Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    96s
  • max time network
    99s
  • platform
    windows10-1703_x64
  • resource
    win10-20231215-en
  • resource tags

    arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/01/2024, 14:47

General

  • Target

    https://sites.google.com/view/congobrands/home

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sites.google.com/view/congobrands/home
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa9bf59758,0x7ffa9bf59768,0x7ffa9bf59778
      2⤵
        PID:656
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=1840,i,17358165426547029816,6240358434142718793,131072 /prefetch:8
        2⤵
          PID:3364
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=168 --field-trial-handle=1840,i,17358165426547029816,6240358434142718793,131072 /prefetch:2
          2⤵
            PID:4536
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1892 --field-trial-handle=1840,i,17358165426547029816,6240358434142718793,131072 /prefetch:8
            2⤵
              PID:3108
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1840,i,17358165426547029816,6240358434142718793,131072 /prefetch:1
              2⤵
                PID:3768
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1840,i,17358165426547029816,6240358434142718793,131072 /prefetch:1
                2⤵
                  PID:2988
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3916 --field-trial-handle=1840,i,17358165426547029816,6240358434142718793,131072 /prefetch:8
                  2⤵
                    PID:4976
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4448 --field-trial-handle=1840,i,17358165426547029816,6240358434142718793,131072 /prefetch:8
                    2⤵
                      PID:4632
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4408 --field-trial-handle=1840,i,17358165426547029816,6240358434142718793,131072 /prefetch:1
                      2⤵
                        PID:2444
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1840,i,17358165426547029816,6240358434142718793,131072 /prefetch:8
                        2⤵
                          PID:4988
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5232 --field-trial-handle=1840,i,17358165426547029816,6240358434142718793,131072 /prefetch:1
                          2⤵
                            PID:3456
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4916 --field-trial-handle=1840,i,17358165426547029816,6240358434142718793,131072 /prefetch:1
                            2⤵
                              PID:2344
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:3352

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\9d99fb03-d531-4b88-b4d1-8aca70207697.tmp

                              Filesize

                              114KB

                              MD5

                              134738f1454755618f6c37d2f0d2577f

                              SHA1

                              136d353dc576ecf5f9e7bbe8368c4562449d07e4

                              SHA256

                              e1448d99dc09a085841206fd92119eeae9ad5129f6dabb5695b44d4bcbcd9c77

                              SHA512

                              b544939aa445277821d0e925c88a5ce3f4b40c3e25d5dc10f00518ec296b543668893adfae6b1fe65358a55467c7cdcd8c7a2dc416a69ef3c6766749d148db79

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              288B

                              MD5

                              ac92fddd4fc39a66e0e9c8a87a0e6459

                              SHA1

                              b2920198bf4f3533156efac1aa0a39b84e6c17e4

                              SHA256

                              383a4c2f21e5620154bcc3be901bd2ff2d3945c67053014178e2fe47483d316f

                              SHA512

                              d8e89caccfd2fc5ae68af9bdf0be21c3c403887ea711306a3c75e540829211200a27007c5aa7ea6d01173309dba73c204e6f2dcfbcdaa3add3248e02950aa96d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              3KB

                              MD5

                              18a1b6c66e99748898521f95ac8071c5

                              SHA1

                              1a7b3eac43099bf7fd99bcb7c4e7447f9b71561a

                              SHA256

                              93ce49e090ba71530595dfacdbf076ed00a821d34445430e1bb269dffe989071

                              SHA512

                              c9d69888cb225e39a8ef18a43320eeeb6eef242032bace052aea0530962823bd6c72a0e75bc4adb6a531c65081e31aa48bf8708101bf9234726d01fb5c0fd79e

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              539B

                              MD5

                              1318d6739048b6766c15fa879eefa501

                              SHA1

                              eda5f4485682c4143396d2dc58f9c91c5f8ec593

                              SHA256

                              9c6063950d83ef1f9d145529e0e8afd90b4a5d0b438c20b653edf45c9c2d192a

                              SHA512

                              6aface5e58d3f6a7f95772fed7d7c26af7195b57bbec1437c7348331bfd3870ee57d56763a9458667ffaeddab313b7ebd2f0e98a8b42fe37554e01ce26d1403f

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              706B

                              MD5

                              4a4f7e9a49464a10524d4859e996fe5e

                              SHA1

                              130fe54235bf2866cb012e582c6d619f56b4cb76

                              SHA256

                              a9335c52431f12d891faba8673ae3417558b6ebf0d07dcbb58ad41817fa4a08f

                              SHA512

                              d1945ecfe81320f239869dcb8d9191a6ab23b117d72cf22f7c730e7f7b0ead9568468a718f20d37f341cc8613c8058b7c62889e043c5501c4f1c96a050b12e4c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              24554c31fbef7a1618b6bcb644f1b83b

                              SHA1

                              316193b7e4f0ea15a328d0e0e5a3c02ada47bec9

                              SHA256

                              d705dc3f47843555f91f08b603763f94ddd90c2d7a0ef3f8efd4e8befda973c1

                              SHA512

                              8fdd5cc922c415c321a5e1ad7ddd0161b4ecf49b8f9e9676304d012f91c2e03c75cd8ca8a6ca99a8602d3d4779ee7dfa7e18825bcf8b02486b4069c1b0d600ee

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              727a84e67a28be63b928004e1d8f35ca

                              SHA1

                              e3b830f8d767a5c7892a7e9e8d66a98ca292ca94

                              SHA256

                              4447e5db2d587d7b4da0b1099ed2d23bac496e8ef5e545419924358feed6924b

                              SHA512

                              54a8c469d199b8f141af7f56cbe6607842d51c3a4546c6ccf838c598ad2d02589633f4016287d50626dd2f8a3664b45ecf8e1fa611c9b373b2bce3560d9d295b

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              780e63e6b8c3fedc5a4bbd80da1d3b93

                              SHA1

                              3080b8e66d3d1dd15027c6e13ac5d01ed5e7b01a

                              SHA256

                              d8d6eab55944c7d930626ccf8c496f60054c2f56c7256965a30ead230ed9ce25

                              SHA512

                              b70ac6b19fb9d35c61cbad264c270e934f6a3a0d5fed67e7fcd1551f1a9f573d3727ff2c134160c161c16d9b03d5ad310828c9aad66f251405b29f80c1ba3ca3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              4b4c92a810d0a9ceff992ed102da0941

                              SHA1

                              52001cfe403611bef06687bdf96fbb8b94dcca43

                              SHA256

                              e0ab677a921db6cf3dfe20f89a6dd1bd3941603da4fa69ed309089ced58151db

                              SHA512

                              50cf072e5b58a928d0f9ef77d02fd9add4b2c03b5a271bf0a47c7af46d686a4c26da5eccad2c4209b7c27a05696ddfe2a254a25cc826de9ad12ad82085b68731

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              114KB

                              MD5

                              a1fe5c086db83596b07dff3e504701d4

                              SHA1

                              f1d67b773a09f05422f399bc242f90bc1402871c

                              SHA256

                              d506662588cf5cdb7256b98fe24e7621abadbe43ff5770ff7a71edb67e01ba1b

                              SHA512

                              74b799653fae2f8ee0aca326293eb37d6397f509574456bce6d02a4c983567792c02fa10f2cc45fccd813b8e04360bda12bb02c68bf602e163ff47916895daf7

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                              Filesize

                              100KB

                              MD5

                              0ea05d8c6e0632314e8d6daf0ad0dd11

                              SHA1

                              52eb15f47f57ea79263f4160732dbed8745d1a3d

                              SHA256

                              3de98851b50038e3a771e3568e9cfef06ace0bbdf1c1d2213702c9e1bac4042b

                              SHA512

                              d7d5e5d7d049f076eecbedcf5e9bad2cd22e1935fb4a8f6ac7688ec3df8f9df8a0fb548a328fe63431e18a335002758a8ef6110fde0d167af7c7628db7786803

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5807cb.TMP

                              Filesize

                              93KB

                              MD5

                              f6cc5a4e798045c27ce0a13e272a0ef4

                              SHA1

                              9c4e22f6c8ea14be2e63de73e74a64327cf94793

                              SHA256

                              a031e02f0d3d4ff42c2c432be66538bf308b38bb980c37a067292f0ca56a134b

                              SHA512

                              7ae2282879198d0f39041ba29dc0b84fa2614137d003b9e25370906840b1ce3902293864ef7ab7d1e210c093027bf16d7d9f16e7c4e861b5c0536d5015b80f54

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd