Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    299s
  • max time network
    287s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/03/2024, 06:24

General

  • Target

    zfer.swf

  • Size

    84KB

  • MD5

    10d7ba32cd6cd6549bc975a771215620

  • SHA1

    84706b56c8f3e509d25282dccee9fe290f99d8a7

  • SHA256

    b9c54bc2436992f72b025bbf1531a9ba80a7cd1f2c54b7f3ed1ec30e1dcf63ff

  • SHA512

    0fdf0473caf3ce40a4a0290378fef759f303558ac4e56d086dfe175c7f45d94a20b95adb8fa7e18779d386a4fb4357370d77a6e75c0881e9cc2e089695ab4609

  • SSDEEP

    1536:HTF6hWuxo1YK74Md3NcRmd721ToVU04ETiUN2X2jNBREIz6H:HTF6hWoi4Md33aNoP4bUU2hfv8

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\zfer.swf
    1⤵
    • Modifies registry class
    PID:1808
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:3128
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4132
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdec4a9758,0x7ffdec4a9768,0x7ffdec4a9778
      2⤵
        PID:536
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1868,i,17181469751435749078,2504266371573224843,131072 /prefetch:2
        2⤵
          PID:1896
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1868,i,17181469751435749078,2504266371573224843,131072 /prefetch:8
          2⤵
            PID:4776
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1868,i,17181469751435749078,2504266371573224843,131072 /prefetch:8
            2⤵
              PID:1168
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1868,i,17181469751435749078,2504266371573224843,131072 /prefetch:1
              2⤵
                PID:2476
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1868,i,17181469751435749078,2504266371573224843,131072 /prefetch:1
                2⤵
                  PID:3368
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4584 --field-trial-handle=1868,i,17181469751435749078,2504266371573224843,131072 /prefetch:1
                  2⤵
                    PID:5064
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1868,i,17181469751435749078,2504266371573224843,131072 /prefetch:8
                    2⤵
                      PID:1512
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5176 --field-trial-handle=1868,i,17181469751435749078,2504266371573224843,131072 /prefetch:8
                      2⤵
                        PID:3624
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5308 --field-trial-handle=1868,i,17181469751435749078,2504266371573224843,131072 /prefetch:8
                        2⤵
                          PID:1936
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4944 --field-trial-handle=1868,i,17181469751435749078,2504266371573224843,131072 /prefetch:1
                          2⤵
                            PID:2612
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4460 --field-trial-handle=1868,i,17181469751435749078,2504266371573224843,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3224
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:4704

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                            Filesize

                            194KB

                            MD5

                            f5b4137b040ec6bd884feee514f7c176

                            SHA1

                            7897677377a9ced759be35a66fdee34b391ab0ff

                            SHA256

                            845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6

                            SHA512

                            813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            168B

                            MD5

                            783ed44974ceb8aa56fcf2bb62d83789

                            SHA1

                            bad3674a6a484c10645567a1d4cc5085322eabfe

                            SHA256

                            8fa5181ea565459fa75c252c148f302e495e0710e7acec79263efdb65408a452

                            SHA512

                            796b33123864010d57ec84952cf13c78526e74bf8c40c62bfff8c67734d1da53cb79c7c4ae11c02a2363149acf9d4c614d2f41fe2fa0c0a792c5ffb6ef0944d2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            168B

                            MD5

                            9170412e336940c8617397b2c85a7081

                            SHA1

                            32166721a2fe8e64081c95832eb3f20c5090e3bb

                            SHA256

                            8d87c774136e45b22e82a99a90cdb8fa4f11e586cec00d4d1bb2acf07f881f99

                            SHA512

                            ecf126208c50fc8f13bda705daab6f921382797a15500743c4924289b318efa24aa915cd6b95a4c2adde2dcbe7c79baba265dd7c706f3e088bb57bb0f296d574

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            168B

                            MD5

                            1bfdc5536bfaae90954cffe257b6f11b

                            SHA1

                            b7813fb9ae8913d2e0ef1217dddf5aadfd448cda

                            SHA256

                            3e6cbd00eff2b8385464f3cfd82e4be2fdbe2028ae5bc429bf6bc80ff1df687a

                            SHA512

                            a1973cf3059e5929dbf7fc5e562b8b30f74eb7646f69d5e69d1312d7120adef504e87b0b2edeeb5b1566c1b367fb2202187efafab2add0d3393e1446ba7d8715

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            34b6d2c20b65705f4de1ea076b00fddc

                            SHA1

                            b5fa31202d6507d37fd4cffe6a0bbb0d770264ca

                            SHA256

                            48c352e2e4f4f883be196280602d8d1d8bbea4e66e299c147f6d6876836ea9c5

                            SHA512

                            e7cf4ec7c6693e6c6622d05ace53d01a0fff650fab82ffd930103cf552fd632a728369e12b327f424ad8a1142ded6c73c05a314655fb87a7409f01fc69701bfe

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            bc5af0e23393c62dc44aa3b09f4a9f7a

                            SHA1

                            b59ac1922b1f36c9017f9d7420ba3726dcb2539b

                            SHA256

                            3b4ffa1a1642f78b36d02ff1786382934c035b960f294b455031d3d67b550518

                            SHA512

                            77410ab627f64e7753814ff200cf56218b4d16f58f12c38915f2133e4ec1efb1be951bda6516d3b810b62ecf1e1b8d142948762cecab0b20bfaafcdbb4c28a1a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            2bc18c05f567baac32ddaa8e0447e38a

                            SHA1

                            7dbbafa4385f665affbabbd73e73dad2d7e38e28

                            SHA256

                            f50ec074cd082fcbdd20d2262811561678c5d312033aef39840e397b82dfd315

                            SHA512

                            3590c54040abade6bc602e6a21f1fd3005a459179a05c0c23a02f5bdf0233c34df4cdcd77e25581e589f552534cbcb4dc1ea174efc0bc87f4309ef8e5d7a9fb7

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            371B

                            MD5

                            1a049fd66a9cbc82a2295246dc1afb13

                            SHA1

                            bee028a2a01bd4cda2605ac5d6ab52fd37022c7a

                            SHA256

                            b117e5b1c9b23ecdb759a56c0434a4649c808de97387226d3032253dbb6db0eb

                            SHA512

                            c8fe70391a67081776c3a58e505c16da0d62819e8e5dea65d3854df46ce98d16767c1750952cd37a39098a45890f730aaef064693f9f96579fecd627e7ecefdf

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            371B

                            MD5

                            340533a6eefeaa104b7e192e5c3525c0

                            SHA1

                            6e745662a06b8b41d2c83a5042ed5c97193306d0

                            SHA256

                            c4e0014c3ea620eceffa0049aa25eb850306793c644dfe1701b634f4bd938dca

                            SHA512

                            f8dc3bc72f9780977ed8324e48a88a902d3aa9da368fa2dfcd01a6d108d0efdcdb38d27a3c367eaed272127a77c5c2832b3d9cf5a41f7b9eaf7890af53b3410f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            8ff1308bb29e99d1bf7bfbe7711ceca5

                            SHA1

                            2a98233d2dd0beffd3344bb290063d9b2717ef74

                            SHA256

                            6cb3a4faed08b7b107a8eb3ec93d4f2b1151ab1939b5da6508794e609801f118

                            SHA512

                            c4b0e90f5c2fe091696dad1a679aed9954fb2008d9f2d1b60b9a800503516b6cbc0e1b48b8768abe5e1e6a196881d91ecc3bcbdf3e8bd4f8fe3a10e3b12c8e54

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            10d772111e4e5d9c1625d4f3b54507a7

                            SHA1

                            7f0e4667a5485568703f0308f9b227ba71c72fac

                            SHA256

                            3bdd2edab0164f30f4a7dba2198129e0a60022acbfc30ad77f4d529388c1f5a2

                            SHA512

                            1e3dc36f7e1f0e3ffef14cd2fb688a16570be51a4b5a35e48fee0ccfb7983b54c9e140b8e382c81a428823f41733f17ffc68f4b2707ca84afe9381bdb642add1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            4b4b55e70c9dd69ff5f51847a8b03320

                            SHA1

                            c7e41eadb6ddf634a1c3ab18df5b420f21f89ebe

                            SHA256

                            d95c9b577a8e3fac380173e9ec0c15777b0d93829e2e4f10a05ba51d68e88311

                            SHA512

                            2dcec3a1d71c7ca9b02058b7c2786c9643192c839c6aa5a49f2d69ac62458a53c22e71dc2498b9f299840dd759e2b8757dc3623734498976e290c3fd0832aee8

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            d43ad47de787d760fc635457ae41cba9

                            SHA1

                            f78ce3566bdb18bee25227af339029ec61982a02

                            SHA256

                            6964ab70d2d3a684be40f3eaa31d35b5ea448db1a90bc99434ec3062f1d29939

                            SHA512

                            2d3241664982899874d9146d5c51b569aa748c812dd39b4a55c02b75f9dabe89c4d549baa2f85f0960fb266108c867ecee907e30d5238b3bc4b481c2fbdec84f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                            Filesize

                            15KB

                            MD5

                            2c72e7a69b14cb203456c5645388b9ea

                            SHA1

                            0dd409c145b675b7627a7b340d42ebb97637d9cc

                            SHA256

                            1da6aa64e1725dbf42999bd9e1c889b49c23557ba503305a5bf0c42e5c51225f

                            SHA512

                            ff6bdf3ee0ff6cb90088572752d0427ad31ab4a8b3706b988917615fcc27a8bc87c55a548bf18b37d0e93cc58a040964763c330eabad7b154657efe4d908838a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            257KB

                            MD5

                            cd9f57a66f006db58fabd94c57e1b76a

                            SHA1

                            a80b123b43dd7b184b2792a1258b43cb7f76ab10

                            SHA256

                            73b740e5aa44ee240dbbc88ddd18f20439b1827c9377c89ec01ae8e5d8e7f5b0

                            SHA512

                            d5e34f916e0b2cc41004fb2e59fc47773050316f69e7d12f7bef75bc708b9a01b7934f0aa27db844e933c47b5d53889130b6791554106e604bb6d796ac43f883

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd