Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    158s
  • max time network
    169s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/01/2024, 07:39

General

  • Target

    https://na4.docusign.net/Member/EmailStart.aspx?a=d779c1b7-2321-4a72-9f03-cf50921339cb&r=6cdd7c84-ea1d-429d-b5fe-4b3955399fd7

Score
5/10

Malware Config

Signatures

  • Detected potential entity reuse from brand docusign.
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://na4.docusign.net/Member/EmailStart.aspx?a=d779c1b7-2321-4a72-9f03-cf50921339cb&r=6cdd7c84-ea1d-429d-b5fe-4b3955399fd7
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3836
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf7749758,0x7ffbf7749768,0x7ffbf7749778
      2⤵
        PID:2092
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1976,i,6085373810593923888,15131352570721045417,131072 /prefetch:8
        2⤵
          PID:620
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1976,i,6085373810593923888,15131352570721045417,131072 /prefetch:2
          2⤵
            PID:2236
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1976,i,6085373810593923888,15131352570721045417,131072 /prefetch:8
            2⤵
              PID:5024
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1976,i,6085373810593923888,15131352570721045417,131072 /prefetch:1
              2⤵
                PID:2992
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3128 --field-trial-handle=1976,i,6085373810593923888,15131352570721045417,131072 /prefetch:1
                2⤵
                  PID:2952
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1976,i,6085373810593923888,15131352570721045417,131072 /prefetch:8
                  2⤵
                    PID:4844
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4632 --field-trial-handle=1976,i,6085373810593923888,15131352570721045417,131072 /prefetch:8
                    2⤵
                      PID:748
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5108 --field-trial-handle=1976,i,6085373810593923888,15131352570721045417,131072 /prefetch:1
                      2⤵
                        PID:4724
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1080 --field-trial-handle=1976,i,6085373810593923888,15131352570721045417,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:2940
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:788

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        96B

                        MD5

                        96bb9415d50d470d3104a67a4380c7ee

                        SHA1

                        57ed59dbbf543a238de2bc695de3e61318471f2e

                        SHA256

                        373a980bb911b33874e5c8a5379fbc4066a851a9f0d80afe4405c94612b063fe

                        SHA512

                        8aa26303f34167814ac5b2c87c7c9e454565e30cc620aeb95729055e194adb36ef5622fdf2c45c421072f4cfabdd693adf09dac80d4d5ab54f10b48eac16e6c1

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        120B

                        MD5

                        91674234bff7750643ca7b4623de89e2

                        SHA1

                        d483874418221004da2c2b84fbc317c0c75fe612

                        SHA256

                        2edad14bff44d2cf7c1fdfa8fa96fddd49f9052a33dedae7a6e250780dbf1118

                        SHA512

                        26f5429b811466315b75711bbde0f9a2fcfa25f999e10d1d1e39dd5eb4ba2eed2d28c3794e3d22faa388d724f47c33e4f7d194dbad94767639201d99a9947925

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        144B

                        MD5

                        d93f4a6036960fda6e42e1cd48e6bd89

                        SHA1

                        c79908e51be335088ed9d80139a2bc526428275d

                        SHA256

                        72aec1a3bc39726e5f57285e9a04f9e3f9bb0acf0cce04197b4beeda2a69432a

                        SHA512

                        880f9200f4c9be4cd8c273ca8b69fd97cc236832663594cdf770db9d72698ba1993e2d3ee9d5eb13f7043fa82a67b047b867f45dc64d98ddb0d7b183624b6d55

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        09a17f195e995cf2c7d6670659dacecc

                        SHA1

                        4c5e680321b49a168179ff485fdb09d7a2b76532

                        SHA256

                        33749907ae18b0eefe6638a2fd15b4313f247f56536fbeefe9feecb6a86d3773

                        SHA512

                        81ae0ece03b64a3a41a6b2afe46bee1f044d91461326b2c72e8dd788c138c7799fc82f3d03462876ac02bb5fa5098cc767b270f2100e7d92549a08eee1ab956e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        703B

                        MD5

                        17078670847921fc31a493ad270567c7

                        SHA1

                        5d793f2847bb54d2bd1f6c648a12e964033a4b8a

                        SHA256

                        2dd30cfdc286147a4b1a06d7cb1e213d5e4955a4de8b259504dd74a354be6437

                        SHA512

                        950c394d7b0ef976f33e8b6301faae42b8c9b42a2423c8ee65c9462b204d3e69a4d51004e784a865008d22cf56a6489bf6901796c5f3cecd95939fb46c32c15f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        ca83492f00866e1810e9ed5489b7a2e0

                        SHA1

                        8300da5aa44a2cbfe0b78ed955412fd44eae404a

                        SHA256

                        7517d540f09f000fbe0416298d92b55955357a695929578fd2a8cef9a7839842

                        SHA512

                        c88681ea18c4ea7f60658e4a185b4f6fe6e930c0ebf3769fe0cf9d0a5269b1238e8b25f2222104b8e3cd58050b94985b323a8b379a480cff5465442f1a0d5a4c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        e7bfe7d027ca7f4d879a67f234e29659

                        SHA1

                        9c8b526048a0043978ddcb094149e68168e40737

                        SHA256

                        53236812716c36fe4bede5e30d894d700d0ba8cd1e4bca86bff5b6339dfc48c1

                        SHA512

                        848fe2b6d2fe63db68e0a7aad2ae74d3ebb03fe6b24478aa3970f55deaeb52edddb7be34990c696eeaea22f914adcb8bdc42b544e52637c821cae10937970d5c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        5KB

                        MD5

                        225a6caf64cc706f7ea3a48cbd296ae6

                        SHA1

                        790d5732cb3e9767af60f290113e31a2a9f0f538

                        SHA256

                        0a16115bebc16ad928d52b57d6402eec38fc545d06ca49ee5b373cf80e87d044

                        SHA512

                        3b2277839b886db7b405279b04106ac956fd7cd391d7db4d4f227684a4406fde319147b13fd2c94487a94b04d95fcb18fc3e4acf78c1c7bad530daaaa3042bd9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        39e7c851ff38dfd64288331e3c3e4694

                        SHA1

                        881ec9e35604cbe474763bb459d4bb141abbdfe1

                        SHA256

                        cd176cd1c84383f3025b428bf2137548335009bc340b6344deaaac89a238a596

                        SHA512

                        f39e8f1ed58029512c1a3024fc8d78094dba0e5d6bdd72594fdfb42e09c8fb45f3ec1b424ddcc8f21d84b4bd04e41623657bdc5c3757a3c04d6283d8fbd40193

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        3ab25198889d69385b4d706614a6fd98

                        SHA1

                        8db28ccf70e7dd9fe556f9a0932d60a3eea44121

                        SHA256

                        8ae48fd9d3e433a196dc5c4be0a28d3feb6653555ffccc581a0cb4c772c61a61

                        SHA512

                        ce9e487a2a9474f8811520074a252662328eda7825d473d8cb554643b694db420a462f61cb014816a05fd06756c1c02c00bb03aa76406c6c4b011257041e9a33

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        1db4107f3759683cd1b3a6705615bebb

                        SHA1

                        2915e1cfb39af56ab8e91e68e36af6436738cbfd

                        SHA256

                        7521e44a207a9420753776ce79d3ec58f713a084317083adfe11ec7ae6f23a27

                        SHA512

                        abb2caafbd61b9f1d39d7c5380ac8c5cdc96d2bc986044466203a04a78215793312ce38df40559151e36a40c29b48a15e9bcba012426901516b8ee4c24d2450e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        114KB

                        MD5

                        5843640c82f0c0c849f7cb6732962f78

                        SHA1

                        5a4cbed83e7e602505d4a4574b05ccd8c4ffa998

                        SHA256

                        3c95767178d5d278fd6b458f7a19cd3b87058d0b28a4446e6104b7b5fb2eec9c

                        SHA512

                        a6510d5676f722c540de57fb94249759bd3e7c7459114c7fdb91185ed333373ea1027dd4f3fdbbfa1195a1b8757f6549a5f8ec5ed2f0385d499884b065b852ad

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd