Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    600s
  • max time network
    600s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/02/2024, 16:09

General

  • Target

    https://viewdoctoday.org/f9b188c6d43915114d4e020a8461051165d60f4fd69acLOGf9b188c6d43915114d4e020a8461051165d60f4fd69ad

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://viewdoctoday.org/f9b188c6d43915114d4e020a8461051165d60f4fd69acLOGf9b188c6d43915114d4e020a8461051165d60f4fd69ad
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1704
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7fff19999758,0x7fff19999768,0x7fff19999778
      2⤵
        PID:4180
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1716 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:2
        2⤵
          PID:2204
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:8
          2⤵
            PID:3760
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:8
            2⤵
              PID:2072
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:1
              2⤵
                PID:1980
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:1
                2⤵
                  PID:1312
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4492 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:1
                  2⤵
                    PID:4780
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4952 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:1
                    2⤵
                      PID:3804
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4996 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:1
                      2⤵
                        PID:3176
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:8
                        2⤵
                          PID:1560
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:8
                          2⤵
                            PID:4808
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2804
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4620 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:1
                            2⤵
                              PID:1944
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=996 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:1
                              2⤵
                                PID:1912
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3792 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:1
                                2⤵
                                  PID:512
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5196 --field-trial-handle=1868,i,9732747811898866967,3319570434140003527,131072 /prefetch:1
                                  2⤵
                                    PID:416
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:2744

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    192B

                                    MD5

                                    81196ee57a25bc5e7855152cc88731ab

                                    SHA1

                                    9170dc73950a6d5e02be7645bfd09b90665ce9e3

                                    SHA256

                                    0dab71113e5a82d6e5da064ec15fb3fcab6708e8b8873391bafe5c8a62461d77

                                    SHA512

                                    f44ff5b800599b3f113bda9f3ab2ed8bf6af426dd5be452a8c3d7ce10eb396a53aa0e1d384c4502e08502893f7c0d3dd9a291b4f550e2eac5cfb9bbe8351c92a

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    240B

                                    MD5

                                    c62837dee6e5435e71b1dc612f974305

                                    SHA1

                                    aa1e98f308435cf6560bb76e4d4a6145e75b8aee

                                    SHA256

                                    8e757e75f9b029c95694acb08250a5984475de8edf70490a8295062f84bdf212

                                    SHA512

                                    a363aca5537052e34a982ceba41dbf5a31c23b631518ef14ee2011945d3ade64b991cbde5154aae5216aec6ecc472cf2956a39d8e91e4dfbaa8fd74ad03ba8c7

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    288B

                                    MD5

                                    131c18905679225ef4928f8a4a8ce2ec

                                    SHA1

                                    e2807ce0c71fabe0a8cfe6a50e2d95af2db65891

                                    SHA256

                                    3dcdbfc41a0f25c69caa3160f658eebd1f7cd299596ecbcb02d94e4678c6e47d

                                    SHA512

                                    c4b50ef5a4f360d201a02285ad737ecfcc198450064764c3cd5bce609be65e39a9f86a109d78f0faf4b3013e17bbf5d9ca7cb41e6bde0a5a0108cdb670cf5da9

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    336B

                                    MD5

                                    50c21d92ab93be23db681f5e9b4324a1

                                    SHA1

                                    727e07d0a61c70a7dc6dff81ea7ec02c3deeb248

                                    SHA256

                                    72e19ffca56097bc974511b2d0468d10a640b2573d86547999890878d944fe7a

                                    SHA512

                                    8655173d2b27239f8c04081740211aeab2cda1822bcd01ba7cc9d7dfbab0a42e7cef4827658f04a66ac29483122949c20cf38736832bc5be1dc33e15e1c34dbb

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    120B

                                    MD5

                                    358af1433d2548a66073a36e2b8db30a

                                    SHA1

                                    eee360d8b705c961ffd80b861122c60426ced5d9

                                    SHA256

                                    8852bfdd183326c7e0614f44798c61c960638111434b1a3269ee0ad70f0e6d7f

                                    SHA512

                                    f2f4d419ede8b34eba7c9b9271366bcefe5661f765d72d2663bfd5172b1b69a0fb9a470982dcaa20b5412414e9a628cb70e1fa45caf904c85a4811b0ed24d5bf

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    271266718ac9bfc115cd0342de0ca2af

                                    SHA1

                                    38c0da0a9ba10f0fc1f89843c0db96fd85d0e50d

                                    SHA256

                                    8cb388aff58f49abb849346b77a00fef2b7fa3266db453f4689fa04968114918

                                    SHA512

                                    6a4e5ad63af7f42d32f5fb0bef1d74a949fcc85100dba4266a652e9fd470998d89078897d42b2288ca9ad977247c1e3072eff4b7548a93f85557115b86f7863c

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    fee8bf9d5406c5c1be1630493203edf2

                                    SHA1

                                    32edf79a6f2eff02e41ad56d276fa24ab9f1ac1f

                                    SHA256

                                    9a0744d67af9fecba611495115953a3cc13187915be724fa8334fdefeb254b66

                                    SHA512

                                    d049658b6321c9ef7bc3d4ce9afa86ed2244a207c5bc322bab8be37e6315e67ea720e1c713c51a92f967d5139df7ac8d6c69dea4f2d2698835fe511967aec933

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    646b2691f9c596ab22004f50cd449479

                                    SHA1

                                    f3bfd02057d6c53866ed89c936c93c9dad42d8d9

                                    SHA256

                                    062830d98ca7710b9314a452585801a152efc6d91a6879ce9c949124c0dc73e9

                                    SHA512

                                    ab69325b5ffd4d12680805ea01600aca35563784df0a72ed6bb47948718ebc28529a4f6652387478ec092bc05f888631d5faa2c238a612f5f23c330c44345133

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    9a0294f8d01250156cf9a85e92026094

                                    SHA1

                                    6e45662eda172a730f88d2e78a4e492206d4c48e

                                    SHA256

                                    250867ca1ccc8a075c7d40d5b1f9851096832c779af6a15b6505dec4e5a272db

                                    SHA512

                                    c0fb58071c7537337e2296e2015d8c8ab406a74a827ad8a6d41b5142646a96b25e19c226360556f09d4c82a8e6e1261eb71828d2e45550ac7aaacb543f264cf3

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    a1ee23319ceca289f9fe543ba9a94235

                                    SHA1

                                    0b4e4b14eef369bd4dae6ade6e6ea3d87b4da0b2

                                    SHA256

                                    fbc96ca44bc143e6b03bae6c31f051c0ab0a5b1f0d9c34256d8d0543e51eba46

                                    SHA512

                                    7a31cf371c97034a6f924b523b55338498c179e4bed05e72cd0da774f6b9a78eaf148f433df5fb214062f5fe80cc396907f666beeee95a997cd3e1dc3b6f8a34

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    0e953522aee064eb925a100f5d2f91aa

                                    SHA1

                                    57f39c4640cba388519d6d7459dcb915a08fdf44

                                    SHA256

                                    e67f0f54095afdf6f8bf522fa4be5036bb4671973f7a128a75ee557b5975cc26

                                    SHA512

                                    11926ef328d78905815a4773a61e271bfb957794aeb0122a42f702a0f080526cf5979ced57e4129d0c263f8850458024cee873f54de5f5ce6d3efa6839b04bcb

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    3945060daa6a5bdc01b711cb0cf5ccbd

                                    SHA1

                                    fcfd540f72382a198e7e00d737257bef0eba66a0

                                    SHA256

                                    85a7ba3bffbf23d5980711f3b81d003806ac1c7e40303000e031c87489f5cacd

                                    SHA512

                                    d155318c64ee0fb546c9ec74d1dcaa13b857eb818b8cd7c5bc51341676b815dce669faff62d0033577863d047afda9d0db9c741a5b67d398fc70d9fe40d3fcb5

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    9d951f97afcd16d2d2583e8dd6460db3

                                    SHA1

                                    b76303d1ea5c1b2c6a2365f5ee938b69ca425c51

                                    SHA256

                                    d26df95e0dd9ba90487bc32082b8b2b9d54ed6f51e73f4d9d0dfd371e9513dfc

                                    SHA512

                                    a01d8735c59a533f483371eb7a13c0acedd32f4c7114df348bba5c747eb4393852c6ae52759b5bd05699079d19566ef35a3138450b53adfa3340c4494f5365a3

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    f0db9d99024c0e1aba278523a05aae39

                                    SHA1

                                    6d4422b27a271c5b3ac0849dcfce92272f7d9ceb

                                    SHA256

                                    57f607d23036eb0e678094ba76f1584371509d02a7118942ed53236ae44579ae

                                    SHA512

                                    400204d501385cf66e6ae363357ee8965ca7cd7715f5f749ee4f6c1f91c55569649ed647b604c4675e71aa7832ffcf7a1ec279b1c160b3cc7ad41edd5cb6a854

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    29bcf8e75f4502574e28f4b3993517d2

                                    SHA1

                                    78792f8e2619ce5d515604a35f698bea24a9cdb1

                                    SHA256

                                    854922872b6b5022682de3ab3bb4d5ed7c336f7c617393b9460caf5765b32ea8

                                    SHA512

                                    a64a8a2201894b09fc95cdb1a3f47222ff6620e30c3426d42d666af7254c989dbd170f2fb061690abb15a121c20a601d9305f3b4eb20338352a1645e01fb3cbb

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    5a680c918d722317184b16bf3fa71bdb

                                    SHA1

                                    20438d29ef83d61c31683396300746e14c89a7d1

                                    SHA256

                                    38740b6e8e154590722f1e71dd34f60cf4d9b1e96faf1f3729b21a45fde1ddf3

                                    SHA512

                                    d168fd4f35a66d716be8b8cad06968a5dd12461b5c05dc7fbe638aa0c1434ae5bb579a1aaccf1c3d409151648b67f8e4860acf73853ed0ead1e5b40f6d195a95

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    130KB

                                    MD5

                                    0c72e31ad613eb4bd0ae19b71451630f

                                    SHA1

                                    e6cbe7f6afe1d6dde4ab051d198d204fb981d892

                                    SHA256

                                    2069412952177579b7075852ea74af58dbb26e7b5ec5eff40393b217691cbd13

                                    SHA512

                                    f4a0e61ff4b7523010396916068c94aa78ed31db0074af8e0f6993847166d89449ad8c2265cb92958c55927dee9b72b25669af453758ab41d6c405bc66f0c1a4

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                    Filesize

                                    2B

                                    MD5

                                    99914b932bd37a50b983c5e7c90ae93b

                                    SHA1

                                    bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                    SHA256

                                    44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                    SHA512

                                    27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd