Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    5s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    05/01/2024, 09:13

General

  • Target

    http://www.shareaholic.net

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 10 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7759758,0x7fef7759768,0x7fef7759778
    1⤵
      PID:2496
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.shareaholic.net
      1⤵
      • Enumerates system info in registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:356
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1556 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:8
        2⤵
          PID:2728
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2136 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:1
          2⤵
            PID:2600
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2128 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:1
            2⤵
              PID:2620
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1500 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:8
              2⤵
                PID:2652
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1164 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:2
                2⤵
                  PID:2668
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1164 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:2
                  2⤵
                    PID:1692
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3436 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:8
                    2⤵
                      PID:2228
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3532 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:1
                      2⤵
                        PID:1928
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2488 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:1
                        2⤵
                          PID:852
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3768 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:1
                          2⤵
                            PID:1720
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3888 --field-trial-handle=1332,i,5108507553694140283,12226925598029832674,131072 /prefetch:8
                            2⤵
                              PID:832
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:2108

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                              Filesize

                              344B

                              MD5

                              47d13bf6a5cac812f1d994caff5b4a1a

                              SHA1

                              274a67ecf1c8660be076973d326c332bb74e47f1

                              SHA256

                              da099d5b67b02a04fb394735f29ed3dd3c5997ab8100a5e0fb153271bef21916

                              SHA512

                              f5e274c45cf9af9599f3c0ef1417c66184fcd6980925c12c1e458ce5e9db0bd9d47b892489b31196e55dc8518b85b44a3ba00760053151edda264efb846eea68

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\296ba0cc-0f56-4fef-a57b-c2c7b8bb613b.tmp

                              Filesize

                              6KB

                              MD5

                              ce63b66109b9d7b6c9a881df5653e4b6

                              SHA1

                              16b0049e6ef419bbe09c12919eb8078182c34b25

                              SHA256

                              b10b12392ea66d2ed8b86d05861f3f627d8a1d1164aaf69c32c8f545116cec2e

                              SHA512

                              06975442a786abb894c0586391e18d20a80b93e1b830902bb296ce0d657180fb9ab5bddd151fd0376f04ad210a12f2d3227062b4146e286b13a67d92c78c9eee

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              1KB

                              MD5

                              de8f155cdd923ca31de9ee3c85dba443

                              SHA1

                              b945bfe0d564dc77e6d86010d7c866ac26338768

                              SHA256

                              8a26270a34eccb4b898522863b00699ad9a2a58f461e790036a7bfc9e79a46c6

                              SHA512

                              482da73bb6ec6c4127d7e490c04ecf22f74f5abc0778b05cd574a94449a662a3a0dd2febb71acc568fb1351413a2240075b083e76429d16a5144eb82a7d91f58

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                              Filesize

                              16B

                              MD5

                              aefd77f47fb84fae5ea194496b44c67a

                              SHA1

                              dcfbb6a5b8d05662c4858664f81693bb7f803b82

                              SHA256

                              4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                              SHA512

                              b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                              Filesize

                              29KB

                              MD5

                              46e145626dadaa1fc0afe2cab6bfb5ec

                              SHA1

                              7348fc5b301e2ea630315c9cd17c115f25f47b60

                              SHA256

                              4c7b6ffa71ec2c297854bdb1a511e6c40edd7937e41952c67feccfcbb5216631

                              SHA512

                              bda9018032451539f4ce7349bb19ea886353403318ce694f6fce205b77a9c02dc35c6fa8d814e48f715337171df1f73524a7cf262a82d39bd16566ce71c219fd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              c8267e38b24ec6ae1a3e8751e2ec2e12

                              SHA1

                              0696e83ca80c05991ce15c41768301a4b59f4fbf

                              SHA256

                              6dc6280f90ce2cbaeaa7a6578cdf46090961aec6967bcb09fb65a67b34a4676d

                              SHA512

                              cdd7c809f4a6108c36f2a4d8ba3551f5b1d2b6e0efa26d347bdf41ca3d38e0b86ce26c4ae6f798bc0e1b93553fe7aa336c31f7033c89c93a73add0e48b3196d9

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              f444b083612c5d2c6413175a036cbf30

                              SHA1

                              fa19ed234f08ae4eb8e01d444cabce367ea51f7a

                              SHA256

                              b177922c455cec5f5722dce9c753c89dacac37cbb5a2755989ea30cfec61f67c

                              SHA512

                              bf4f80930b318b81895cab04eb04971d630f37c5a7b24999afa35628c0d1245f50c212502062f4140f20ffa25a1f065038fb2c21a1c22d4268b97003a7ba1bda

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              2KB

                              MD5

                              4273acfd012fef420c4997601f9ab39a

                              SHA1

                              4304ea870fbd1e4b234f20a5beaad991db13b744

                              SHA256

                              94190f5a220417a24808ca33dcd39b0790e9828b0d3c3427360aaea8532eb062

                              SHA512

                              bb6ca45d7a0cdfec39ac57ff03794002284ec95daca67b7da0f5423b0e86e2bc9149e3a20db9a9ec6c55499e49aa2f3752bd7ad1869164c38154886be5832b6a

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              5639e1d5859075b68870f54358c8c3cc

                              SHA1

                              e397f86f7c9898a93a433555f8d35bd54d023cd3

                              SHA256

                              f9b39da4e2f47a51dc58e3b509a0c1933521dee43435e17b281331f0d0fc66af

                              SHA512

                              d857f1b92d1ebb06d58b1d8edf3c5c1cc0ae3c4ca10cbe6d02432e4c064763988083274eb631418d7f1150c776c25ec7a288ab30789a3817264ce49df196f13a

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              2KB

                              MD5

                              51b4dedb58fc56507d1d07b34f394bf2

                              SHA1

                              201022bb7bea0d589814da3c0cbb26c236b1c318

                              SHA256

                              97490dc162c3dfd2c53f50bf0abdec6af4b86d93d3b939cd6e16b6ae0c0c3819

                              SHA512

                              4b5879e51bcb94fa6c9854de2de33212e42f1be112866428c701cb8fd9ab31e8357f709d92668a747ce59acd764aec8bd1fef71081d54d2ae1a199aeba7055c5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              7cb23e0bf85cd4f078f7dc27ce997d92

                              SHA1

                              59b4c7ad8c9fbbad72400097229a8169743f9cc8

                              SHA256

                              25479e09a9e352e0f6e95250b268e2fbe95f42300db00871c8e10503d27ca888

                              SHA512

                              aa1995606a6dc1c51a3202766e7d1f8f78900e83503f57ba407b10e8dacb9e37fc60d41a73a1cebe4dea4af04d96a2a1d901d41a061fa002e0e662978eb6bd20

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              6c7a614630cc71960cc6c1e34e001533

                              SHA1

                              adaa6936358b2fbc721ad6cbb512d73ee9bb5f1d

                              SHA256

                              852498b88148266aab118f0dfd81023c0fdda60e871149ba536bfeaa0cfad8ca

                              SHA512

                              dc2725302675fd2bd2353e48f85c1a82c3f8d23a9f9c6b58c7dbf13ecef0af8bdbcd57bb24875b9db379ecc92c9190223812530a6825be9baf384d17dbeeb960

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              f6f9494fee9e2b6d04d2f76dd5f90f54

                              SHA1

                              0aef3adfced40326a21e3da81ff717aa84a22ac4

                              SHA256

                              6fe1c823f5312abcd878f4c43045e004b06a0592258d12dfc68e5206747fabe8

                              SHA512

                              4d22d71fb01b902667228200fd11bf621738b593a5e981e9b8fe9f93bf68029934e68c703dfc81edbb5f5fe6dbf0adfd3323a6b72bdeb8f6b40339896cb883c6

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                              Filesize

                              16B

                              MD5

                              18e723571b00fb1694a3bad6c78e4054

                              SHA1

                              afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                              SHA256

                              8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                              SHA512

                              43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                            • C:\Users\Admin\AppData\Local\Temp\Cab31AD.tmp

                              Filesize

                              65KB

                              MD5

                              ac05d27423a85adc1622c714f2cb6184

                              SHA1

                              b0fe2b1abddb97837ea0195be70ab2ff14d43198

                              SHA256

                              c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

                              SHA512

                              6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

                            • C:\Users\Admin\AppData\Local\Temp\Tar31B0.tmp

                              Filesize

                              171KB

                              MD5

                              9c0c641c06238516f27941aa1166d427

                              SHA1

                              64cd549fb8cf014fcd9312aa7a5b023847b6c977

                              SHA256

                              4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

                              SHA512

                              936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06