Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1799s
  • max time network
    1688s
  • platform
    windows11-21h2_x64
  • resource
    win11-20231222-en
  • resource tags

    arch:x64arch:x86image:win11-20231222-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    04/01/2024, 20:28

General

  • Target

    https://l.facebook.com/l.php?u=https%3A%2F%2Fshre.ink%2FM0FkmA%3Ffbclid%3DIwAR3kH-xxEj5ATGnwBdsJwmTXQQbpeZWEkS3YTOxYZh9iwuPMJgsS6XfhIrk&h=AT0d2Ce0y7UDe1TY1tEcHmWocqOiLVZNQNvuVQemEStJM5JFxwhtOs4AqebbmriEb9KEBT4lzbsKsT2BGj7VAD_G1vKGuXaO4WWkn7vX5NBBoSAgHuW7DAe0k4Q5_X2FwL7n&__tn__=-UK-R&c0=AT1Q6lm_TMiZyiYq9SAyNJdpfUyivE3EGnEgbvcCouQBvBNOr4LR2Gs_8sNAeXZaIjCpZSZrXrawShbL883JQMCmjCWEGEHbURszHZ0LUSudtPkY3Q93hZ8V_zh_2PC5GBu48_lFSkj-qww8QTik9uN-TvcaP9YNjYHgU7a9EJPakw

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff8282e9758,0x7ff8282e9768,0x7ff8282e9778
    1⤵
      PID:4284
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://l.facebook.com/l.php?u=https%3A%2F%2Fshre.ink%2FM0FkmA%3Ffbclid%3DIwAR3kH-xxEj5ATGnwBdsJwmTXQQbpeZWEkS3YTOxYZh9iwuPMJgsS6XfhIrk&h=AT0d2Ce0y7UDe1TY1tEcHmWocqOiLVZNQNvuVQemEStJM5JFxwhtOs4AqebbmriEb9KEBT4lzbsKsT2BGj7VAD_G1vKGuXaO4WWkn7vX5NBBoSAgHuW7DAe0k4Q5_X2FwL7n&__tn__=-UK-R&c0=AT1Q6lm_TMiZyiYq9SAyNJdpfUyivE3EGnEgbvcCouQBvBNOr4LR2Gs_8sNAeXZaIjCpZSZrXrawShbL883JQMCmjCWEGEHbURszHZ0LUSudtPkY3Q93hZ8V_zh_2PC5GBu48_lFSkj-qww8QTik9uN-TvcaP9YNjYHgU7a9EJPakw
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:2532
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1852,i,9358898838286151607,10936367918419178867,131072 /prefetch:8
        2⤵
          PID:1888
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1852,i,9358898838286151607,10936367918419178867,131072 /prefetch:1
          2⤵
            PID:1216
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1852,i,9358898838286151607,10936367918419178867,131072 /prefetch:1
            2⤵
              PID:3776
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1852,i,9358898838286151607,10936367918419178867,131072 /prefetch:8
              2⤵
                PID:2156
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1852,i,9358898838286151607,10936367918419178867,131072 /prefetch:2
                2⤵
                  PID:3440
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3852 --field-trial-handle=1852,i,9358898838286151607,10936367918419178867,131072 /prefetch:1
                  2⤵
                    PID:1272
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1852,i,9358898838286151607,10936367918419178867,131072 /prefetch:8
                    2⤵
                      PID:2468
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3896 --field-trial-handle=1852,i,9358898838286151607,10936367918419178867,131072 /prefetch:8
                      2⤵
                        PID:2676
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3616 --field-trial-handle=1852,i,9358898838286151607,10936367918419178867,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2340
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:2712

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        672B

                        MD5

                        00adcd1db317c6028ba5bf1438d740ed

                        SHA1

                        56a57fefbc80535f4d85b805bc72445a1880769d

                        SHA256

                        7710a239d1b4019b7e3ccee49cd05cef809e2bd6efca1e2b660400b8268c032b

                        SHA512

                        d8fde096d415ded0710a8ec1bcdbfe7bd345afd552b055bc9f795825d400328eb8c0c3f6fa5d0a363be197296a4c9a9092e70e019f0f91660398702bc3c39a78

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        5ef639d1d3f67434a742b73d70467926

                        SHA1

                        16fae137dcd73639992fa12599ec409c7d208b09

                        SHA256

                        864ec1876b5b514dda754b0c8c28268694000a95965c993e281ca7d9424bbad2

                        SHA512

                        1d56fd112dfc9ca6e2b3cd24936ddfbd6e84a6852bbd742baa7cd509b984c5a4be17031667764ba155aef6ed9a86c1cdd5b71fd69119f2a76783f7cfb627050c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        5adfa1dca33161b5d0d5fe59579f9a64

                        SHA1

                        294f9641507f4b3cf482d9a5562d5e1be0311dff

                        SHA256

                        58c187dac29f9ca4997fdaa61b193eb6ad6d50efd2f9855c0b4f8091bd8cb185

                        SHA512

                        66ff6a524cdf1540334b98dcbd8f4c5531aa8a51a582d1bdf3531f1ac5bff01d309738659658e114e1eea3cffcf383f5130fb991391f87a9c13830a37a44270e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        346317bd0a133a56d074482aea34a91b

                        SHA1

                        11a91370c523ebe5cc0adf0580688bf58a66ec7f

                        SHA256

                        c6e5239abd280c8827d0bd6a93fc4d326722ca4a0189248a063878558c99c9bc

                        SHA512

                        c948f261f367c48dbfc9b2e2776ce368ea38fde5450edfecdf8e6bda6fe563cd7af3240d09c9532cd7aea4e9824e52432f17597dd514a38479695e502c3b77fd

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        bcb4fb27008386e1cb6acb94bb4ac236

                        SHA1

                        96b36c9adc4bb856f9ef4b081c17436a752e950f

                        SHA256

                        0255613a7bee75a787ef9c96055fa62980ba60617f1435ce105ed12302994b89

                        SHA512

                        b88c80e360fbe961b695bbf9c61df954dba7e4be32f12b98b58e91d829b96b5fb51453b301c9d92d39d95225b6be4d3ebc15045ff04b4357d0bde0441fc2bede

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        706B

                        MD5

                        d4d189d06b200f35b0d3d2e25f160f4d

                        SHA1

                        3e730ed9003a5aa943b23ff50c51585127798058

                        SHA256

                        c483b89bd7033358b69d2185c90cb07a23e42825e1af49fba1b57ede8cd1ac16

                        SHA512

                        590114587aebb9be5b0032b659a4b222cb01a0980fcb6eb3e85447934fac39fac299ee2630d0ac39ec7e684f861271ac693490e4c0c9078cfd7383075b3acdd8

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        706B

                        MD5

                        d23710b087fd1091b93947743603face

                        SHA1

                        9116708ea4116973e6c74d22754d2341ce7855d6

                        SHA256

                        5b8f23f77b95433404faf471047247543bf4330841793a88aa763613b46000b5

                        SHA512

                        c3b936801261fdfa9c8fdb009d717e487a72c64e02d2a638e5d5df3b7bdf5cc2450d3a38a5d9c934c14082214a68bfa9fec07a9013ed8fe5b7a4025ab5041673

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        706B

                        MD5

                        230d9a07278eba9b49ac72f3b3a74653

                        SHA1

                        38af39d146a04376ef8fd732d82933c7ba743eaf

                        SHA256

                        8a32e95865880ee59e4d34b166256a3d5b01c8d02400b40a78e2a95c456faf02

                        SHA512

                        a3231b3ea95765699f0b8ec3ea1fe1e75f263aef398c1ac446bc1e3450c1196f18b02421f9735c4a5d8d313339d9426d2489fbfc76ff451dd87b6f7b3ff9b0ea

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        706B

                        MD5

                        0957684b7efd172c5de9cf8921df89c3

                        SHA1

                        c342ce18ebd24bbcf6ef38a6514986bf0333f9f5

                        SHA256

                        eade5eb3a91e02aa60be2f51e2f20d461854943e37c666ed5223845d88de91de

                        SHA512

                        bd68ca608ae142a2c2d0e989817442f39a660ccae14475da48d1fc0f6c772984c5e63e7a60eb62ba4bb53e459f06a89e9ae9e4e471dbe1278c3deafccdc8bd5c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        94c45923f74d807c067337a10e2ac1da

                        SHA1

                        14d354ce9b520920063667146c73bfd44fc95748

                        SHA256

                        4d7195bae149c6fe1e097017c5ebadc2a5f6673b2b8040c7cfa134e385931128

                        SHA512

                        c56ce228274db7f78692330d2b228d0232869e34d5975b7e38ffb3c61bf651db793ae349f14eaf193663f47baf257404f83f95c9b8050684719731ca1950441e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        114KB

                        MD5

                        5e7a9fd96e78f0104fdeff17719a50d8

                        SHA1

                        7975a7414f05d1d0c03bf391caa131139d31d3be

                        SHA256

                        15953ca475a924de435eb83ade388278a81706c93d46196fd990c5d66464c6e8

                        SHA512

                        4aa35f56ba1b1e9a4fd58cc4e161e50ef19caaab3092adeacebe85653bbee5b6e94639fdf38325df28a1e5a9d074409daa490aea199a679a262720e6c6cbcd4b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd