Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/01/2024, 00:14

General

  • Target

    https://www.reknotic.com/2023/08/use-this-free-tool-to-optimize-windows.html

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.reknotic.com/2023/08/use-this-free-tool-to-optimize-windows.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:812
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffc0039758,0x7fffc0039768,0x7fffc0039778
      2⤵
        PID:1260
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2112 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:8
        2⤵
          PID:3736
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:1
          2⤵
            PID:1776
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2868 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:1
            2⤵
              PID:4880
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:8
              2⤵
                PID:2172
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:2
                2⤵
                  PID:2008
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4760 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:1
                  2⤵
                    PID:5100
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4836 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:1
                    2⤵
                      PID:3576
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:8
                      2⤵
                        PID:2112
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5100 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:8
                        2⤵
                          PID:4020
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5292 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:1
                          2⤵
                            PID:5092
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4984 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:1
                            2⤵
                              PID:2972
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=6408 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:1
                              2⤵
                                PID:5084
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=6588 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:1
                                2⤵
                                  PID:2468
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=6840 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:1
                                  2⤵
                                    PID:2376
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6632 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:8
                                    2⤵
                                      PID:1296
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6976 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:8
                                      2⤵
                                        PID:2956
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4468 --field-trial-handle=1784,i,7217946719347066550,14129113941738205166,131072 /prefetch:2
                                        2⤵
                                        • Suspicious behavior: EnumeratesProcesses
                                        PID:3696
                                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                      1⤵
                                        PID:504

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001c

                                        Filesize

                                        201KB

                                        MD5

                                        e3038f6bc551682771347013cf7e4e4f

                                        SHA1

                                        f4593aba87d0a96d6f91f0e59464d7d4c74ed77e

                                        SHA256

                                        6a55e169bc14e97dfcd7352b9bc4b834da37dd1e561282d8f2cc1dbf9964d29a

                                        SHA512

                                        4bee876cea29ad19e6c41d57b3b7228f05f33f422e007dc1a8288fd1a207deb882c2789422e255a76c5bf21544f475689e7192b9a8a80dc2e87c94ee0bc6d75f

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        720B

                                        MD5

                                        8a31fad413ff12477ba68f4cd71185d3

                                        SHA1

                                        c9b3cf204a94e470b76278332bd65cab75ff3e36

                                        SHA256

                                        2d9492f678777b7eb94e71c2235bca097c63b866384980a3a34c44868382fed2

                                        SHA512

                                        fb9c5f386c4cb4ba09e7ee02c8323fb1d58847ea5761550a4a574228770dc934052f619f4950ec7e6e060bc0f975852ccedf76b26344d41841a174ceb334be97

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        5KB

                                        MD5

                                        50fc515ca30ee2df86e21eb6b7cd4442

                                        SHA1

                                        f7dbee7f061fdfc954f141ac5840051130821d42

                                        SHA256

                                        1e6dd8c2d32612e9aae06ec8fcfebaf44748143b08f501ee65897a253eb84cca

                                        SHA512

                                        1c808ba18852c8737ad1bb3a14855ff1c65b0534195e53903ef84ba8d88e06a277d277fdd9e74d785369938db771a7eca4f6ae7e9b500752f10e12ded67d737f

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        1KB

                                        MD5

                                        deb100cf7714f1cb3aac74dae1e2fb86

                                        SHA1

                                        b0d2a5d201240da33ce91220123b1e13e2498255

                                        SHA256

                                        4804cf01ee9c0d3cecd1971b79d41fbb0d7f9edfec59452559dd791b1aabab3c

                                        SHA512

                                        7096c863f812be59078ec0455132d0c9d4184809f11b4a079c32d5b8ddd5c05394c73a7f98a88bbc5f3d865fece362e8caee7d6ca2bbe0c58a1cfd131551dd3b

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        874B

                                        MD5

                                        01556b4fba5c72189899b2f0a08e358a

                                        SHA1

                                        ffa392774506c747ca014e72cbab4c7cf1ad95fb

                                        SHA256

                                        ad7ce42a76f71e3a4589415ab2fb127b34faef7c4394089eff404fb380b5c0c2

                                        SHA512

                                        2ea2c67cf7faa28f809657cb3dddbbb0922c96fc3a9cf8aeec7364465edf39fa724dfdde174416c3cbdb0c77742970ba307ef27f8d21b22ac6599bf089f9a7d6

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        39e401bb471f3512977b7e29775eaa52

                                        SHA1

                                        44d11948bfa3b52bfafa4bc93972e54cce2be42a

                                        SHA256

                                        0fe28e988351c403d648be3395e1cac31c432821df0ccff8ed52d0752847e6db

                                        SHA512

                                        26e9ae219d1149fb9d7cbf6a7a6198e4c7a99181554b61fb6d627655b237a483685e819a3ed81dd82c54ec5e4651cb4dfa76cbd7e1c331e590bd4780d44ef84b

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        c720ed18b41831eae8fcad2d0c035243

                                        SHA1

                                        d435df563d5e957a5eba3f524641e05ca449f195

                                        SHA256

                                        248d1f91646f48ab4fe938b22f42040daf7c1b78bf6a077c148ccf482f9be325

                                        SHA512

                                        c434ab58389222b86965a7b67d236f99f316f9d936c0432a3c5978cbb0fe93eca8a645f1b7e9ff75be70bd36f13d1a46d33fe06ddbd7e47d5bd9f3447f5daf41

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        6KB

                                        MD5

                                        9fcd75d9b82c9b3d58d9a6dbedfb2dfc

                                        SHA1

                                        d1a4adbb97f9b86913d53188796aa2c5691cfb7d

                                        SHA256

                                        2f6e4497eeba64bbc056d61a110382d0d3745369fcce5a2b6af55b087669d1ce

                                        SHA512

                                        64b4ffb84f1d758f8d36966f42dede6ebf0352dc333e3f79ed0e7c6cc54dfb07ac00458235701ba0beb9a4da614f12fd67664f9ed9f6d1be99ef88e9c3054207

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        5KB

                                        MD5

                                        b4f559e2315a83a6d00887d4896b77db

                                        SHA1

                                        cdd27a154f00f15dc59b8751aa63e0cc99036f03

                                        SHA256

                                        e633d6ea8108298ba493904c4daebcdbb8f0d5e98ddf193cd4ab4c28a8ebf7c6

                                        SHA512

                                        291aaa129edc07e84e1085c9c04af6b2c78cf3ce44282d18eadeb3ce8a4cce3c13f246208d4da3ab27b9ba2f05bdf18de07396a57b30f7219aef83b2e773167a

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                        Filesize

                                        56B

                                        MD5

                                        ae1bccd6831ebfe5ad03b482ee266e4f

                                        SHA1

                                        01f4179f48f1af383b275d7ee338dd160b6f558a

                                        SHA256

                                        1b11047e738f76c94c9d15ee981ec46b286a54def1a7852ca1ade7f908988649

                                        SHA512

                                        baf7ff6747f30e542c254f46a9678b9dbf42312933962c391b79eca6fcb615e4ba9283c00f554d6021e594f18c087899bc9b5362c41c0d6f862bba7fb9f83038

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe579153.TMP

                                        Filesize

                                        120B

                                        MD5

                                        a1339fcfbc9f765b01fbad1451c06bed

                                        SHA1

                                        2bd04ba852854537eac8ed66ee6dbc71ff701bfe

                                        SHA256

                                        2f486acbdc61be8402d9cefcfc3da598cf1882b05a25509ed414b98388804ebe

                                        SHA512

                                        b16c99ddbe38cae89c0d84047e019989807a2d6d4ee62912f7ced0fec8f460b7f7cfb8421f12f1747e1551d288c131967274e4c776ca6dab20dfe333d72a0bd8

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        114KB

                                        MD5

                                        d4c1a43a86b019c19ab32fd2b2657b08

                                        SHA1

                                        ca25c0139b060c69b86cc3669dbffb7304c26052

                                        SHA256

                                        af610e02d2afbfabdc09d871cba1bc2d7266307de7cd4d714d84d0b0bf03dc43

                                        SHA512

                                        660e23f1e745225040643d0c0e5e912802ea06fb739cd0c6102c44d48ae3adde86087ca2b17e5d21d35b4f10a498b17841e761311ddb9f2601bf442133a431d5

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        114KB

                                        MD5

                                        b5ff2a62b47cdb7e18dccb06c4c941e7

                                        SHA1

                                        17a8e4452b746041b6703d9d5c9bb90520ffecb5

                                        SHA256

                                        15c1abb92a4003d66ab5e3b2ba380f8d9ea5ebd339fe48fc0388a87b0aa44dae

                                        SHA512

                                        1f87a76ca3b2dffda6aa09beb761494ff046bc623624844fbed2854b5e375ab3370f5186cfb7a05c3bc284d2ee2e80ec49e24e0da199000e784a9e088f3a9fed

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\e15160bd-a0a6-42c8-a90a-c042c5840880.tmp

                                        Filesize

                                        2B

                                        MD5

                                        99914b932bd37a50b983c5e7c90ae93b

                                        SHA1

                                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                        SHA256

                                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                        SHA512

                                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd