Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    103s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/01/2024, 13:09

General

  • Target

    https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//megraftermillinery.com.au/hjdbhjdbjfnjfbjhbfj/hjdghdgtyftygfy/Examplel/[email protected]

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ad.doubleclick.net/clk;265186560;90846275;t;pc=%5BTPAS_ID%5D?//megraftermillinery.com.au/hjdbhjdbjfnjfbjhbfj/hjdghdgtyftygfy/Examplel/[email protected]
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe18509758,0x7ffe18509768,0x7ffe18509778
      2⤵
        PID:3568
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:8
        2⤵
          PID:1744
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:2
          2⤵
            PID:1156
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:8
            2⤵
              PID:3480
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
              2⤵
                PID:5012
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3124 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
                2⤵
                  PID:2892
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4676 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
                  2⤵
                    PID:4392
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5052 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
                    2⤵
                      PID:4732
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3144 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
                      2⤵
                        PID:4708
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3912 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
                        2⤵
                          PID:1404
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5232 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
                          2⤵
                            PID:4796
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:8
                            2⤵
                              PID:4652
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:8
                              2⤵
                                PID:3144
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3912 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
                                2⤵
                                  PID:3644
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4944 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
                                  2⤵
                                    PID:4052
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5956 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
                                    2⤵
                                      PID:3700
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=5324 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
                                      2⤵
                                        PID:1940
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5612 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
                                        2⤵
                                          PID:2784
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --mojo-platform-channel-handle=5596 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:1
                                          2⤵
                                            PID:212
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1740,i,14641111454193849352,1150118842964583616,131072 /prefetch:8
                                            2⤵
                                              PID:3928
                                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                            1⤵
                                              PID:4736

                                            Network

                                            MITRE ATT&CK Enterprise v15

                                            Replay Monitor

                                            Loading Replay Monitor...

                                            Downloads

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              120B

                                              MD5

                                              559f7416f7fdf706b1e230db9b4f1cae

                                              SHA1

                                              3f3d8c6e3c83e380365a7a1b60c5ea8551a143e0

                                              SHA256

                                              d0c83e536d0d9dd333aa53dcdece6b21709249c1113a12230c0f9d7edec246ee

                                              SHA512

                                              8384240ce633ed0b45906d9f5fcba24457cde4f979eff2895451821d1b3d2a23129293cbe3118e062b38f133b866d8446649d89dbc798bfe400e5342d80472f3

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                              Filesize

                                              216B

                                              MD5

                                              88b740efc88b2c07f9e95f1300d7b880

                                              SHA1

                                              d00b4e146f7fcee7ada87500643a8c1ed77c0449

                                              SHA256

                                              5655ad99b84387d900d3cc48cfe2d033023962d6881d22d5d30a84511f348c3b

                                              SHA512

                                              83a45d8081976d24cd2904b58a77c6572475875f691c6a71cfcb880cd1dd5f1b2a4b3f2e28f6f466bbc7f104f80af2249fad66244f5ebdea86873cab9bc2d473

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                              Filesize

                                              1KB

                                              MD5

                                              68f5e1656df0fb832283d2ac8b482a42

                                              SHA1

                                              a3362bf7d5bde9c5a587ffa4d0986777581834f6

                                              SHA256

                                              230a26253305da8ce08600918148362d414dbb8abc52397fa663539aea1fca4e

                                              SHA512

                                              991045ec721eeab9a09a8ed4f53d6619bfa9258f4f29c078b9c03dbc8e5d02f34528852e66a3210f4f714b83bc78962284d3959a2db725deefef86e6a4b57264

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                              Filesize

                                              1KB

                                              MD5

                                              33125e6935d4cb278836d8d1a0e6d523

                                              SHA1

                                              57371a38e361c7145a09915a306892e0ae4c1ef0

                                              SHA256

                                              8daf16fac5df72f3b0cf29b60d24b5a760c67fc841ef0ca5d2d259b78338b0ba

                                              SHA512

                                              474ffd0eb57847a60b1395b287c40a6b5afff7e023f3cfd9be3814c8d8fa5d82f3b27c627024d4e2dbfa11e857db864ac2383d8ab0c305466a4b9bd37326e030

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                              Filesize

                                              1KB

                                              MD5

                                              a282049fd1d7c60b4ea76862d55766cf

                                              SHA1

                                              7da2d1d396a7de39fd22b80035e233007b396947

                                              SHA256

                                              b32c1f694aed629fe28656dc9eb441cf9db193932040dcfe8f1c32b2dcb0f358

                                              SHA512

                                              342bb39939eb60abe05ca67ce03de613e02dfb89df049f9c0a2edeec09308ec3a6639093227cef55a3b5e2a6ad72a2c18fdac5e473f02345d765e4b5ec5536a0

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                              Filesize

                                              538B

                                              MD5

                                              def7b85686a0ff196069b38e529c9d76

                                              SHA1

                                              f994debf1329f0805d371953bd80796b6bf5f6ad

                                              SHA256

                                              bd97b68615e30e79716058eba2e1d9918a2da5f36eea7ddfdc61c0b7893e2004

                                              SHA512

                                              901830fd661e504b93a471bc74e05d2386cb9815eb167c707deb13f951801165c0488a7fbc2a83497fa458e9c8df3cddb2f41aff94ce3b7faedc884414c57fed

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              6KB

                                              MD5

                                              e7f7829deafcaa8b837745fde0db5b07

                                              SHA1

                                              21d804fe838685cdc1d0baa56fa962f8222159e3

                                              SHA256

                                              8d4f1c71b277eb5d782a8450e5433936bbd426e461bded57ac1974073bd90b42

                                              SHA512

                                              ee571b0419c7ad12e82646517bf16ed65839133885777eedcdc060e1f26f82acb2146bc8a9f2c6242899ebfd8f760da3a19dd4e7dfac5ea093229919fb389d13

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                              Filesize

                                              7KB

                                              MD5

                                              6fe1d936fc90118e90d6b6cd0b0b134c

                                              SHA1

                                              ffbc786af741c0df6c85e76d3a909d094e889481

                                              SHA256

                                              9d6b16c4e8bae17e14623335b78ade991d9eecd6b5b4d05769e11719d92cc3f2

                                              SHA512

                                              a042248d702e0ba2389ed8221e2b07b921accc9a2ecb96d808ac2b4775fdf0fac38f15490e8210f9d55ab6b6c85f7fe3810604f8961648885a0f93dbd4b1d9db

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                              Filesize

                                              114KB

                                              MD5

                                              2784a00a753f7ab04d6949ef9c957f16

                                              SHA1

                                              dab4e6ed7ac1182fce5cc4918afadd66e2227c06

                                              SHA256

                                              80cd0806a40b20c10266500358cbcb7483d7cfaf04f46cc3f19f4cbb7de4de5d

                                              SHA512

                                              f1a08bef502a3d59e9d7220e98de9df5750e783eb9ec9cd11fc8739cc4340ee5cf2ab04593c28efdd07b815ca048aa42059ef98cdf6ffdaa0a1c15cee818d37f

                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                              Filesize

                                              2B

                                              MD5

                                              99914b932bd37a50b983c5e7c90ae93b

                                              SHA1

                                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                              SHA256

                                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                              SHA512

                                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd