Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

05/01/2024, 07:55

240105-jsg8aafhdp 1

05/01/2024, 07:53

240105-jqyr9aggd9 1

05/01/2024, 07:48

240105-jnf5esgga2 1

05/01/2024, 07:45

240105-jlehtagfe6 1

05/01/2024, 07:39

240105-jg8absgeh8 1

05/01/2024, 07:28

240105-ja64paffar 1

Analysis

  • max time kernel
    159s
  • max time network
    253s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-ja
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-jalocale:ja-jpos:windows10-2004-x64systemwindows
  • submitted
    05/01/2024, 07:55

General

  • Target

    https://www.fenet.jp

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.fenet.jp
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3464
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffe0f259758,0x7ffe0f259768,0x7ffe0f259778
      2⤵
        PID:5920
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1896,i,7940272434267068034,6847065843987172976,131072 /prefetch:2
        2⤵
          PID:1824
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1896,i,7940272434267068034,6847065843987172976,131072 /prefetch:8
          2⤵
            PID:1400
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1896,i,7940272434267068034,6847065843987172976,131072 /prefetch:8
            2⤵
              PID:5652
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1896,i,7940272434267068034,6847065843987172976,131072 /prefetch:1
              2⤵
                PID:2112
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3112 --field-trial-handle=1896,i,7940272434267068034,6847065843987172976,131072 /prefetch:1
                2⤵
                  PID:2244
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 --field-trial-handle=1896,i,7940272434267068034,6847065843987172976,131072 /prefetch:8
                  2⤵
                    PID:1128
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1712 --field-trial-handle=1896,i,7940272434267068034,6847065843987172976,131072 /prefetch:8
                    2⤵
                      PID:344
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 --field-trial-handle=1896,i,7940272434267068034,6847065843987172976,131072 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:2020
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:3736

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                      Filesize

                      330B

                      MD5

                      b22fca592786a71bb3be444b67614e13

                      SHA1

                      0e515a2146995a264c165b53b2602b997958af83

                      SHA256

                      dc41a0bc3147f6c9dbc37fe70daa3d20df5771cec0804d0c2a013c65ae2db271

                      SHA512

                      eae06fc8e89865c5daa30d91f9b2c25f5ead5b89ac1efc2b686941e47339d525095079488a6d09b752f2c38fe31566610b2a0e95bdc3d11fd50f65523c8a4c6c

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                      Filesize

                      330B

                      MD5

                      2438f56985b2300c27a6c86257172b6c

                      SHA1

                      7b2f7e20395567249d71b126ac725cf7724c2a78

                      SHA256

                      a4e0cd789b20398c55746265ca9ea063cb28d199ccf4a76acf0839338f2c326a

                      SHA512

                      e5ddc7e745d5162563644a80ae5e9ab8490475776ce8a5303f5790ef03d40baa91cd9268b31c5061c4065ac8307f6e63136b88b855e2480d42050228f097806d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      120B

                      MD5

                      ba79d55abb6336f3ce6f32afdc23b683

                      SHA1

                      8bddd6d9a4ab4a9714df6512d15c8210aa896afc

                      SHA256

                      2828967be9231bf6a316b1df91f8acba4336ef6a38c34d153cfe361cf39915d9

                      SHA512

                      2931b14530045839299657b8c2329c5c1d71ad7ed9daa81cd3b549008654aa962c940652f2857fab5a91b4a4cdb1710e0e936a8636349e76ef9b8ffb11825cd5

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

                      Filesize

                      16B

                      MD5

                      46295cac801e5d4857d09837238a6394

                      SHA1

                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                      SHA256

                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                      SHA512

                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\MANIFEST-000001

                      Filesize

                      41B

                      MD5

                      5af87dfd673ba2115e2fcf5cfdb727ab

                      SHA1

                      d5b5bbf396dc291274584ef71f444f420b6056f1

                      SHA256

                      f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                      SHA512

                      de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      1KB

                      MD5

                      5fae27407b103d3b89ab4ce38e15a20c

                      SHA1

                      a25e1848e89976ed4cba7215c2f205c657cb5956

                      SHA256

                      e5c6dd92ff765dc8fdec7e0b2de6f2f01ff7d52bc5530c7a43b3f7167bfd39ab

                      SHA512

                      3108c48ed5ff04e03a18a82c73a113ff205a36a77290f84e214baf1dc94dd7e6745b1489eadd540d63a92bcf10cf4148b560b13c37a057e7d0056cd9bebe0710

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      2KB

                      MD5

                      d4745ae8f16264c599096fdfcb090022

                      SHA1

                      5f6f22b60a2c05a785aea7bc3e24a41a01eb5a2e

                      SHA256

                      c977f03be1c96fea15f05e8207ea4e54e9a87602e498492ad005e93da77d3a96

                      SHA512

                      39ad424b7bd71bf50321dd8ea6f363d6400949c3c7712558b51a79187b36a4b0c0fa605c8c4292bd947a8718a6acf75738895e6661f0212c956b6477184631ef

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      873B

                      MD5

                      68f5b07672622d679bdcabcd86429405

                      SHA1

                      bd119cf351eeddd48b72b8e8dbbcf0a41c3423c7

                      SHA256

                      9f59fba177ef97b29e4712b30efafc03a743b74f1dcd120bb0ee8b02737390b7

                      SHA512

                      76d88f3c5a5712aa4d1fcb6cb48b9d81c96defc871856d90266da0c7ad3c07d3dd32c6922f0bd10a4df6920ab4aec03f99142bf5fceab70e3b2e8aaae367430e

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      873B

                      MD5

                      82e5bd7c19d3d632597e7caa2e6bb933

                      SHA1

                      955756b7cf8468fe0e6523fb6265a26101039144

                      SHA256

                      dbf7b2ba59bd301b75abe25bbfee19cd212f8edb6b099782ff195e8a416b1b4d

                      SHA512

                      f88b4d0f472cc1c52ed400f6552f0149fddd49dd442ffe875eb6ad7bd73478915070200d09538e6c55ce8ff94286d6e9ab57f5034242648cca227fdd00a7a5fe

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      5KB

                      MD5

                      109429ab7071ae50b08e7334eba6b325

                      SHA1

                      a531660c29e681be9f1452de9a7e34e1aaea8de3

                      SHA256

                      80631c324f9d315e2975740facc030eb3cbe9975b334363d818e8426e726fdbe

                      SHA512

                      fe81f9599bd6b29ad0fb414c4f03c4675b7d81005bbc75632fbbafcf9dabb37c07fadb92751ceef008e2e9a942ee36e25a46a4425b763db62fd9c84d51fbae2a

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      5KB

                      MD5

                      b7b7274faa711070210ed88f7cd9581a

                      SHA1

                      f83d6551c19d36676dd422b8a71aee6f36f55bba

                      SHA256

                      8d6a48192de633551a394b45f6989d39ce5d25ba7d1843aa41ab0c31634b2c00

                      SHA512

                      24ccf0cf1f2f3528dcdcee1a2f57fde9a5dacfa76893192f0c10e295e3bac1796e82e07c6102c2d47a0e971ebec16bcd505c1cb3e1b089e99c03ce1d46669c32

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      ff2c468698637e68be69809237171c39

                      SHA1

                      51fff4894a0288a0a8a96fea8e084c87bbe3c921

                      SHA256

                      55c325a671b0f42e17941e13c2187ccc2e1c7034d56ec2c84fc8d805451ccce7

                      SHA512

                      920c737bbf7798b519212da9e3f9a22586fead684349865d9827a3c6f66bb18c936a62b93a4f6f4aa1fdbd5a26594f113a9384e23a5a3484e79ed8e54b8ca65c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      114KB

                      MD5

                      4259381e956e507aa9d4387d09d44cbf

                      SHA1

                      ca1b0fdf717cb684ca2dba5a46ffbc12e7f24b9f

                      SHA256

                      34a477cc64557606094f6b0f26706b7a426825665eb565578e908d089ef787a7

                      SHA512

                      c948d5edde80c2d99568fbe992a2ca9e85aea6097a328ecda62481eece02c30214951b0b476d85de14d78844c806098098af35c99b221b2c13ea3d5ed6f2d2b1

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                      Filesize

                      2B

                      MD5

                      99914b932bd37a50b983c5e7c90ae93b

                      SHA1

                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                      SHA256

                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                      SHA512

                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd