Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

27/01/2024, 02:54

240127-dd6dnsbgc5 1

Analysis

  • max time kernel
    58s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27/01/2024, 02:54

General

  • Target

    AboutMe.txt

  • Size

    107B

  • MD5

    62112b74e8f1bfb02ef2c004bb2a5117

  • SHA1

    534c1e1f0da2931ffca2499e150c4fbde71f56ab

  • SHA256

    7a700be3ce6345895db90ea0cbde38864a886ea98946d9bbc1313b851140cb83

  • SHA512

    a6bc8e87c28fa00e264aa95b18097994188373a0132f37a2009138f8857f3fe88329918b55d230580e330d73c2f0139aa16e0769570f94cbd9fcd223b3c912c7

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\NOTEPAD.EXE
    C:\Windows\system32\NOTEPAD.EXE C:\Users\Admin\AppData\Local\Temp\AboutMe.txt
    1⤵
    • Opens file in notepad (likely ransom note)
    PID:2120
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2792
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7839758,0x7fef7839768,0x7fef7839778
      2⤵
        PID:2804
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1104 --field-trial-handle=1332,i,393776725642592131,1962169214470058995,131072 /prefetch:2
        2⤵
          PID:2600
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1332,i,393776725642592131,1962169214470058995,131072 /prefetch:8
          2⤵
            PID:2664
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1332,i,393776725642592131,1962169214470058995,131072 /prefetch:8
            2⤵
              PID:624
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2324 --field-trial-handle=1332,i,393776725642592131,1962169214470058995,131072 /prefetch:1
              2⤵
                PID:2148
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2304 --field-trial-handle=1332,i,393776725642592131,1962169214470058995,131072 /prefetch:1
                2⤵
                  PID:1876
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1460 --field-trial-handle=1332,i,393776725642592131,1962169214470058995,131072 /prefetch:2
                  2⤵
                    PID:772
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1380 --field-trial-handle=1332,i,393776725642592131,1962169214470058995,131072 /prefetch:1
                    2⤵
                      PID:2496
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3460 --field-trial-handle=1332,i,393776725642592131,1962169214470058995,131072 /prefetch:8
                      2⤵
                        PID:2080
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3572 --field-trial-handle=1332,i,393776725642592131,1962169214470058995,131072 /prefetch:8
                        2⤵
                          PID:1276
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3468 --field-trial-handle=1332,i,393776725642592131,1962169214470058995,131072 /prefetch:8
                          2⤵
                            PID:2444
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3688 --field-trial-handle=1332,i,393776725642592131,1962169214470058995,131072 /prefetch:1
                            2⤵
                              PID:2972
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2712 --field-trial-handle=1332,i,393776725642592131,1962169214470058995,131072 /prefetch:8
                              2⤵
                                PID:2900
                            • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                              1⤵
                                PID:804

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000009

                                Filesize

                                192KB

                                MD5

                                5036f7c363373f5d9cc2b6519806feae

                                SHA1

                                3caf2148a2eb7c82f9aff0f3a2f4594ee70327bf

                                SHA256

                                715c5d3e3839c1b47c3008e8a89f929e60858ee379724a20775003c692e9fd6c

                                SHA512

                                4661cd6fb02dccc48a42fe127b1e88f7e794cd4eb1d8a5a8f5075f772dad63211efa349bab579c5bb81bfb2c4b1be201c6725a56f617f8913a2235e3565fe645

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                                Filesize

                                16B

                                MD5

                                aefd77f47fb84fae5ea194496b44c67a

                                SHA1

                                dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                SHA256

                                4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                SHA512

                                b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                Filesize

                                264KB

                                MD5

                                f50f89a0a91564d0b8a211f8921aa7de

                                SHA1

                                112403a17dd69d5b9018b8cede023cb3b54eab7d

                                SHA256

                                b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                SHA512

                                bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                1KB

                                MD5

                                a98f50fe178d5ff1f23ff928d435ca0b

                                SHA1

                                3dfd8257a017e29ac8d30303fcf8f5ed72680078

                                SHA256

                                80dce777f5a75e0a9f49190852068b9b78e519aba18fbe81ee7f67b68968a57b

                                SHA512

                                99e865599668e2c20aacab48a3f61730d335d1ff2f05fc949c5ab3d75fb98cc69b34d598a1e5161201fcd3438a465df111a5728891f1185bf9bd2e9ed4df377e

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                Filesize

                                361B

                                MD5

                                6b197d0ff4b44d121a34589e17a09a49

                                SHA1

                                392958ce231195db98d71df9b4384f97cb57d52a

                                SHA256

                                3d9068388434af569819e28803e1260996f778ebe4615aa7edb53b1d1fea3c4a

                                SHA512

                                92d04372e228cbf67b3d80795c77bb4a96121ab76e2dade25b488907b718eaf5e9573dbe5c846f7ff41e833fae2c714800c3887f3f84ec5fcddd3096c5a65d86

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                6KB

                                MD5

                                73cd777ef9b0972701a8591129ec838a

                                SHA1

                                5598997fe9676e9ba42988e5f2bf24ee09478bc4

                                SHA256

                                9854eccc54e5795514398688a28a2fe74225c4321f5c1a06292eef4211c7c5a3

                                SHA512

                                1fd56d0d323d6a8b69d394a61ee32d7d26c6f60540f6bc72bcd7a40440ee750753ec4e1adc03200119e16bd729cc5c35e4e99d4afe5b6d035971ddd84a16c953

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                5KB

                                MD5

                                8a044717549befa7440baea80f928f98

                                SHA1

                                b0c82f5f72154f1d6e60b3420e74e858e19be98d

                                SHA256

                                7f49fe0ddb36c4a7e65d1384d5031c1e9d2f4edd5c630a1f8084f742c4b4fcad

                                SHA512

                                9d68df121f0b29a2217beaac17f1b9166e5918d2b09e2ce247f63705a5d845d2e2ace7b87903742060521419c03eca21dee6bbc7e1f74ccfe3989c8168647d47

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                Filesize

                                16B

                                MD5

                                18e723571b00fb1694a3bad6c78e4054

                                SHA1

                                afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                SHA256

                                8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                SHA512

                                43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2