Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    170s
  • max time network
    1701s
  • platform
    windows7_x64
  • resource
    win7-20240221-es
  • resource tags

    arch:x64arch:x86image:win7-20240221-eslocale:es-esos:windows7-x64systemwindows
  • submitted
    15/03/2024, 10:50

General

  • Target

    https://www.hoyolab.com/article/214784

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.hoyolab.com/article/214784
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3048
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef65c9758,0x7fef65c9768,0x7fef65c9778
      2⤵
        PID:2144
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=148 --field-trial-handle=1376,i,6701589827434071256,425832063325564562,131072 /prefetch:2
        2⤵
          PID:2580
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1508 --field-trial-handle=1376,i,6701589827434071256,425832063325564562,131072 /prefetch:8
          2⤵
            PID:2628
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1536 --field-trial-handle=1376,i,6701589827434071256,425832063325564562,131072 /prefetch:8
            2⤵
              PID:2592
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2204 --field-trial-handle=1376,i,6701589827434071256,425832063325564562,131072 /prefetch:1
              2⤵
                PID:1604
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2216 --field-trial-handle=1376,i,6701589827434071256,425832063325564562,131072 /prefetch:1
                2⤵
                  PID:2960
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2768 --field-trial-handle=1376,i,6701589827434071256,425832063325564562,131072 /prefetch:2
                  2⤵
                    PID:2780
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3356 --field-trial-handle=1376,i,6701589827434071256,425832063325564562,131072 /prefetch:8
                    2⤵
                      PID:888
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:716

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

                      Filesize

                      1KB

                      MD5

                      55540a230bdab55187a841cfe1aa1545

                      SHA1

                      363e4734f757bdeb89868efe94907774a327695e

                      SHA256

                      d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

                      SHA512

                      c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

                      Filesize

                      67KB

                      MD5

                      753df6889fd7410a2e9fe333da83a429

                      SHA1

                      3c425f16e8267186061dd48ac1c77c122962456e

                      SHA256

                      b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78

                      SHA512

                      9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

                      Filesize

                      230B

                      MD5

                      413b667cb9ef88b1c99078c85bf587c9

                      SHA1

                      76824db6f88662673f4c500b0b6579870127a9e7

                      SHA256

                      1af3c370f64c8a75e1d128a5f70d63ef6baa6fbae58487ae30a7e3b991f2ab19

                      SHA512

                      6219dc33536855aba844689f49d90a1cdc59b3aad89155a7ea52046766def11f5d69b16153c8e659043a26fda13f6bce679f5d123a806db8a8ebecf069184da0

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      344B

                      MD5

                      dfb8023a9f9a873315febbfeed6df2e9

                      SHA1

                      d5ab98335ea52745a895f76c8c0a9cbb27dd6214

                      SHA256

                      5333501e4bbcc2bc946c1a5b102fb911a2ec65737178c0241703f74bab6e100c

                      SHA512

                      bf47e900d475a707897282f4befaf80369a002ac51799d9d235a6867c4a63a6c7e507c69a7b82c54f8162b796cbf1ad5664956cb2de7e2d2c9367e4edd798760

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      344B

                      MD5

                      2177229dfaa77aaba82ce3d68408f8e9

                      SHA1

                      c766e73b75a1e06ebf32f5e1b1dd1ad101bd833a

                      SHA256

                      7a680e18e0bed1000d33c2332d91c63d40437365d24fa2e0e4ea88148891c940

                      SHA512

                      6a1368fc87d003d22718857f48308b346c31024f48f991d42bb4aeae994fdca1187cc481e3b70b9f87a14b18c3f139a3da01fcbff9e9cb6a60e841b34b1c1e27

                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                      Filesize

                      344B

                      MD5

                      1246001e661f7b023379cbb5a82f7f1d

                      SHA1

                      4dc5c97eb68824ebbfa4585bb2f3b1d7e98328ce

                      SHA256

                      fda87b6212e4da10f4c603ce5664ed497bd4f3f5fa18e33a0f8de6bfb2077489

                      SHA512

                      56b2da4744342988416a2dd035197c90b55cb1bf205797194d40ff20cd0b2045c1e38cc9b6a956fd0c940c89356210803955af47249b62297752a2ed6729b0d5

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\760cc21f-a347-4683-a5b0-4491e9d101b2.tmp

                      Filesize

                      5KB

                      MD5

                      a471a04c4ce21bc35b727bee74c0c321

                      SHA1

                      7c53211469c646c6af09853c20bd5b9f478f724c

                      SHA256

                      1cd2df877c7b9babbcab955521134494736872b17622fff5e35a4ac86807a738

                      SHA512

                      af8a02b9e6d3c2e181bf146b63e33ee98bb563e5e0791ff84b4c71786e88aee829c1dc9a2f9d6f917f83aee7c862595fc2162904bafed26b197075be061bf643

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                      Filesize

                      264KB

                      MD5

                      f50f89a0a91564d0b8a211f8921aa7de

                      SHA1

                      112403a17dd69d5b9018b8cede023cb3b54eab7d

                      SHA256

                      b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                      SHA512

                      bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.hoyolab.com_0.indexeddb.leveldb\000002.dbtmp

                      Filesize

                      16B

                      MD5

                      206702161f94c5cd39fadd03f4014d98

                      SHA1

                      bd8bfc144fb5326d21bd1531523d9fb50e1b600a

                      SHA256

                      1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

                      SHA512

                      0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      3KB

                      MD5

                      0ad13a56b5bf921ac9596f9e3eed768f

                      SHA1

                      ce0a8028904200071161b806bfb17f6ffde0c672

                      SHA256

                      100cf723039e5af4c1f50edd50c61c8a86008b85e436768e8b9c8712ef03ff9d

                      SHA512

                      b013efa19f8b338689069fde515a4d903d76d2fd1ccdd0019b9fccd0e574e39f08adcb19c2e29220a497fb4a5787ef540198dc1dad0412439ce20b3a1017d9c5

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      986B

                      MD5

                      84108d27b23a37dbef19aaf2dc33bff7

                      SHA1

                      4e28ad32cf822aae81880cab0c8b91af73c78770

                      SHA256

                      7c1e39cd752a260bd2294249f4a7dcd833e2b0529d415feead3ffbf980493f30

                      SHA512

                      454015db538b7d1bbe2964b15f5373a2ca562b205489b0de98bea39dbbc21f264f96bd25bc18cbab5a00ad0ccd3042a8e960c9c026aff5d664c9d2ecdf95fcdf

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      3KB

                      MD5

                      a81b24209f961758bbc2cde2ccd93d39

                      SHA1

                      7c5b85fefd573baa73fc5dc96820d97e1aafa97b

                      SHA256

                      dbb6c5e064826b528d2f61b53f05cb491a537d1f6411cb10400a465678826434

                      SHA512

                      23b63c9b6aa376f0e2599d4cf9c801f4d91a67cf6cfd00c925e5768c47433e2e0bc6baa31b6d05e2992384c19988d483530f2cc3507bc227a707b67f6e107bc6

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      691B

                      MD5

                      644848f72aed8c1af9ab22fc60b3ebe5

                      SHA1

                      bbea1ac4c1a647c7ae043ba8c838ed75f078e305

                      SHA256

                      910a7edad93dc1c101cb5f9d05e4743e890a9364421c0daa60a023fa434c2cf2

                      SHA512

                      5bd577a7f54337d74aaf1fc84a4229966580b7ecd6965c64e84a9299ed4fb42acc8e2942942ceaa88ec4437818374a00c4381a5bdf6fb79267c4f1555a3d03c0

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      4KB

                      MD5

                      e5d49e7eddfbbd07bec238e89e3321a3

                      SHA1

                      124fcd56e2dd0660db7e0cfa0fa4f3ad98c53ac2

                      SHA256

                      dede4162623ea24919e7b275908a46f40ecb183ffe3457a5a82228d4b5e35fb8

                      SHA512

                      245f3666ff7f2bc47a119c5418a2513ee8b69cce096c9972287a6362a50acd3167d10dac854801362ba925502d9fb6ff6c3c6953f9d418ae7da5350d25e08120

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\Database\CURRENT~RFf7683a1.TMP

                      Filesize

                      16B

                      MD5

                      46295cac801e5d4857d09837238a6394

                      SHA1

                      44e0fa1b517dbf802b18faf0785eeea6ac51594b

                      SHA256

                      0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                      SHA512

                      8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                      Filesize

                      16B

                      MD5

                      18e723571b00fb1694a3bad6c78e4054

                      SHA1

                      afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                      SHA256

                      8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                      SHA512

                      43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f5fc04b4-329d-4867-8611-0b1f62799274.tmp

                      Filesize

                      4KB

                      MD5

                      ef94edc7011f33e3fccc7e1e174d3d3a

                      SHA1

                      31ab80dc860a57db70024f5f854feed15d1e1414

                      SHA256

                      84367970760ac92c77731e556647de401501fa31db314bb5e51e81196794967d

                      SHA512

                      0f98d1093e7ee1a0b638b14ed1a9358ee64a22e23294d2db8c2207f3bdd7d51ec4445c14e9a157b24bd9408f4129528ddb20aadbd3120129f6a95599b1ee33d2

                    • C:\Users\Admin\AppData\Local\Temp\Tar9718.tmp

                      Filesize

                      175KB

                      MD5

                      dd73cead4b93366cf3465c8cd32e2796

                      SHA1

                      74546226dfe9ceb8184651e920d1dbfb432b314e

                      SHA256

                      a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22

                      SHA512

                      ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63