Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/01/2024, 14:29

General

  • Target

    779a8dd084070541deb0fcc483f36d16.exe

  • Size

    88KB

  • MD5

    779a8dd084070541deb0fcc483f36d16

  • SHA1

    e930153a7546046aa4be54d458215428c79b86b4

  • SHA256

    caca7374602035a6ca33725856204bbec446012dfcbc8ba2c80da90872a18fc3

  • SHA512

    bb8ee5b0e4fb0b248e844c48d7cb98b945f751bf77eae9bd1ab5b5995becd353ab08a6239d8f75d430a9508d4762d881d86cac769da0b955983998911a3c3008

  • SSDEEP

    1536:2cXasPLOoR/BDZcQipICdXkNDqLLZX9lItVGL++eIOlnToIfbwwNOj:2cXOmCRkGbKGLeNTBfbDq

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\779a8dd084070541deb0fcc483f36d16.exe
    "C:\Users\Admin\AppData\Local\Temp\779a8dd084070541deb0fcc483f36d16.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5056
    • C:\Windows\system32\cmd.exe
      "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6031.tmp\6032.tmp\6033.bat C:\Users\Admin\AppData\Local\Temp\779a8dd084070541deb0fcc483f36d16.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2336
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe
        3⤵
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:3384
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ff98a889758,0x7ff98a889768,0x7ff98a889778
          4⤵
            PID:2256
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:2
            4⤵
              PID:2520
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:8
              4⤵
                PID:2744
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:8
                4⤵
                  PID:3996
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3092 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:1
                  4⤵
                    PID:4848
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:1
                    4⤵
                      PID:5088
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4728 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:1
                      4⤵
                        PID:1320
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4824 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:8
                        4⤵
                          PID:1616
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4836 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:8
                          4⤵
                            PID:2596
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5100 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:8
                            4⤵
                              PID:3356
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:8
                              4⤵
                                PID:3244
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:8
                                4⤵
                                  PID:2988
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:8
                                  4⤵
                                    PID:4336
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5400 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:8
                                    4⤵
                                      PID:4520
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1924,i,13913440316962422393,13470017136141245305,131072 /prefetch:2
                                      4⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:740
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                1⤵
                                  PID:4564

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  36f428f9ceb3fd37881d0b0879764279

                                  SHA1

                                  43acfe356e13cd07ad75d5a11cefb2c163653265

                                  SHA256

                                  64c1e7a923f1ef01687b42741042c7b78133eda625696670fd317f4c137df841

                                  SHA512

                                  d726b3267383253152a02be6443eb6bb52730b82df6da9cd6e28a88599052532eaf8abfc4a17750417e6c7bd3ea0350c9c17e5446d1cb58253f4e953320abae4

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  371B

                                  MD5

                                  8e599b630113165e3f1a34ebab0a1690

                                  SHA1

                                  96bd5302082e354627a4bc06e39824eedb0040ea

                                  SHA256

                                  317d3444c6d099271b298fe480f78f69e5d01c71cbf45054b5aa18fe4afae732

                                  SHA512

                                  085048eb253a101ab8c695834e1216fd67168d456ee719ee810cfdb2ea9b6ae53a133921eb871785396865ff42f7c662c980f4e83d719026ca5398fdfffe970e

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  aef949b4ddcfe5b972fe7847bc702edd

                                  SHA1

                                  7b8734e9b774022ae2d5a65035517e69de1568e1

                                  SHA256

                                  a0171fa139424380d581173ff9a251fb57c7923625d439ad62be0ca05aae4fb9

                                  SHA512

                                  4eaff6b7cb09b0e78d31cc42cdcbd71b6329ef1e6e37dd2e2be9786993908b667fe5ceaa55a4bb803f0abb15b36a908c81d5d81ef94e48c4ef21cdd4ceee9e35

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  5c5ec3e262a5ba4cbcd57c05b49afa0c

                                  SHA1

                                  c1f80a4ee7d3f09886384716e7766f843b96d8fc

                                  SHA256

                                  70a5efe1f5ced82525a4c960c8d7b7ef947f4c4643a2b899625120e7ba7f69c8

                                  SHA512

                                  957998cbf1e11ad16f0651bf899de0d4fd8398748e7ad65756e749489fa383720bd13091e5c73693c8ad68d106c9741bb2ce132519964a1d45815acc6ab780f6

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                  Filesize

                                  15KB

                                  MD5

                                  a4c9c0ff1179c5386bfdb1994d833120

                                  SHA1

                                  1aa7b99e97343e8f21b8716d748dec490f55bb82

                                  SHA256

                                  9a9ac146cb97d202b1c6503364e2f5174ec3e06cf58158af58fa9f43037e6e80

                                  SHA512

                                  4f64fa3dc54eac68c221334513538c3078cb64d0cf969a18f6543ada7dd97f2c98a45bf0fdb7a6b642f6b4e09e10215dcc01c693db99177b6b608ade858dc85f

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  252KB

                                  MD5

                                  62c15649e7587f33458aeda7988238a9

                                  SHA1

                                  4c4c3f063dab59fbbf9ad42e046d5ecbd0f63569

                                  SHA256

                                  b8c2ac83c5836d4fe2d2d87e621cc1f27d8f4eac8d568dd1723ad92170a558f5

                                  SHA512

                                  d8c570459c9411d403ad30195c78aa98432fcab321f4359de0591c50bfa0b918a3e3d142c6083dc1037445e6ca3ff6f201b175bccd0c94ac08492e4747868e3e

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  115KB

                                  MD5

                                  e440b2cb3bbe7985160bf085dc0f40bd

                                  SHA1

                                  eb1f3e289417ab10d30c866ec65004a18de5804d

                                  SHA256

                                  ce1c6d1e22896b9bada7227f90da15e7b9481e6c0f16cd4d0b4d1001c4c43a5e

                                  SHA512

                                  bf622955b016c6ff9dffbcf5011d59c754e75d1d89999a29df0af4bec563c3d18c4814d28f8c01385e2fffb0758567dd55233f6d7688be195f2bf53b0173ca49

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  233KB

                                  MD5

                                  f8fc2460fbad947adfafa1a6a3d61225

                                  SHA1

                                  f93062bc8e21bf77365261721f513aade37c0f27

                                  SHA256

                                  a71ba8d8e5f3577933a30ecce736a95a73b4ab07ddb09ecc8bfcf86897ab81b7

                                  SHA512

                                  0bd7ea8660f2c73a1c20ff448990fadbae222ba739e03cf7564bb7c6c907a5e2ed2fb9544abecada5d3fc71e466110809deddb124e1a470c21a433696744d03b

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  232KB

                                  MD5

                                  400238e74c8dedd57ab1698f5c43932f

                                  SHA1

                                  83a8f96a9acdf483c8d88eb937af0303555c18c8

                                  SHA256

                                  8a18c05cc6523adc2acd6e9c53216bf3736d441889e1f5fa4cb865e7c025d52e

                                  SHA512

                                  69d9dc2439b5e1b9518fad816c94912bfc3746745725563597d55366f1f93fac333e99f6007d2883f8e0e0641bc06fadd10608ffdac290b8d7365e3a448f5c11

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                • C:\Users\Admin\AppData\Local\Temp\6031.tmp\6032.tmp\6033.bat

                                  Filesize

                                  206B

                                  MD5

                                  9f3853188c56b93b4679991c8b41cb79

                                  SHA1

                                  e27443fbb97d26c9a3ceaabfc26f268241c21a08

                                  SHA256

                                  62d0481a976a6e3de0ee7d00a795e1e141867d39b1eedeb8a5311c9ef059ff05

                                  SHA512

                                  a771492c3125124e8ba1ca07993576450b49b89cb917317549957c655cbf756e71f3a871c4dabed3e6922c9a019669f05894654df48da763805a603c41b83e0d