Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    158s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    16/04/2024, 17:11

General

  • Target

    740ac32fb413f2627de66a4c1ee9c551a398268de3e65b6cde776edaaf1d5816.exe

  • Size

    5KB

  • MD5

    663a487fbda9489aa364b54d5593bccd

  • SHA1

    b8ba2d8c393b6370afc29d66ab469d4be0038051

  • SHA256

    740ac32fb413f2627de66a4c1ee9c551a398268de3e65b6cde776edaaf1d5816

  • SHA512

    cf2cdec904c8736fe7815302b6eba8a32bc34cfe801b2de66405275805c5573111d334aada0607f674bbc13f264a75fbd923cd25f5354dc87f4e803724c973fc

  • SSDEEP

    96:KGfEsW8umMueP+o42Q/VgoGVSTlhxWNzNt:9fs8umYO91GVSTlhcn

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\740ac32fb413f2627de66a4c1ee9c551a398268de3e65b6cde776edaaf1d5816.exe
    "C:\Users\Admin\AppData\Local\Temp\740ac32fb413f2627de66a4c1ee9c551a398268de3e65b6cde776edaaf1d5816.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4452
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://chromewebstore.google.com/detail/downloadr/gkhnfgholfknepkhdmdejfmnhhijfpmd
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1776
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe4cd2ab58,0x7ffe4cd2ab68,0x7ffe4cd2ab78
        3⤵
          PID:1612
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:2
          3⤵
            PID:1620
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2064 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:8
            3⤵
              PID:2432
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2168 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:8
              3⤵
                PID:1920
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3012 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:1
                3⤵
                  PID:4288
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:1
                  3⤵
                    PID:4800
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3880 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:1
                    3⤵
                      PID:924
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3280 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:8
                      3⤵
                        PID:1992
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4004 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:8
                        3⤵
                          PID:2828
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3276 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:1
                          3⤵
                            PID:568
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4356 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:8
                            3⤵
                              PID:3572
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3272 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:8
                              3⤵
                                PID:4868
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:8
                                3⤵
                                  PID:2640
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4716 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:8
                                  3⤵
                                    PID:2288
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:8
                                    3⤵
                                      PID:5092
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1832,i,16512233418913600221,2153726674956656630,131072 /prefetch:2
                                      3⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:3472
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                  1⤵
                                    PID:1076

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    408B

                                    MD5

                                    d05dd852c763e0c1b840727a52fc03fd

                                    SHA1

                                    665a998998c9cfd1fd02393d4108fb804dca4539

                                    SHA256

                                    9cb6b9ce5a03ccb2f4e209fd186cec9b666cd3c8cb108fd8c85a564278cbb07b

                                    SHA512

                                    4e28fa0751c53f98a4eb40167f5fcaa5ebc592c08373407d20c95e655414edf71a0aafe57f59f779accd2f707043ebbca9610d8fbb8daada0cc6e6efc4009ae4

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    aa5d03ff6ac880bffa2e357e99adf258

                                    SHA1

                                    c70b4e1ac756bef82800b012d05fac9abb2d2958

                                    SHA256

                                    de23862322abb075517c02de4ac4db7ffdcf788337132fb39f140c213e427555

                                    SHA512

                                    2f56f4ac48ade59ff2b86b060b0e973936ad6d7222afccb6e29585c8de12c6a432f25701d58e534c5a272755333ed7b6875e59b38495bb3fc13f40fc776a4d62

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    0a6599687e64726fc6666bbc45dcf1e4

                                    SHA1

                                    ea1ceb5dbf0c994f3b787578ef3581b8db509703

                                    SHA256

                                    60fb89a67fca015c3b02fc76129a348170323e050fb83395187fc39aecf21568

                                    SHA512

                                    b9f35803b3f3a8df8475d22f46d93ffef3d4459921ff86fc75992376f68e55f19d00444102e6f2ed09262e0462b448d598ac664b36d950dfc1425b0f836c6599

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                    Filesize

                                    2B

                                    MD5

                                    d751713988987e9331980363e24189ce

                                    SHA1

                                    97d170e1550eee4afc0af065b78cda302a97674c

                                    SHA256

                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                    SHA512

                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    690B

                                    MD5

                                    bdf58fc54b7a24ae943a21f023392548

                                    SHA1

                                    9bc383a10179dc705e036f7368d5167d76cabac0

                                    SHA256

                                    5553af0e34fde046dc6fe966fdc8be01dfab46cc2576e10fbbda06cc3e6e2d06

                                    SHA512

                                    09916ab5f072f8e27ef6b8eb32144c9d340d1964c7f5764294e48513c6b213102a7a54460625e6f5bd2fad4bcebf86971c8e2f9e48ca659407bc5a2fb562587b

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    f6b4253956519b0a4c833a030f172d54

                                    SHA1

                                    d629b163cdf8306e53fcfda647fddcfd1c1ec9e9

                                    SHA256

                                    8fbb5f6f51407f7eef3e3cc5208b393cfd4733b50cfa5628933fc87e497c16e9

                                    SHA512

                                    a48140479972978ba3ace7417368a969dee86a215598832d07c673f257ce3dd8922b11ac7e74fd623373ec54c049e26833bf1061f4dcba1ed1d9b4c409e9f0e1

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                    Filesize

                                    16KB

                                    MD5

                                    557771688887b9bb1d073260cb773e39

                                    SHA1

                                    48be9373a74adab6be7c6439d3a7f2233360a6c0

                                    SHA256

                                    a5d542efb81515fe1fb56c9654f78e80e969e0ebd3302fb2b2f0c136fd08ee99

                                    SHA512

                                    75aec1029b255ba65e6b996cadc4de68941e9e1b138f41e7762357d610db61f6c77bac0592b45f6bea12802b5bc2759416dd64f470ca23628ee7885917b0d36e

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    251KB

                                    MD5

                                    95c59680b45cbeb3d78ba7a74ca14393

                                    SHA1

                                    919be1c85dcc31ea98b7dfef97c10d5b9f7dd966

                                    SHA256

                                    3f6cfe1ef2fc54d4fa9b41e4cc8b69c49a5bd3662a75625b548e93a83511359d

                                    SHA512

                                    ca18e9a05e6723af721ee1cbece07e0bce4c30bd98edfd60c13e16bf31bb74a2ae7f69f1c2b6b59454f8215188a684ecd66dcf7f83f0d56d84b9993fe042bee8

                                  • memory/4452-116-0x0000000005F10000-0x0000000005F20000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4452-115-0x0000000005D40000-0x0000000005D4A000-memory.dmp

                                    Filesize

                                    40KB

                                  • memory/4452-114-0x0000000005F10000-0x0000000005F20000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4452-0-0x0000000000260000-0x0000000000268000-memory.dmp

                                    Filesize

                                    32KB

                                  • memory/4452-151-0x0000000074B60000-0x0000000075311000-memory.dmp

                                    Filesize

                                    7.7MB

                                  • memory/4452-3-0x0000000004D00000-0x0000000004D92000-memory.dmp

                                    Filesize

                                    584KB

                                  • memory/4452-157-0x0000000005F10000-0x0000000005F20000-memory.dmp

                                    Filesize

                                    64KB

                                  • memory/4452-2-0x00000000053B0000-0x0000000005956000-memory.dmp

                                    Filesize

                                    5.6MB

                                  • memory/4452-1-0x0000000074B60000-0x0000000075311000-memory.dmp

                                    Filesize

                                    7.7MB