Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    53s
  • max time network
    54s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2024, 15:57

General

  • Target

    https://action.azurecomm.net/api/a/c?r=AIAACCNXI2CFEGNPA3FZ62QCC6SZDR33TSCMEQXZHM3JM2CYSGXJDZOC2RYRN4SN6YVLCIVQGYVTRGQLIYFJ3ID3MKKWHWF7HWCPEACMYYLTSUJRNIQMFTBTRRQWTNMBQI7HE&d=AIAADQQ2G4POR246OBGCIWJEBR2O3LZZQ7FTTWM4CUIZUXNPB4FYJTDMZNWI5VXCTQHGMPVIVQXVICB5J6Q26TSTPZBTBRTYH3Y6APLDT7XUDPNHX4GTT3RWO6AAQ5ACE7QB3LA5TP4UQZK7JWDYHSABGUBWTAUDLF5K7JUPACAN7Q4LOXVEK6NR5LN3GMQFJL6OH3DUZFFZMEVO2XKDKZ6KWXVD32PJBNUSNK2KHLVJ5F4EURZZNAMCW2VH3BCSRSZS5BR6HWMG3R4IXZLC6OKX74TV2MA&url=yygpKSi20tcvSqxMLC3Jr9BLzterStRPzs/NBQA=

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://action.azurecomm.net/api/a/c?r=AIAACCNXI2CFEGNPA3FZ62QCC6SZDR33TSCMEQXZHM3JM2CYSGXJDZOC2RYRN4SN6YVLCIVQGYVTRGQLIYFJ3ID3MKKWHWF7HWCPEACMYYLTSUJRNIQMFTBTRRQWTNMBQI7HE&d=AIAADQQ2G4POR246OBGCIWJEBR2O3LZZQ7FTTWM4CUIZUXNPB4FYJTDMZNWI5VXCTQHGMPVIVQXVICB5J6Q26TSTPZBTBRTYH3Y6APLDT7XUDPNHX4GTT3RWO6AAQ5ACE7QB3LA5TP4UQZK7JWDYHSABGUBWTAUDLF5K7JUPACAN7Q4LOXVEK6NR5LN3GMQFJL6OH3DUZFFZMEVO2XKDKZ6KWXVD32PJBNUSNK2KHLVJ5F4EURZZNAMCW2VH3BCSRSZS5BR6HWMG3R4IXZLC6OKX74TV2MA&url=yygpKSi20tcvSqxMLC3Jr9BLzterStRPzs/NBQA=
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2468
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc499a9758,0x7ffc499a9768,0x7ffc499a9778
      2⤵
        PID:3240
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1956,i,13485022852092480550,17639106200147872047,131072 /prefetch:8
        2⤵
          PID:4756
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1956,i,13485022852092480550,17639106200147872047,131072 /prefetch:2
          2⤵
            PID:2000
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1956,i,13485022852092480550,17639106200147872047,131072 /prefetch:8
            2⤵
              PID:744
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1956,i,13485022852092480550,17639106200147872047,131072 /prefetch:1
              2⤵
                PID:5096
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3112 --field-trial-handle=1956,i,13485022852092480550,17639106200147872047,131072 /prefetch:1
                2⤵
                  PID:1856
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1956,i,13485022852092480550,17639106200147872047,131072 /prefetch:8
                  2⤵
                    PID:4752
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3788 --field-trial-handle=1956,i,13485022852092480550,17639106200147872047,131072 /prefetch:1
                    2⤵
                      PID:3200
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1956,i,13485022852092480550,17639106200147872047,131072 /prefetch:8
                      2⤵
                        PID:3196
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5316 --field-trial-handle=1956,i,13485022852092480550,17639106200147872047,131072 /prefetch:1
                        2⤵
                          PID:3120
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5712 --field-trial-handle=1956,i,13485022852092480550,17639106200147872047,131072 /prefetch:1
                          2⤵
                            PID:2528
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5772 --field-trial-handle=1956,i,13485022852092480550,17639106200147872047,131072 /prefetch:8
                            2⤵
                              PID:3172
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:2908
                            • C:\Windows\system32\AUDIODG.EXE
                              C:\Windows\system32\AUDIODG.EXE 0x4f0 0x50c
                              1⤵
                                PID:216

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

                                Filesize

                                1KB

                                MD5

                                55540a230bdab55187a841cfe1aa1545

                                SHA1

                                363e4734f757bdeb89868efe94907774a327695e

                                SHA256

                                d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

                                SHA512

                                c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

                              • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

                                Filesize

                                230B

                                MD5

                                55d2d0cb8b762ea12faf9b72babae2b6

                                SHA1

                                ea7e375c092d6e90d47dece99efd97aa8251e864

                                SHA256

                                e5c90e0ffe2e0bb9069f19777c2cb2a976558a32761aa46ddcb89c1d15e94132

                                SHA512

                                6f5efd036b40fd09d5ab04e915e6b7a6dbf2e8c965d7919b8a02caab2c780ce34d8f59ad59eeeded46785c45b7fc5904db2c97fe332fc70f1d55a638e4f5cf25

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                Filesize

                                1KB

                                MD5

                                e9b04ac3df4f98468209937e6d94b18b

                                SHA1

                                e96514bc00d8655bb275c07f8d96dcb8628481b3

                                SHA256

                                1d411336a01194e2d7ad9838357f23ff83f7e281f71408db22cb7cdd4787726e

                                SHA512

                                2ddba2b227d398f35a4d4751414586483948de09d2d9c0b03db9123c4cb4a6a58f754347cca975037f83a374173b90283e183d63e5cf8ed3ffdf41e2d063a483

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                2KB

                                MD5

                                d52de86044d8f4851f735856a6936c01

                                SHA1

                                eb0e2869d21a4a93affbe35300ce88ddaaca1d41

                                SHA256

                                e3bc3389a88970031c11b917a6ed6942dec4351b9bb305bdaa1a59a80e58ef9d

                                SHA512

                                f32323ba37c7bc6e4e5be48e0816a1e61351797606305e0a0c81bb31daa11d51effc226102c4eb427e37ec3f90149addf07de05c251a7029b9e8edcaf3e098a4

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                2KB

                                MD5

                                782fc172ce7ed1a6e87e4dcae85f4fb8

                                SHA1

                                a2e904212a559aa7cd140ec3b6a1feafbb4cc707

                                SHA256

                                e9ea0916cefc561eeb1000f0a6619a64890f6ddf94f858f022009a2527586e77

                                SHA512

                                8a4bbdd5d9e06f80049f7e319ac6711d85b4d0d33910c248080008506b8462213bda7c2f2850dca9e869db5bfde97ab67f8010f3ca76ae1767b7b1a8ae519f73

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                2KB

                                MD5

                                4fbc893d6cabda16768b34e5bc70c37d

                                SHA1

                                465394f281bb9bf09059baa4a7e8fd22bb6643e4

                                SHA256

                                84c7cf8f18511ca517ac9fc8211d3df5ad46854a09e75f130de71450d5d5818a

                                SHA512

                                4204c2490aec97361518834de71e163437e2cd2d53409985768ec1e6614f51bec5ffc68e62c2ef8ec229561f84e2ec89c8ce18b13216bda8fc4ff41e4d543d7c

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                59c8b169c327d5e0e58bd507aa091c7c

                                SHA1

                                3afde73f7f1959db8a0a6ae5ed29b9e5aab0676d

                                SHA256

                                fde64a3b7c6f440a2f54cdd9aec945b08072b2fc6db0cd663542a95a09caecff

                                SHA512

                                fb8d37b587acecc8e6f090b30e154d74131a9a4bb24aea99f6e58d64515ea467117b12c47947deb6f80cbf99dd15676ffc2dfc393c37afb8d60561ccf1c8eef0

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                18e11ca9a8a3d8d3e89acfc12a57ce85

                                SHA1

                                08b7b1e47af09794539b84224b044f39b3214f3a

                                SHA256

                                da5eab0006a9aed1136e619daacf67f9508f2bd2b3e874a0631421a22f0a99aa

                                SHA512

                                9690cd54c781e1e693831968683b230f10932ba3586a490bb457857fcf1704b40fdf372f40668318228cff3d607372a5182bb494f35583a06121c0c437875f20

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                114KB

                                MD5

                                8e66e49093858008339cc187394e2a5f

                                SHA1

                                abf7fc26f6305467d5ba4e765bd5933b1d607c00

                                SHA256

                                b5d1ef1103f7849c5839ee7824ce1fb5dfc6d900c24cd8b6c3eefb9cffd33480

                                SHA512

                                2cc8a4d804744b4499303cc4ce27420d281462f0f06dafb67e383ddd7c4624bdb5147a87b74ba80f9e5b6457b8732ed7275c2452417bed7f0cc089103d283b8d

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                Filesize

                                2B

                                MD5

                                99914b932bd37a50b983c5e7c90ae93b

                                SHA1

                                bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                SHA256

                                44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                SHA512

                                27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd