Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1799s
  • max time network
    1685s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/03/2024, 17:48

General

  • Target

    https://discord.gg/77jgNRQv

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://discord.gg/77jgNRQv
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4728
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe87b79758,0x7ffe87b79768,0x7ffe87b79778
      2⤵
        PID:3544
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1964,i,9376985695524763891,17831678329173928357,131072 /prefetch:2
        2⤵
          PID:216
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1964,i,9376985695524763891,17831678329173928357,131072 /prefetch:8
          2⤵
            PID:5044
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1964,i,9376985695524763891,17831678329173928357,131072 /prefetch:8
            2⤵
              PID:4988
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1964,i,9376985695524763891,17831678329173928357,131072 /prefetch:1
              2⤵
                PID:5048
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1964,i,9376985695524763891,17831678329173928357,131072 /prefetch:1
                2⤵
                  PID:2224
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4660 --field-trial-handle=1964,i,9376985695524763891,17831678329173928357,131072 /prefetch:1
                  2⤵
                    PID:3632
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3448 --field-trial-handle=1964,i,9376985695524763891,17831678329173928357,131072 /prefetch:8
                    2⤵
                      PID:4460
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1964,i,9376985695524763891,17831678329173928357,131072 /prefetch:8
                      2⤵
                      • Modifies registry class
                      PID:2328
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5456 --field-trial-handle=1964,i,9376985695524763891,17831678329173928357,131072 /prefetch:8
                      2⤵
                        PID:2364
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1964,i,9376985695524763891,17831678329173928357,131072 /prefetch:8
                        2⤵
                          PID:4348
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3628 --field-trial-handle=1964,i,9376985695524763891,17831678329173928357,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1364
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:1336

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          2KB

                          MD5

                          f4bb7fa09535509767c6fbe72dc0e1c6

                          SHA1

                          1c2a10f2e7dc8b6802b3b3aa1407a6e9291f46af

                          SHA256

                          fa925468db23d47e8ef16ef334bfdb630dfe63bc418975826bc4e8d04ebc9626

                          SHA512

                          03b90f5dbb2c15d268aae74071138bae99bdc654143b1104b7d2bfa5c3e5ea46fb66788de59ff6564bec9d8682c51af92258808632ab378cba49dba4d12fae53

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          2KB

                          MD5

                          b89af4d6ddc657305674920b74d39544

                          SHA1

                          25fd020481127d21cd16f132fc5f3016eb821fb2

                          SHA256

                          9a1028d9a81e175bed566645617f25d73e3408aa01320e4ee8025e8b692d1b15

                          SHA512

                          ac9b7d33e84accf5c2ec381916392d908d0b6cc9a510c8323f09a5dc514700fb07cd5af40a41a12653e80b3e67bffcf811fb0add9745d7d34112f0e585730899

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          e0e04e05e2719d92318770159d7452d4

                          SHA1

                          0548bbb78dcc43006e7b5cff1f4d1b8cde838f0f

                          SHA256

                          761986a9c3a189917b1d3003f7ac90283f07efe8709a716363826a88e4d26a36

                          SHA512

                          da3aa0f6929d7e109c6d04055876440ff98ed2b2999ed6165c26ddb67c87bbb57fc941bd0d483ccd0e1817b941771d5b020f5bae0cea400e59a11aa31457f399

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          705B

                          MD5

                          be62111b98fd3b331555582df43f8706

                          SHA1

                          5b4fa1ee8ced64ce27b9f788cfe7d6cc299906d5

                          SHA256

                          4ce725bd31a987d075d81f8f87b9b0deca68dc2bb705a97a682f0bbc79414841

                          SHA512

                          fabd01b2457af8325377bcfdbf6c96b4d75db4ee25f36826765860c75cae57bafd68db5de970825f802702894e164fa7affe7882adb85f99df71781fa33a1660

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          705B

                          MD5

                          17488b97311f407b164147a1a004c45c

                          SHA1

                          e537ea99df0e0e7161440e66928a427c9f483e6c

                          SHA256

                          3b6810cbf3de69676d26dc5dc8bd5258ded3448b42ea412195235356081798e1

                          SHA512

                          de65cb6bf44bd24c6615b8e32aef1e3c5ab56fbadc8233aaac0ea1293e584928aa025a0711e0d8a1cf699a8a2b84f93c8af95588405885872e02a9dd4f02e650

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          8dc2b5a112b894e3965c30951ad8603a

                          SHA1

                          4278186ccdae8f412fed0a3c678fc32f3a65706e

                          SHA256

                          a2c4fe1f378133c5dc03dfbcddb02f9fa7a07b558a289af87a34ec4b9a511f5d

                          SHA512

                          7c7cf58ff048d12afc42380b96a91ecb9f7aa7c6761907832a62a9a99d387c3fd19c7f49c84dec013e5654127c0bb17ef5e537b534ce51eb3190e584cfc40f8b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          128KB

                          MD5

                          b188657a54172bf2aff2ce16a3aea827

                          SHA1

                          bb8719dbfbbf3cf55bf11c44225f39f1ccdfcc11

                          SHA256

                          cc64718cb52723968d454cf3e14d2ffc492b62e5f5afeb61a89fa2362bbf03bf

                          SHA512

                          43ac7ed847f7f9625decf7dcd3df93ad265cfcd5dce41a454dc7b1ec18df3f4fd3973ea1f46ebb24fbd3b99adcebcca5dd8d73630af1733fc03c2da9c1c56699

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd