Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    600s
  • max time network
    570s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2024, 03:43

General

  • Target

    http://sd.bhu.ph7techmologies.ca

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://sd.bhu.ph7techmologies.ca
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1624
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffedbea9758,0x7ffedbea9768,0x7ffedbea9778
      2⤵
        PID:2400
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:2
        2⤵
          PID:2676
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:8
          2⤵
            PID:4988
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:8
            2⤵
              PID:5096
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:1
              2⤵
                PID:4600
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:1
                2⤵
                  PID:2172
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4036 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:1
                  2⤵
                    PID:2804
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2996 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:1
                    2⤵
                      PID:4368
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4992 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:8
                      2⤵
                        PID:1944
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:8
                        2⤵
                          PID:4328
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3772 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:1
                          2⤵
                            PID:3264
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:8
                            2⤵
                              PID:2852
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:8
                              2⤵
                                PID:2512
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2312 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:1
                                2⤵
                                  PID:5456
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2884 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:1
                                  2⤵
                                    PID:1832
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2528 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:5928
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4896 --field-trial-handle=1904,i,1968431420891300098,3891828496759096964,131072 /prefetch:1
                                    2⤵
                                      PID:5876
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:5008

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      1e9fc678f17228b20973a62d772d43ec

                                      SHA1

                                      807b9f8e20ffc0edb7814daec1e566a487c804f4

                                      SHA256

                                      55fba89c04650ac291e5cfe930ab08d6bf7328ff054af00e490e6b23e791f5b7

                                      SHA512

                                      ca0e4c3154392b2c9de06655b9feefc1599bb64cbcdf70c263b2a8538c596a27c2baa04781eab061ecc3ca72a62d409d2ab9eddf56feadf571e71c4964d1fbb9

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      93f4d8cfa3c3b5845f6dd6033254bf3d

                                      SHA1

                                      bf0aa2d9864a34e510e7ab2e548ace7136abe311

                                      SHA256

                                      8eb58b4992555489a7a808238004e8d0b994ac407a1a13927e98c5f1ebff88e6

                                      SHA512

                                      64e6133bae8198bd48fbe712a7b25afe65cb5d8d86ed65cc6c4c11858807c71d60ca71d58ec900ef038be31d5c3483d3c5de5a0ca06e0920dd741453a24199ad

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      a84d30ef8188768d1e11719832faf2ee

                                      SHA1

                                      e9cf1982626076a512f44c2456d53f1f69d99d40

                                      SHA256

                                      b8227213b7572ea8c03644fe19c0511c51eb8ee3f5bed31f2a1aa38a02cffa25

                                      SHA512

                                      3d26c4ce4a0c3d88647d8fb0c64626a1840095e93228e81cfe87d5d8fdad4984327323181568d325aa1080f6bec58f4f8f5afced52eb31e113898d46a60a80aa

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      115KB

                                      MD5

                                      57725859336c79a77f556be736f80a78

                                      SHA1

                                      b3aa0bc56cf5c5652e29225dc9fb8f20324c9ac0

                                      SHA256

                                      a8fa0878a82b9675f81a9c958e308bdd401ce1645d1c95de40795820816c8147

                                      SHA512

                                      f03803d77b1e9bdff49da01f1e528ec61228b2b5f541e91716fd8b2a933fdb20d29b53fd9051ab5f0184b1eb523952a60be9db2c7ec45a2a07c3415f292a03bf

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      116KB

                                      MD5

                                      de0273d2f48ac28e594fde8bea3e9aa4

                                      SHA1

                                      c1c4a36e972b9bed470874cdc3d408d30dad5f8e

                                      SHA256

                                      578735229312c8b4e9ec19817a3f2af78b683a2fa69c08658ef555f8c601ac71

                                      SHA512

                                      93d6b8465b49757e57a5d573a17860e53142d34f3f6b6d1067d04d4acc19ac2ec900cc31a4229273bbd0c70d6fb80baf84dad95f65344c70ea4fa5b3c995566f

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      137KB

                                      MD5

                                      ddd06d1af4a05c319ba4b8d616ec1995

                                      SHA1

                                      43c45cf518b9d2c009fa5afd5a5754bc52aea8eb

                                      SHA256

                                      df2fae3bb90201f39c02612713015b1e0a939eb0b197d4b80373368b44ba826a

                                      SHA512

                                      923e6b8cf2f70d4219b3e6fd3418beca404d8ad66b2ae7cbd7ae98a976c903bf61231511af624817293c26ed55337b18439934f07bfb611f727b1b1d686e4255

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      115KB

                                      MD5

                                      ef904289980ce00251411a2a5618b636

                                      SHA1

                                      c84dabfee225123b27f8bbd9248f8386798bfec5

                                      SHA256

                                      53689abd473c997d0aa3f536ea2df05b72165f49338660336f36724d5d90af25

                                      SHA512

                                      925fa0e616eb4f9cf9d26e6cdf330e623bcb5b89ea4e2ae5a4f217f9e4abdcb148b24d4979be1ad0ab0d087a2fd68ac5b6553a79dbcceb310e2d979ec99204ca

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                      Filesize

                                      2B

                                      MD5

                                      99914b932bd37a50b983c5e7c90ae93b

                                      SHA1

                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                      SHA256

                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                      SHA512

                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd