Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    300s
  • max time network
    288s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18/01/2024, 12:06

General

  • Target

    https://www.zweigleisig.com/#Restaurant

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.zweigleisig.com/#Restaurant
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1664
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6a8a9758,0x7ffe6a8a9768,0x7ffe6a8a9778
      2⤵
        PID:2400
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1824,i,566905179689587841,11495404805355147147,131072 /prefetch:2
        2⤵
          PID:1828
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1824,i,566905179689587841,11495404805355147147,131072 /prefetch:8
          2⤵
            PID:3880
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1824,i,566905179689587841,11495404805355147147,131072 /prefetch:8
            2⤵
              PID:4068
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1824,i,566905179689587841,11495404805355147147,131072 /prefetch:1
              2⤵
                PID:3340
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3060 --field-trial-handle=1824,i,566905179689587841,11495404805355147147,131072 /prefetch:1
                2⤵
                  PID:1460
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 --field-trial-handle=1824,i,566905179689587841,11495404805355147147,131072 /prefetch:8
                  2⤵
                    PID:1612
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1824,i,566905179689587841,11495404805355147147,131072 /prefetch:8
                    2⤵
                      PID:2328
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2364 --field-trial-handle=1824,i,566905179689587841,11495404805355147147,131072 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4552
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:4400

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      504B

                      MD5

                      9abc81fdc0abc7a3ac0ac10898a0c8eb

                      SHA1

                      ebd71c9ff305b81c36cfd432c419ea6ed3934c41

                      SHA256

                      f70311fb699c7a22f6c608394c195fbc17d56bff47662798dd8287f88aef85f5

                      SHA512

                      77581f25967f897525fab20492a0e8af0af65f362a1057e76ccbd65188438d99b2f41a1a7966bfaa986e83463e8357130bd5fe3a9fec1118fd0e242201f56b1a

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      2KB

                      MD5

                      f9afbed1d5fc887e8d391433333e9cce

                      SHA1

                      a5c73ee3eb1fe9607d74bb2c86636f3b042d57cc

                      SHA256

                      dc2a110c748525f2d56ed5c8186747789a2b6689847a0898ebbfc18b3cf84da5

                      SHA512

                      caaa3e12eed99a53881e6073653d498cfaeba2f4883502fab616e890940639ae42083b5d290168b24481d2979a5c5e92efe73726ea98d32376866deddd319696

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      2KB

                      MD5

                      a95739b53a4b49c47232ce7aaf387572

                      SHA1

                      cf152dc1c7351801824ff0ea7b3181e4c66bdd9f

                      SHA256

                      ec0ee6ba3d802c7dfbac0086081cf711de091a2117083a33b96448d9e7b9859d

                      SHA512

                      4bf452f5a25f9a99256bb84fafbc8cfaf30981f635c53c69fed6426b8701d736b01541595941d42207afa9de2e4d8c1d0fd22f1901337ab6c78baa0a4e5dcc97

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      1KB

                      MD5

                      0becdf206f02550b68b664999b1bc9f8

                      SHA1

                      019ecffe051daebebfb9ae1535413ffdd9b37eff

                      SHA256

                      14c43343b27fd8081027797ad8ba4e4887572befbf9d2f5b8223a6653354b0c4

                      SHA512

                      cefb42cedf07ab3030f7ec8a9cdcbded08e63d883950256327ede801a19f35603496288c0408317fe4a3e04098112f7b3b5995a7e312bdbd0b0e7db9032162b0

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      701B

                      MD5

                      bacc4a643b13b2c202e4ee938941d995

                      SHA1

                      514db8614a6dd4d2f766dcb21b11b364ea9f838e

                      SHA256

                      32c14a68aece314ce9fdf94440368fb6a32bdcd635dc39b072d760962542fd8d

                      SHA512

                      e2cd996f69be5d6db797985d1140ca2c4302fc9114c1c777c114159fc5b671d07dec0011b7af050a3847852a08493177f7364aaa3cd64cf3a5d33e6b71fcd8c6

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      98e3b8f3f648d5f2bc82d5a8d97fdf1f

                      SHA1

                      97e812d8390472d1f74af44c572d0ed6a90a75f5

                      SHA256

                      ca59c0a03955f7b6b8c1fce860ec30db87f753ed781cdaa574ecd91e4c64f342

                      SHA512

                      747bbe73556aed021b17cd6303fb897bc79d49cb24442522a2db2dce8e8dfac6e8605be0a12d45f6e1b409e7d8cb5a7effd8867399d0de9ba32d51310d26c8d2

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      7cbe8dc3d6bdae42c469d3bc73cd5718

                      SHA1

                      5a075ed65347215de6acfc0e9304e57f4542dce1

                      SHA256

                      bb805c1787981efef3153ca210e9f8d74678c938002d4335d3b55fe9296ffa6a

                      SHA512

                      87445f9f8e0598fc467d14d8e0174a62431f4570ab98d6a8687c09773c8fce7f0615722fd7d0773705e3eaae292f82b405af5b88eff104e8f7678c4653e9a131

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      5KB

                      MD5

                      867d3f477a33a0ba29007bc0a655bf93

                      SHA1

                      f6d8b39a909e7b936810b728239087c56485b79d

                      SHA256

                      7dbb6c52527336e6c6e733b9382eef043afc958b1ff90c7b8cea11e501d767cf

                      SHA512

                      7413fb7607d086707fade54299d942a6366ea7ec85e9d8d3038610bea3b1b11b1f3a2eb9c43ddd762cc719609a007c608c9cfbb9b4c04ebceeb8ab54bde8aaf9

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f86c3010-e7a1-4358-95f2-5a1a6e995a3c.tmp

                      Filesize

                      6KB

                      MD5

                      91a93cdfec5269b5651f1e3f069f80f2

                      SHA1

                      d7134536f358ce0784daa83d3067ebae090bccac

                      SHA256

                      cd2bdf7b6a578873804403832e4eb8813e2aa3d2c8835ce4d57cfc7198c9482d

                      SHA512

                      790f0a52b4bf25c50310ff8784b051f270c9c3144b155e25c6fd8dc725fbb112c899803df0fdf8d02a95b7247e794787f3fd01c542e65d1196587b00b433e578

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      114KB

                      MD5

                      436ccdf0cf99471d7fc56ee7bb41a423

                      SHA1

                      f4de2a35d832259c8e9efcafa1ddd7e504f51708

                      SHA256

                      db21584c1f37aa2c99df702775cb79782d7d7809be0b26fabcfde001011c63b2

                      SHA512

                      cc710e9c0b754065a0d6a858d1e57159984b2c7257f6cba685be6475e0379bf387f3bca21580caf5a4b89bbef27434a335a7708c9195de5daca5401f0b33fa35

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                      Filesize

                      2B

                      MD5

                      99914b932bd37a50b983c5e7c90ae93b

                      SHA1

                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                      SHA256

                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                      SHA512

                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd