Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

28/02/2024, 10:14

240228-l9zvrsha9z 4

28/02/2024, 08:37

240228-kjnt5sfd8y 1

Analysis

  • max time kernel
    120s
  • max time network
    131s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/02/2024, 08:37

General

  • Target

    https://dik.si/tyRvT

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dik.si/tyRvT
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1552
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb82d9758,0x7ffbb82d9768,0x7ffbb82d9778
      2⤵
        PID:3672
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:2
        2⤵
          PID:3352
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:8
          2⤵
            PID:4676
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:8
            2⤵
              PID:3932
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:1
              2⤵
                PID:2968
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:1
                2⤵
                  PID:2552
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4604 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:1
                  2⤵
                    PID:2424
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4632 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:1
                    2⤵
                      PID:2116
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:8
                      2⤵
                        PID:4492
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3992 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:8
                        2⤵
                          PID:4744
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3808 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:8
                          2⤵
                            PID:5920
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1704 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:1
                            2⤵
                              PID:5192
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:8
                              2⤵
                                PID:5416
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:8
                                2⤵
                                • Modifies registry class
                                PID:3164
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5408 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:8
                                2⤵
                                  PID:3860
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5648 --field-trial-handle=1876,i,4722867602433845815,2370965871014009439,131072 /prefetch:1
                                  2⤵
                                    PID:4976
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:364
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1340 --field-trial-handle=3084,i,14217130992253490921,11543335378077656547,262144 --variations-seed-version /prefetch:8
                                    1⤵
                                      PID:5876

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\729c2ee3-9a1b-44db-acfd-b74604bb8d27.tmp

                                      Filesize

                                      7KB

                                      MD5

                                      47278ccfb027dea7743e9cc15b374c89

                                      SHA1

                                      9f344fcae6aa6f921bd866e7e6c046cbc006f910

                                      SHA256

                                      aa754d05a0f649619443d85f9abe478a4067feac032b02b964dfa0b6f1041f90

                                      SHA512

                                      fb1937bcd0d15367580cc2d4e1f7441405d7fff473000bd71d95c47d4dcc3944fa3538ba446e91c811b84da67cc91660208e51cffb8125057ffaf00083e3c7af

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      1KB

                                      MD5

                                      a609394bc897b946bbd69d656f887321

                                      SHA1

                                      69ad24c9dee727cb13f89cbbf5a3c43fda5ab751

                                      SHA256

                                      b314a1ebde0091fa52b3c699e39b1d7e5129a2ac95697527b0297089ffa57fc8

                                      SHA512

                                      42c0c8d06670d8a316a36b951cb2b6dcc7a08361fe40ea839d5e33f0844a891b0791d066e6928e7d73e8d1c28a129edea2c79ee9c75617b10c7f825b77a2425e

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                      Filesize

                                      264KB

                                      MD5

                                      651ea263ec4666f6ee09df62d6eb866a

                                      SHA1

                                      44707a89e3d9ebd26e188db56fcf3e791758d462

                                      SHA256

                                      504b1e0a4a2ddab4c4e10f58e1e1eb9d4b92bbae91e04053efcd81a5161b3919

                                      SHA512

                                      f28e25067846b50bfd45e9a863e9f35b8f57336f0807e2a6d4eb949bfa8842c65ccb360d8a5dea66ed8c06e41ff810de0aad9ca1e22f81fe609ba4d79dc34714

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      2KB

                                      MD5

                                      669defd83f56522e5f7aedbae3cbc731

                                      SHA1

                                      29ba0f90972e533e5592e45a279246ab83646621

                                      SHA256

                                      076658229441268fdef40fd0a1fb7337ea5b742e8bde286cdf7ac7ff20f88bf2

                                      SHA512

                                      40158dae1ff49e486a5c64aaea939a08e69ab848751282d135d27d4259b4ee560d277c520ee4c8e645019f281656f7e9e5a5fe9b7936c495e315ec1d6c9b5a96

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      5KB

                                      MD5

                                      3a7705aa11ffaedebf2dd89fa80fa3f8

                                      SHA1

                                      e991a61edc9d48bea94f36b1950538d5b8115fdc

                                      SHA256

                                      9171b9d6d2a4f74c14d374e3741aec77e03a411d7061c5c9542d1d49ab74959a

                                      SHA512

                                      9b86d214816db1c09cddbd48adb85c4ee779f70c50c1a07d0a69d236aead2b15280e4cc12065e43a761a4ea4dc2c41aa0686bd9ab2db18d4db8d6eaa72feadaa

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      369B

                                      MD5

                                      57573c6121aa08b3d30b1b74fa892a33

                                      SHA1

                                      e4d2eb3384ae4c3f3c4c0d39156084406e43e037

                                      SHA256

                                      2b32fb359813d0290a28a66786b730a55319c4d3775b05c622f9c9187cbe75a7

                                      SHA512

                                      f2afadee02a871461e0153c4e3df99261ac730219219264c9478671984f700446d2a2519f4e2f9e69380cfc211f93f91b7f134b5ba637723106878923c370dad

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      2KB

                                      MD5

                                      c0448f9522f3382159e96618f54006bf

                                      SHA1

                                      23623f1ea7320f1cea6f56395ff9317e5496024c

                                      SHA256

                                      320a998944578e823c67e7e795ad155356f0035b290080b02025a85d7a5a35c0

                                      SHA512

                                      cd78b553116a3f3b5debedc49c97b131ebb3b3b58660cd5cbaca1c62b2458108ee0bb0f2035e74612aa9b018aba886da5c05f7bcdd1e51d8edbbafe080da3906

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      4bcbb97b7ae360e94f944de30a18c49f

                                      SHA1

                                      3cb64ecc4cc69f3855fda3cd07a7a7f26c177ce1

                                      SHA256

                                      a4f8bd7b3188e9bd5ad4181d425a11487dd6f5372841d46f3bc641e5da5b57ac

                                      SHA512

                                      5abb1d4333a5f15d0f249001527128e36c01d0267cb42c568ea4039c82de638ba9e9a7e10ee99487c8b6dff75111fd907e6d6de53ab9146d0a749f94f520f1a8

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      dc107b8f9f7184b8720a788980282434

                                      SHA1

                                      8afd09f5bbb0345d8756bc61b50b61db83658653

                                      SHA256

                                      137b4b1866f1335a931d980f3d24b53b0c96033e42fd3c0e76c2803c86a47442

                                      SHA512

                                      a985ad852926e1590096eb83bb1d563ed9e0839b4bb4200cb0be8b526bd3c2910337151a0fd66f3653c50e9d00dbbcc333fd328a96807774436c0c6fa4107db4

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      6KB

                                      MD5

                                      cdd859825eff43f965ae017c4385e34e

                                      SHA1

                                      c50077137ef022358e3603b3fad2fc162b37a483

                                      SHA256

                                      d89666b8598f1609e40c52c95758e0e25e2cfbcb666c49bb97008ea745522b45

                                      SHA512

                                      2a09ac9b5e5620579a822b4fe2872dccbb27b3edb5a0aaeff9a50b215859e3d7cc3a4f1200890c1da221cbcf874be1c18ee3bae2e96123d5334775a66502bb72

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      253KB

                                      MD5

                                      96f107055f53fd148bee0e444b973167

                                      SHA1

                                      b9345bd62f86153b1ad408abc00550c226439150

                                      SHA256

                                      294e290d3e37462ca380a6417f8584804dc103e7739cede47998ebe57546ebc8

                                      SHA512

                                      ca3612cc8e25b3c68b65eaec49e07dddda131ed3933e13f4c953c4898c4d561c5498784b78d037da9e6084340a3b72759d59811b0167cb90eb2233922ecde1c1

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      253KB

                                      MD5

                                      52cc93f4e78d6ccde1b3b69fa0352fee

                                      SHA1

                                      4b95985871b3f399da1141b49300a6fe5d4407c9

                                      SHA256

                                      e333a33f5e035edbe00a6cba455f52239f2c2864d1b0123c09a224f17314154e

                                      SHA512

                                      2438b267d9e31fbc3d6350d2b13f96fd10d46b7deb100230a4221c3b7db600eb567e967ef552f2584739f85f7261e3b11214b326ae8862f96ae0f03534f71291

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                      Filesize

                                      101KB

                                      MD5

                                      d5da8327d2acfe3dc38aeb22fbc42c20

                                      SHA1

                                      f288151a69c6e54a62e15bfaefbed70dff2e5c80

                                      SHA256

                                      38b08caee32d4322d7b9d51b712f34efced29c4ced5194c7ff19ab5d9fe834aa

                                      SHA512

                                      0d5e23b9113306d24bc2be3ca44a53cc66e78b9a532f94e08145d150522276ea29bd373ff703713d14cff64358a23ceb718c3871bd116de6e3e230c9149a7564

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                      Filesize

                                      104KB

                                      MD5

                                      c5173a35e4e896bc0a6e4c758396f81f

                                      SHA1

                                      8412516b71666b40894622678273b0aecca6f164

                                      SHA256

                                      27bedf9a657b338dc4748840c4d9935084032f792999fa6f339f959a59ca27b2

                                      SHA512

                                      21c62d2111f222f4f7d2e48b2df4d208e39c251978d441efd101d391c3ece5870d42a12b72381613c16dee7bf013361f0e8a55fdc3e43d14919dca40796d989c

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe585407.TMP

                                      Filesize

                                      100KB

                                      MD5

                                      b125c6377778e78c9e7a069e3b28fffa

                                      SHA1

                                      1bb2f3427936678924000dfb7240cd8ddcb68188

                                      SHA256

                                      f85ecb134eba114996ef302a58f32ba28e4b6bfed33a7a1df91f8597bc190ae2

                                      SHA512

                                      361853b8d4d4bc018381814c84910ad0da67775aaf71154fa8cdff214fae1e22d75ff2ffecc20eff74372ec5268c0e2cc0d767acbe27ea54a81d61ebf16122c3

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                      Filesize

                                      2B

                                      MD5

                                      99914b932bd37a50b983c5e7c90ae93b

                                      SHA1

                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                      SHA256

                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                      SHA512

                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                    • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                      Filesize

                                      2B

                                      MD5

                                      f3b25701fe362ec84616a93a45ce9998

                                      SHA1

                                      d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                      SHA256

                                      b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                      SHA512

                                      98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84