Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    381s
  • max time network
    378s
  • platform
    windows10-1703_x64
  • resource
    win10-20231129-es
  • resource tags

    arch:x64arch:x86image:win10-20231129-eslocale:es-esos:windows10-1703-x64systemwindows
  • submitted
    10/12/2023, 21:42

General

  • Target

    https://epsilon-spaceworld.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd77379758,0x7ffd77379768,0x7ffd77379778
    1⤵
      PID:2300
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://epsilon-spaceworld.com
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4436
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:1
        2⤵
          PID:220
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:1
          2⤵
            PID:1620
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:8
            2⤵
              PID:2436
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1748 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:8
              2⤵
                PID:2868
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3820 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:1
                2⤵
                  PID:5116
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:2
                  2⤵
                    PID:2648
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3972 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:1
                    2⤵
                      PID:200
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:8
                      2⤵
                        PID:5028
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:8
                        2⤵
                          PID:1848
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3204 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1556
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:4472

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          480B

                          MD5

                          f007b20c1bc9545b3c480c4380000657

                          SHA1

                          eba01a7417bf7fbdee03dc0b503c637b157c7a37

                          SHA256

                          005f359dc9f227813e2b6ff5e4ff6deb616306457bf70b1b3962ac0dd791a648

                          SHA512

                          8db9cfc6bb8c8380dd15ffc57614a05874c2352b540a0563908da2956825b146de04fd02f67c719b4032d77462d72a71919c8117ac4a5d9dfbafa080db14a660

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          111B

                          MD5

                          285252a2f6327d41eab203dc2f402c67

                          SHA1

                          acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

                          SHA256

                          5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

                          SHA512

                          11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          c4c6f3d114f509834f3540af12f266dc

                          SHA1

                          63a4ab35b66165d9d4f48c0498f0f6392558a6f1

                          SHA256

                          18f882090c9fa815939994337ce6834afac8b5410f6c05c5d58a3bdc5049b100

                          SHA512

                          23b95910a9d808cc188fe997857338c94389cdffded16592d42993b7f82af2d9ef31854744411411fb4e8ad4d9ecbadcccd7ceead0a20e878227289ad52bffb3

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          bff588049d737adc37824c439a43c59b

                          SHA1

                          4601f30e141a4d7ed60fd4e0604f1367da833332

                          SHA256

                          4d90c2ef640f98b50f446692788cf799562855b4d8ae42e4cea6ea78eb8f5aef

                          SHA512

                          17e470d5e617094ae3ecdb992f5c7aa15032500f9454933cd7d71efdec490c513acc461e5e49dcb5dee4d169d5f79b003ff2aa8aeba2a27840046e9ec71a49f0

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          980b8092d83a3de37b20f395b004ba32

                          SHA1

                          fe2ea690e36295526476699003d928b0664c20d8

                          SHA256

                          dbb6d0d26dc09508ac9a9f3d7cdfa1d53c53a5fc3a785adc05376b1a88317ec5

                          SHA512

                          4f8431d9578232b78e6279a606966b852c00386c79e831cc1d4fd822ceaee701b78191359b09bb749615364e3ba6ca423d54033867c4fec3d9dffd6aadc67369

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          fbe5414ef9831bcfdf3291354e069525

                          SHA1

                          f2da50ef80b8c67d39363b8ea25c225ef211a78d

                          SHA256

                          c0506e835285d35ec6d764b3401956046555a9e1358d37980147d68dcf59f0c8

                          SHA512

                          6401b713f75c286d274828e542cd3dc96ae3112f03838beb84b88862905c4242bb3e82d16117bb3cea08ad37f350ed6299f6cfce17f51a245ac32596d6dbd17a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          5KB

                          MD5

                          5957a15a4245728dc24e8e3d08186b86

                          SHA1

                          aab70e9716051b6e9ca69ae50e2305e5e2cb9cdb

                          SHA256

                          4c7e372e20c1262afc2efd079f2de68302923c8be509173e71b40e9efa3a51b4

                          SHA512

                          6eb988f5eaa0b3777f07bc2f55f2ec03828c24fe991ea89d27a7a4a24322fafb161a1d1695fd41e457b1a5465fbcad9054dd1962b2c9b10c10793423fcb4dfdc

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          3KB

                          MD5

                          40ff593557c5a10f7d814fc13bfd866a

                          SHA1

                          0d9451a5642ac76df10fd0d19afb77049a3eaf55

                          SHA256

                          da127d8f3830f0355c0ca3dff417e1c08d01efa3655bd812fd399e6d91485924

                          SHA512

                          02f0bc91016154913db03595a05d1fc67cc4a43335b75c01b2a9020f7e8de1199ebe7995ecc5b7c36c95fdacb07d59abf4983e607b8868d573202ebe75a7d152

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd