Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    595s
  • max time network
    557s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/12/2023, 13:13

General

  • Target

    http://www.npb.scforum.jp/jump.php?uid=991&url=//hellointerior.jp/product?url=https%3A%2F%2Fhotelmarbrissa.com%2Fpars%2Fbuharrisonstlharrisonstg%[email protected]

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ff8d29b9758,0x7ff8d29b9768,0x7ff8d29b9778
    1⤵
      PID:1360
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.npb.scforum.jp/jump.php?uid=991&url=//hellointerior.jp/product?url=https%3A%2F%2Fhotelmarbrissa.com%2Fpars%2Fbuharrisonstlharrisonstg%[email protected]
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3620
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:8
        2⤵
          PID:4204
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:1
          2⤵
            PID:2680
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:1
            2⤵
              PID:2196
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:8
              2⤵
                PID:1548
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:2
                2⤵
                  PID:4236
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:8
                  2⤵
                    PID:1936
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:8
                    2⤵
                      PID:3600
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5228 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:1
                      2⤵
                        PID:3532
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5272 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:1
                        2⤵
                          PID:4396
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2940 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:1
                          2⤵
                            PID:3196
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4488 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:1
                            2⤵
                              PID:2640
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3368 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:1
                              2⤵
                                PID:364
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:8
                                2⤵
                                  PID:216
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:8
                                  2⤵
                                    PID:1560
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:8
                                    2⤵
                                      PID:4816
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=744 --field-trial-handle=1884,i,13827657977763130592,2889733754235790100,131072 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:4616
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:3084

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\8d19950a-c80e-44f3-b8b7-f8491be7fae9.tmp

                                      Filesize

                                      115KB

                                      MD5

                                      5027cc3791916da85def0c7dd868564f

                                      SHA1

                                      a370aa4119d25636efc453cb1659cf5da33231a1

                                      SHA256

                                      37c65b7ac0a2a4b011fd6e46672528fba0536b7e55e498d2e40fabb28c06886c

                                      SHA512

                                      529124cc6f53f7cebcb6d7b8b3a9ff5aa1f379454f7f54bc39f7a9420b4719d26fce9b297862c5ffed782eefec53adce3b9a6c8ba8198741ab7b557fe8b897a6

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      216B

                                      MD5

                                      fe41f49fa6aa5ecb9d8099f13164506e

                                      SHA1

                                      96a09d71c5751895131239ff49cf532a1d19c063

                                      SHA256

                                      c2bff4f62a62f14f4fe15a24cd1c86f8ef4d3c79db8e7a4f4b177674951d05b5

                                      SHA512

                                      3e4cc611aa99fe7cfc29f79a844b43ed9e18f7604768c426f47e5436815ba2e7e1d60aea1fda1f36a9ea61703977dbc4209fc2c7e1806afbe07418edf2b02828

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      8af1395d9d5912f86c10ee0cdc84fb95

                                      SHA1

                                      51d0d259bec1027e4e98aeded5319edea8a17a47

                                      SHA256

                                      9c034edf24e1989f81933d7faf24690ffe80cae40752c2b1e6b1be0b795edc44

                                      SHA512

                                      8ae28557980b9f826aca0433dd068a9116c0ed23ea553cc44737b982a2fa787823ba97fa85fd2064160088d823a187d4d768c47a7b61f1e86d3986a5831fa45a

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      2KB

                                      MD5

                                      c7ff113b89ef6fb634d6d399988b394b

                                      SHA1

                                      271a0b56351c642e24a83603f517ca4b89ed015c

                                      SHA256

                                      36c83ea5853dbb7958ef3fa4c8cff3073cb9d3c1551c6523b81508f973304ccc

                                      SHA512

                                      fca455cd0de9ba29c1c44ef202ad579e8f1af49f023f2cc028c4e09777abda1d8860f30b581a0295e1b0513ae173493b11f0bfc28916d35775e3bc6543ada4ba

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      539B

                                      MD5

                                      1a6197597480ee972ead1ddb0fda9522

                                      SHA1

                                      01ec19f593bfc796f555c6766b50ca82a461729e

                                      SHA256

                                      574d7f0b75f244689f258f9c181e3646ecf9196203a4c2dfc84513fe13091f8d

                                      SHA512

                                      d033b7806fd64bd7a137e7ae8bcc1d2e7ab66b53d3a6b44fcb16985935f7b293fbeec7906116aeed8709a095e938866459db81857f3e4a63d55f145131d15621

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      9e2d6a7a7b3edcd8e03d0a72e5cc1ff0

                                      SHA1

                                      4d92d823a769ab20de1863960bc524496342c7f6

                                      SHA256

                                      f3506c8d7f5465d66160d9a134a832f821abde836d4ec47e42c071b02cf74cf4

                                      SHA512

                                      fa2fb590ab7e989ebb83d82502c77c7cc9c16b17fd03fa8558c8076e4e76ee6aa6e74e325f2156249fa8de07a35dfedfb4e197ffd74c4aefa5c6499e24b1f355

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      cec6bed510a17f7c88783e6d51b4f7de

                                      SHA1

                                      25fc40c74ed0eeace1bf43670efa8b9206bbfc1e

                                      SHA256

                                      14488f3bce177203395708b306522132b6e848493d071b4eb6dec775d60ed98d

                                      SHA512

                                      46debc9d659ad593c017bdef5b0408f70e994978f8824bdb181bd203917c3f80c670a563b7281c3c35b476e3b4d23266e65b5b92a5534f9ab986c27ba19fb1fe

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      152KB

                                      MD5

                                      014ef5e41a96296f54706d0ff2a6801c

                                      SHA1

                                      a87ba33ecf9b71be078cff6b6b36b3b9a257d12e

                                      SHA256

                                      14fd5a5b28a1c24da15a8b53b60f0024b08aebe9630ff8b2afc4361c57b87d47

                                      SHA512

                                      6bff7cb7d3c8c219d7e55b8543450194af6feb5036ca4bedba23684d4aff6ccf029d9a2b6cd9984c2b82fb32b2a5d7135ed0f11ff68093a9e0c8b27b56a8b117

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      115KB

                                      MD5

                                      8bb99ef45f22984525b2a2722c4ebb22

                                      SHA1

                                      1802cc6bdeb9c9424cd832a16c3a278ec00c5b09

                                      SHA256

                                      664d30e2c84a839b326f68a27149efe42ddd4b7745450a7e01d124f15c706da6

                                      SHA512

                                      52200d224a0a00e3319feeff7815fb6dd626a52863b0d066e5a16db196ea70059bf3e8229678c3dba8aeaea02ffee2a1342eb12fbf889d89358e0e9123d74071

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      116KB

                                      MD5

                                      b78b75a44a99b6efc33d885b58757c9d

                                      SHA1

                                      9b41c04bd8bd2553ac837d389e2d44e89e9713a8

                                      SHA256

                                      f57ecb2b2b82a44b94c843d47e22a6d22be529a2fc29b112f9b6318546eda54a

                                      SHA512

                                      5ae9d48de3806498858b607fb54dc50d9ee7bb36e966619c702b4386a8a40df25e14b849ca4cff3989c3b4224a4ed0174d92894f00a8e5f33974e9e0612ff54b

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                      Filesize

                                      2B

                                      MD5

                                      99914b932bd37a50b983c5e7c90ae93b

                                      SHA1

                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                      SHA256

                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                      SHA512

                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd