Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18/01/2024, 11:15

General

  • Target

    https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fon.alz.to%2fsite%2fR%3fi%3d9fbRRffWWnP6L9%2dYsaZpr6W7jnBgYYX7ewPilG1fi8U7GlJqmFTpSw&umid=26147449-e004-46f1-8354-d8de42f8e460&auth=22703eca72d2c61a5658601e78d3fe1b18a78c37-05196a59c9ee8c04258268d12fc8561fc49efc65

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ddec1-0-en-ctp.trendmicro.com/wis/clicktime/v1/query?url=https%3a%2f%2fon.alz.to%2fsite%2fR%3fi%3d9fbRRffWWnP6L9%2dYsaZpr6W7jnBgYYX7ewPilG1fi8U7GlJqmFTpSw&umid=26147449-e004-46f1-8354-d8de42f8e460&auth=22703eca72d2c61a5658601e78d3fe1b18a78c37-05196a59c9ee8c04258268d12fc8561fc49efc65
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3964
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffce8539758,0x7ffce8539768,0x7ffce8539778
      2⤵
        PID:2792
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2004 --field-trial-handle=1840,i,16112409544528817948,7956569089390408461,131072 /prefetch:8
        2⤵
          PID:4408
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1840,i,16112409544528817948,7956569089390408461,131072 /prefetch:8
          2⤵
            PID:1420
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1840,i,16112409544528817948,7956569089390408461,131072 /prefetch:1
            2⤵
              PID:3004
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1840,i,16112409544528817948,7956569089390408461,131072 /prefetch:1
              2⤵
                PID:1780
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1840,i,16112409544528817948,7956569089390408461,131072 /prefetch:2
                2⤵
                  PID:880
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4128 --field-trial-handle=1840,i,16112409544528817948,7956569089390408461,131072 /prefetch:8
                  2⤵
                    PID:5060
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4240 --field-trial-handle=1840,i,16112409544528817948,7956569089390408461,131072 /prefetch:8
                    2⤵
                      PID:3916
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5096 --field-trial-handle=1840,i,16112409544528817948,7956569089390408461,131072 /prefetch:1
                      2⤵
                        PID:4076
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 --field-trial-handle=1840,i,16112409544528817948,7956569089390408461,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4956
                    • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                      1⤵
                        PID:4344

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000011

                        Filesize

                        452KB

                        MD5

                        17f1749d91527d0510e300f182b436f7

                        SHA1

                        8978a6d55566b43cb3418a23fe0d1f0abd305061

                        SHA256

                        daa44fbfbefd783d194a2f2884b0584bd4b2d83e2702b49a719910451c2e5c78

                        SHA512

                        6a2f84c667777ded6eff0d18e549db2e98439a1093f2a18bfd8404fb0ffd812db0959a6b95b486452d5fc68bccc35cdba94f83dd3b786076ddbbce077cf8f4e4

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        552B

                        MD5

                        fd03b6a527af343b236af5c95ba64b25

                        SHA1

                        96c02121572c03adbf5d500175296a7d894d5e42

                        SHA256

                        94474807c8be2ea197d8cddba20b8a5a5c29e2d9c65518c226d255cc2c8e10a6

                        SHA512

                        cebf2609743958f39593a0fa40f4f511e5e7e3a016002936a64e81750e68e03a6d7a302f0fd8b7315a085355d674783ff6de6ce3746ef25ea341aa830b4994b7

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        b1889ee042787197d86fb4eada235ae4

                        SHA1

                        ca7c6ca21c302b1b409895be40286555a6d6c6ce

                        SHA256

                        160be05f11c948770f05d79d86339c5ab2d0c76728e2849b0d5657eb90a9ef10

                        SHA512

                        f1aa7e2cd62dff14c3b76a9981a4daa5aec69fae707b832cb4de2f03d8cbe944b85d149367d1bdfbf441cf5a0631e082e7d3d7780ae70bdaa448ab0cb1596020

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        706B

                        MD5

                        7cdebd917c62c3180bd1a3856d18b54a

                        SHA1

                        45aef4a1f040753e48c05d2db60f5d6de55c83d3

                        SHA256

                        d5580dcf8ff6ee9fb78d1f43c1289c44098bd61aa40ecba65f1f3714b6df5b79

                        SHA512

                        848f5301c437fb4b06e3e7deacee5f25a13777065d7960b9028beb37e728a8ceee19264a2977812db3f8c3ea3c10d7fc4f78ffa515ac0e30ebef7244f546cc90

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        93d85f91e62f4b19a6910223d0e0e030

                        SHA1

                        ad54d50a5e2800019dee0b14d16c9cd48b3119da

                        SHA256

                        473a9b5164b2ccc02da0d4efa4feb2215799a7429bf46dd509868fd939f06ea5

                        SHA512

                        446ad83330cabc4db7a059ee03538033ff2d754e10b8cf8958b2c8936da51bf224bcbc92b69e86561ced747c3e8b47cbae46ee5a1e4050c1ca59685a847d7540

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        6KB

                        MD5

                        6f9a99b1bb66e68373d54ef0059c000b

                        SHA1

                        165db4e34c0210b272620c904339270cedcc2090

                        SHA256

                        4ef42f54ed311f8cf9acdc3a6f83315f393cc2960acd56897399220eb39c1624

                        SHA512

                        3063c8a20f8d64e1d2cdff296e0ec7a428d42414cac34dae487c0527462f79cc4b3168efeaa147008e549bf07463b9a32bb8c44bd435c0fcc2e0ad7c34bce243

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        114KB

                        MD5

                        a722351390c3f1daa32c9d0e58350911

                        SHA1

                        51e65302154de9e86b986b246908b1f6c83f1b44

                        SHA256

                        8bfe78c25cb4da4278245f5b6fcde44def0e623e3d3e4333ed5de3ab3542de3d

                        SHA512

                        c2a56606d53e7df7e233d50cafa5ea745c82f6057dc3a5dbe2480a260f2a5bcc94220332ad85e65e5e66c68b46b30c9b7ee5f5805e2b487d2393c25798135828

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                        Filesize

                        2B

                        MD5

                        99914b932bd37a50b983c5e7c90ae93b

                        SHA1

                        bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                        SHA256

                        44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                        SHA512

                        27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd