Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

18/04/2024, 06:27

240418-g75wsafa3x 10

18/04/2024, 06:22

240418-g4ynaseh5v 1

Analysis

  • max time kernel
    266s
  • max time network
    264s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-es
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-eslocale:es-esos:windows10-2004-x64systemwindows
  • submitted
    18/04/2024, 06:22

General

  • Target

    https://docs.google.com/uc?export=download&id=1Pfa__kpg_oLasDz_3xXEkfJBhr5qPe1H

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 38 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/uc?export=download&id=1Pfa__kpg_oLasDz_3xXEkfJBhr5qPe1H
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2356
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb4601ab58,0x7ffb4601ab68,0x7ffb4601ab78
      2⤵
        PID:4976
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:2
        2⤵
          PID:2076
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:8
          2⤵
            PID:1264
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:8
            2⤵
              PID:924
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:1
              2⤵
                PID:4900
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:1
                2⤵
                  PID:2212
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:8
                  2⤵
                    PID:1120
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:8
                    2⤵
                      PID:3872
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4344 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:8
                      2⤵
                        PID:756
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:8
                        2⤵
                          PID:1920
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=988 --field-trial-handle=1888,i,8451672898201879838,6349153183539150836,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1320
                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                        1⤵
                          PID:4916
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:2084
                          • C:\Program Files\7-Zip\7zFM.exe
                            "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\Downloads\NOTIFICACIÓN DEL FALLO; RAD.7653890012-2024.tar"
                            1⤵
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of FindShellTrayWindow
                            PID:1692
                          • C:\Program Files\7-Zip\7zG.exe
                            "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\" -an -ai#7zMap9319:148:7zEvent16948
                            1⤵
                            • Suspicious use of FindShellTrayWindow
                            PID:1992

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            80ffa31945bd7f3313ca6e7c24539771

                            SHA1

                            ea523636cbe5fd82d5347710b53826a9e2754ae8

                            SHA256

                            76a7f6b81d86a3794928128594f837f7f554b16f913b54a192b9450063ff52b2

                            SHA512

                            24d7c849f0fd19a6ddac7b4e73ded43320b937fba6634a5e6b85e1224d50582432dcb450d500758149c43da2ce6a24db8d31bd458552d6bab244a03583594156

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            524B

                            MD5

                            662b6237eb514ac9624ff5f780e0b9a3

                            SHA1

                            8bbb88ab989f6c0830dc744bff5f8cefb3d72709

                            SHA256

                            eb7af2e6ff3f36fb6c6177c171adaecf0a7409c51a5a9454c2b3fcd2f292fd7a

                            SHA512

                            258dfc916cdca648446c2b0efba1f3e31410aafc11212cbf82c285d62a37073067d592aadc79a6990b1c717bfd221a3cc9b84e3efac90651ed3464f2ba0b1eec

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\c49ec810-8a01-49a9-90ae-d20ef89f95e3.tmp

                            Filesize

                            1KB

                            MD5

                            6d621f3fcc9a5f5725e58efa0f58efc1

                            SHA1

                            a9e5860a457d97faeac6e23ff468dd2ae0d471d7

                            SHA256

                            7f9ecbed42ac31d54dcc25cbe6608ce74641e3556438de99b01f0cb7cefc40c2

                            SHA512

                            bef3b974396c27e4786c2c4dc31096ae9bc6c65ad7522c77c2d8b4481d12389b8a236b288908d67ca7fbb3b283378285a9a22341cf3ddda48bcbea6f949ff506

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            3f63465cceb6f1a54dca463468ee34c3

                            SHA1

                            e4069f23c7941d47eedaf34455acb7168b6ff1e7

                            SHA256

                            936b55e172a4a90a2f4929ca53345a65f576a91c41a46fdcb568a268d3b6ff97

                            SHA512

                            1e17eefd000a0a44898416866ed0805f31201605839717701f69742960107cd1e7a055e65a728b4e1f7775040afe92f4426dff39b8687282452dfcdd006d5c0f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            250KB

                            MD5

                            966d9085a8d53588c498ca9f2f6f08ef

                            SHA1

                            d37f4126b82f13b78abf1049eaf219fc270ef74c

                            SHA256

                            7f6af830c469bc9f331263e4c9d17d0daf839bf2938c2d8533aa87a07f65a4ba

                            SHA512

                            55935b9247d55db3314bb2bfc64384760d2710606b2070ae9bc9c990ddb9b0be9b735a0bf5023699ddd03211629370b8010a965d61c9738200b0a82f2c7364a2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                            Filesize

                            99KB

                            MD5

                            34e27fad1197c1f4cb3f25db94b68d16

                            SHA1

                            939fb261446d2520b9c5a6e0bfc5862234ec8e3c

                            SHA256

                            5ca1a33cbc9e2477d7a51eef3834521733844dc19f59ba97f56e61aba667a451

                            SHA512

                            0e33b8751a80aa89005585b9f00901f1bc1a61a4c54d93877b673d0f4b26ddf91e59c93054499f0492aec9297bca2349a259b76f69fe264dfd1a139682148758

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe579ac9.TMP

                            Filesize

                            95KB

                            MD5

                            97aaf0fbeebc0dbac82652c63d1e8a19

                            SHA1

                            80ea27701ea60dbf3ec9422f51537a8f2c1e40d9

                            SHA256

                            dfe91251b975993f9cb1c7c31188dfe8f0960487a3f94a857a720fb0739be031

                            SHA512

                            fb4628d083ece18ce2ba224512ca843663746b8c4c7fc9d0c8531058428f370e43b7f1d5de0d0060ec30a19d29e56a2393c7a09f08b94c5c0ea2f7b0445539f1

                          • C:\Users\Admin\Downloads\NOTIFICACIÓN DEL FALLO; RAD.7653890012-2024.tar.crdownload

                            Filesize

                            2.0MB

                            MD5

                            14e97c831d3eb18a5fe6a708e7b70d0f

                            SHA1

                            634cfebdabf6fe48ceb2701728055fcf8f3794fe

                            SHA256

                            43599f53d07c79582db46154043054eeb2b447602b71a6501d8db203783febe7

                            SHA512

                            7819e277acb5bd4e98af1ddd0ae4e82bd6259df1b797853fb8ba7f260d9d3051d58bede5d5df49ed8e1035f353ca364861ee4ad8be5aa040928cfb45a8716787