Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    87s
  • max time network
    79s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/02/2024, 15:46

General

  • Target

    http://codeload.github.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://codeload.github.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95f269758,0x7ff95f269768,0x7ff95f269778
      2⤵
        PID:4624
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:2
        2⤵
          PID:4164
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:8
          2⤵
            PID:4776
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:8
            2⤵
              PID:3828
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:1
              2⤵
                PID:4884
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:1
                2⤵
                  PID:3184
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4556 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:1
                  2⤵
                    PID:3240
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3848 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:8
                    2⤵
                      PID:180
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:8
                      2⤵
                        PID:2888
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:8
                        2⤵
                          PID:2332
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:4980

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          2KB

                          MD5

                          7a113cbfd8f40773f51c25409df84295

                          SHA1

                          ecfd6665c5d25d72dd56538d472bcbcb2d04e13f

                          SHA256

                          7ba061c3a07dc3009fcc74d707b9fd239e59895b962f893723142b81458c6ecf

                          SHA512

                          17703db6eba972f0e3edfaaa646dc8bf2f3f4b4f542fc53324b09896129dfcd8f794bd3dc162aad4ded356230be71fb26e3ca7a45f989a693701dbce44f31b75

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          63273fc639136f3c4a976f74aea620bc

                          SHA1

                          063f4c4bbe4b4a59f45df434f8b4b5fe7c9a9617

                          SHA256

                          77fbec30d72a81bf717c05f243663c420448967edf039cfedf2a0bacc2850809

                          SHA512

                          9361ef22eae7100e9ae9d97c7748cee4051cb32ac93128c7ae48251a1d54ecd05e8549cac26c9466b9855b9ad1f83df75c3f62bcff84c188b3117f9be60fbfb4

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          3518448a857db3baaca8811fcbeb1435

                          SHA1

                          21d306b07de120807cb935995f0c9aef531dfa64

                          SHA256

                          0e928f36380c9b06c46580f221d3dc80ec8357fd6cfc739d01d69ea017ce8708

                          SHA512

                          7129951414d8e52339b5298ede2786787d3cdb3b35812792505cdf45cf08bfdea0362ce766edc9a752c40ed0f538580fe06a296ada1470fae10e0c4872210c02

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          64e69d088d5cae188775b7b52353df73

                          SHA1

                          3e64efa7aaf8d6cf65cacd6e571ac790d05d28ad

                          SHA256

                          0a2ac2bdd858523d5df1f8ba3ed4d740896e527656a9af882010cdf54ff59462

                          SHA512

                          f66e39f057c7dd912ef71cd16857f082f32198034b6edb700ce43c0e50db97bb8cc848ed803aceedc6c884c35b03ecbb0dc238734c1a48b355d4242eea985d79

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          62c22b3027370d02112ceaeda6c7d139

                          SHA1

                          cfad55bc3d04ec87e8cc0d851e9c450442f248e3

                          SHA256

                          2b272cdda4ba5e64278bc55ff892649f2f475d8815ec368954c88ebe7635a076

                          SHA512

                          06fbf458f76c9cb65e6e0724915dfc33e9fa3fc5da38b5e40b3fd59889b8655318e8ad72d43072c32a389b64ece9a079cc175e4f6a89aa8d6047a52d913c9438

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          84aa5d0fabdbdf7634fb0f63679f0eb0

                          SHA1

                          0873a9bd809d6baaf71cced7ff885f58ee5c7b8e

                          SHA256

                          0889f43aa33e8f481fa6519a1a2f979d5d5eaebf07f8da9dc91268ff5a858399

                          SHA512

                          614cedc52cf0049471426fe6453922d2cb76002207a3574ce37e2f81327fde1c16cd0e174aefb1da960d6687dd1a1ffc2b141f30eb4cca03426d924e52827636

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          88a135f7f5cbd0adfb3721773529212f

                          SHA1

                          c1e2819b71409e55dfe784a3dac9f8fda8a444b1

                          SHA256

                          d9f8a71bdd6234a38726e716f2cba892b7dfac28ea73e16a13afe04c92c3174c

                          SHA512

                          7075e345c8ed106f0139828b50bedab45a27cee25525f5d5efb82e455ab606555d28cbf83bff4333d67c9aa374219cb590b5b790abea5ad6a583b1d67ddc93ec

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          93ef72851b452dd853bed47f13d84501

                          SHA1

                          f4314cac2c9bd63bf0e375aad0767b8dc7645f19

                          SHA256

                          89f696371b83bbd38d8707b83048b96df67fec84b0d5f29e3e4b064e7ea60e18

                          SHA512

                          01ad6401fda81f110ced5a503e7e4e973a4c0258aafb7312dc276aa3a6896eaa7abe7d8dda2bda1510850d11850310706dc0cf90cbd12677ed75a821fc4a6924

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          07e510266b2b18494c16496454ae71c7

                          SHA1

                          5d488242fcf163ae007367d8ff16fcb1a9901387

                          SHA256

                          c822aa847d02e1154c966c2d805ca4ad29efaba3dce6dd0c645c4ec29ecb89bb

                          SHA512

                          487b8c0c1b11c0f2a2fe8a26ec7e52e98ec802886bd1ae8cf1fdf4af61dd1529bc9e87027b2c4c96b19fc59468d0e0d74224d9e74fda6f1522bff4fc785af06b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          f9b4e780213df624068f6fc516e9c0ff

                          SHA1

                          799aed679aaa128c8097e25dc881d4d99d60a8d6

                          SHA256

                          47f45a01a91f30788765d18e0987146aa7c2f03b2cae28bc9d66f7634ac0f7e8

                          SHA512

                          d20cc4cc68db246588d3ae31ffdf44f4b0f232236be38a5adeacd3ac15ebadfc1729405f62f6bada34dc22944922918c61286a861fba309ee56bbce2f3213b09

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          130KB

                          MD5

                          ef80c8c2e5b4b68087f35067b458dfe2

                          SHA1

                          9528f271e2103f7e1d358d1bd24cf019a4863733

                          SHA256

                          28b999c8e9c6de414d3612f638949184b508ef1173c4531bfde5cd14b7b5a0d4

                          SHA512

                          1c8f176e55c73482b551cabbd4f4e86ac8c9072db05217db1a5dae7bf03c39a0a013d424542e4ca61c32009f3eac891f237c7c43e0d1041c92ef8868aa0a4f7b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd