          3KB

                          MD5

                          fdb47691038cfe1aa38273aab7d02b10

                          SHA1

                          85a97e478b1e9c39d451ac23e47620ecaf4107c1

                          SHA256

                          2bdcd2274f542c405ea948364446e14f14a9f5bc07e01f73b8d86fd2d5d0d463

                          SHA512

                          6df2754aab3a14fa083632fa9674e912006a45d3cc1534435be21adfe6fb416ec5a1768e35c24178452b5becbbf08ba5ea33f5bf4b12570222bc522f5648adc8

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          3KB

                          MD5

                          76ca2f43b2cfda3f1a0b682c3bf04884

                          SHA1

                          5daae7c9206ddc92a848566ceabde4ab40fe6369

                          SHA256

                          9892841a74e5b414dba90cd0f5079be5f6f6fe513dcb214ef7a4b1bba73257bc

                          SHA512

                          67e4650363a70f10c04dd12c95e68e21b0f664ec831c1fd126d003502863821e6b185620b88bcab1ae3a361cad4ede91ebb41ece39caa12675fc0aa80780d304

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          c6e7b40d7308d4152cd192c5fe466d07

                          SHA1

                          e42e6401bd79f520267504e78fff2b4cb5bd6961

                          SHA256

                          d4d0e6e14c4adff560cb1d49bc1ee7a53e0e1070814afac2d282434a01b50119

                          SHA512

                          46e22bc0655068104c4029249d45d895d12e4d4d582c3aab134f224a802abc04e6dff83179613e01f17e8b63bbb8e7e795f4be9c5490c16871777e7561e17bb4

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          d75583dc086947c4f86034d9d66225fe

                          SHA1

                          0e28107cd61ae67749e2cdd927f5af7e49759f32

                          SHA256

                          d162e4387b0e60867caa1db1356c36046efcb67aecd232343cc231678c79ecf9

                          SHA512

                          775d520f9a54f2f98777e8a2f69e54064523ee3e72e18444969dc72d8c87eebe9449efc509bbe790d1fb5d4689a220add6fea7432ed73642bf823e9c7d09abce

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          5451344131bef5f457a5151445c5fc0d

                          SHA1

                          e4718a50124e84014f465483157aabbc04541271

                          SHA256

                          d9f9f5a735508b6721602480ded07c9a5d58d3c1b19b964865e8e864c0aec316

                          SHA512

                          5762dc130c6ffa4c82549ce7be98a6d3d165cdc67bdc9ff56db001067e88772886e6e0c2f7f762e53d625eca056fcccc25b94b5a8091e8828364dbf01ee9ad80

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          6c8f389cf702ff8d6c35d66baf5ecefa

                          SHA1

                          0dd2df856cb44e7e31bd1d16ebe3515607f4e359

                          SHA256

                          d08d8cea15e773addc72873d712d62deea2f1a90e93265c450111837af6faf12

                          SHA512

                          43452e62d009c4f299df192572c5d92bfcb1a5a39d8a684f340c91ecd684ec97a1cd49e2264532a1a1469f3864cf6efacd8eb6954d4809d86a1abab010d1b15d

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          4116617d053ddc8bdfdd432fffde7117

                          SHA1

                          15d5e42f6d01472a44a270d762b9460ce1eadcaa

                          SHA256

                          dc60a5089ff87c15c80060e39966dbdb823413bd2ad48e5acc3b1cade5eb659f

                          SHA512

                          8c9e588b23c49d815336b43280536dcec364abaee2592dd45951ae16a523c2005a2d2d8a6d79d968587a68fc567ce46248199312b6c97c466a33c7ba61d03da1

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          0b1b8f9cc7d8df0b7b4c57fa13e46ea1

                          SHA1

                          c789d1c04a663e92f85fdc99b6831740570b08d5

                          SHA256

                          d141f859939aa5721dbbd4c23c13a8f2f2d14abfccb756de55886e6c69511c5c

                          SHA512

                          18dacfe5ebbe723348d5b120a95e5db97bbcfb6341041fe8ca873482e71b8a8194064d0d590eb7bf0d8f1e554c2c9ac9f7c116315c635622bdd8cf9730ce84f3

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          391b83a243ffafa7cede7dcba315e2fe

                          SHA1

                          fa18c0f9a8e0eb41b700f10257fcfaaac4408405

                          SHA256

                          effc994cc7f992627ac0dc4d9eb4925529acf430fc7e09c1d6a463db12f89b80

                          SHA512

                          d9aaacba89bc05b362c59d13754cbcbf92e5fb4226fb64d6bf88fe9701fdd65cf1a375a8ff20cd31bdc2361357bf2d1d574452c3903dbe097036766d80c6feee

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          50fd73fb841d98fc33b139913d400841

                          SHA1

                          9bfd09d4651a0622beb0a964dfc42ac6186f0fdc

                          SHA256

                          53d83ba20d19bdd9e0050623ce5037187c6d1b80ceffb68d120d738e45636509

                          SHA512

                          5a5f0fff6757f2fb9ab5b4d66c79eb55d28b96a0247aa578d81ab89df6680f922c8dfe844c5d3f36fd0a6867ab191fe1cc795276079d501bde66db7bf199410b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          b08cdeecec162f10a78730534ee9d040

                          SHA1

                          501d72b21b022b3e90e8825dde91195260457c63

                          SHA256

                          a3c2ee97f065fbd277f2d273e401e2500ad2c6479813ec267daf0d2cd5b12bfa

                          SHA512

                          02a4e14462f44114e203f4d28131de31740ba15b0d14d6786f86af05c625fc3b5193e5d2116c4781114a7771e202442d8957969de4f479a02e79afed06c748ac

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          16b179bac2d9f63cbd90e299444bbaa2

                          SHA1

                          a0508d1affbdfe899a043a6b85bd1955975327a1

                          SHA256

                          13bd6fba9520bb095de2ec0ac744b75db707d85b45302d5368d1d45e1587b5c7

                          SHA512

                          64efba4f6d194218206a6816a3e7ce9de06bdd476e2c3738f3e055e7d2e40d02ac5d52a90fc10f679c54839c050c8fa2dc3bd7cb0612d7986d905fa93d00f662

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          5c8bb9693410679624846cda65069406

                          SHA1

                          756dc55d32eb316d2a00bd090e9fe5a3686557de

                          SHA256

                          85d5d9c95eca2e83ada94060b4f540a24d84bab0f4cb35bc1135e8c0d05b6411

                          SHA512

                          b122e0dd0efec9d96adb27cf576c66b9092b98c05d64925298d21a973b07628768ce12e0c730227ac029f76824c71fbfd19601260ec4ac9a9ffd1a26d391c83c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          766ddeecff2a0230759672af96214035

                          SHA1

                          b0d7f09ee97a7a09109834a6e8433a3816c6bd2c

                          SHA256

                          77394296f69ce73b36fddb3b41bf335812b5985b348ada8aeed5f8f3a75594ca

                          SHA512

                          ac007b8cc97ebb608d75557004a8ecd3f27355b30258af6074e741f8974557061a7311f81a75c7c20bebee50a6f83e734ba9151d0fff25d25de3cf90e9c2d9e6

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          ba9222bb617e5803230769fa28cdafb3

                          SHA1

                          e2b8bde6aa805bc4f54d14ab0127c81ac3a2d77b

                          SHA256

                          42457edc7be01c902921dbc40bea493c5cd3f5b6c185c28b52c69ad78d5e336f

                          SHA512

                          467204fe11b27766d14b96dfca52b814b2998c6264937ffe30ac62bf5b1278dc63b39696f16a3c1d48023fcddbec89edbfdb2e8304bc1d48dca1fc1eca1fdb06

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          109KB

                          MD5

                          aa7f004a6057d3c436d9e59152ac1603

                          SHA1

                          26f3df7dda536c152e41b1ff6fc2492b865e906d

                          SHA256

                          38d9b811b364efb9271bee41272d60cf2c22e57f9bd526e707623108741e6c9f

                          SHA512

                          3c12b7fa98338693499861ef866bac4e153d7d3928ff867de44661952579e093871d23d6729d7133408f088cf5707ca17f870faff9eeecd9ee5eb84ce5fa89c3

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd