Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    25/04/2024, 13:50

General

  • Target

    AarSvc.dll

  • Size

    38KB

  • MD5

    d199682ab29121afb4769bf69f85384e

  • SHA1

    50ce145219d9f8d9aef54fd850c99046c7dfe6e0

  • SHA256

    1a6120426d8ca8ccb9d9dbb5e675fdc704f2c5e365f24b23bf23d29cff16ddee

  • SHA512

    e2fd3f8989d2e61c9e2a1bf2fce23c04d17f4cb38ea8fd5fb762cd939be5a5f1fde403313cb2fb3052ef452a7952d9f83c554020c1bc874ee1f8d4d8c5c4d152

  • SSDEEP

    768:u+lzxo7OaJeeIculAlicTtr9+pjzHnzplpLXekDel/dG974d5GGGGGGGG+l:u6OfFvTF9+pvHzbpLe4GXGGGGGGGG

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\rundll32.exe
    rundll32.exe C:\Users\Admin\AppData\Local\Temp\AarSvc.dll,#1
    1⤵
      PID:3016
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1016
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd7ee29758,0x7ffd7ee29768,0x7ffd7ee29778
        2⤵
          PID:1104
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:2
          2⤵
            PID:3284
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1872 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:8
            2⤵
              PID:3568
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2128 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:8
              2⤵
                PID:3924
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:1
                2⤵
                  PID:2184
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:1
                  2⤵
                    PID:3280
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3984 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:1
                    2⤵
                      PID:600
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4420 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:8
                      2⤵
                        PID:5112
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:8
                        2⤵
                          PID:4208
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4924 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:8
                          2⤵
                            PID:1996
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5040 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:8
                            2⤵
                              PID:1528
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4916 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:8
                              2⤵
                                PID:212
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4508 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:8
                                2⤵
                                  PID:1728
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:8
                                  2⤵
                                    PID:5044
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 --field-trial-handle=1856,i,14739045286038031598,8824494608002743356,131072 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:3844
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:4672
                                  • C:\Windows\system32\cmd.exe
                                    "C:\Windows\system32\cmd.exe"
                                    1⤵
                                      PID:3832
                                      • C:\Windows\system32\rundll32.exe
                                        rundll32 AarSvc.dll,#1 jweo
                                        2⤵
                                          PID:4500
                                        • C:\Windows\system32\rundll32.exe
                                          rundll32 AarSvc.dll,DeviceInternetSettingUI jweo
                                          2⤵
                                            PID:3352

                                        Network

                                        MITRE ATT&CK Enterprise v15

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                          Filesize

                                          1KB

                                          MD5

                                          0ec0d4ffe8fbc7ea8c928f54acda3281

                                          SHA1

                                          21f0dc0f7345ec08cadcb602d3c75f4afe54e7c5

                                          SHA256

                                          3a6b9e357db81d6345b586475390a2ce3cae06d3d656b516da2c068ce04333e7

                                          SHA512

                                          0b96295e3c36d260691b2c7d8235725f6f3a3b898df7e79926d81e3bd77bbc0c4719d47a1b688ff919aecd3304d77ccf997687ab8f3474193517f785d65c2436

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                          Filesize

                                          1KB

                                          MD5

                                          08e585541aaa43379ad5acd169dd7607

                                          SHA1

                                          d0fe449764babcf9ad4d14c220074fc1f5c52852

                                          SHA256

                                          64a7f251c27db22a7fa539979b41dbc13cbdac680e4672444598df8279ab873a

                                          SHA512

                                          62b779511eefbab72f1493b28848230930201f9df94fadc1946141fdcb9bf991e7e44b9a570bc259af6225c7184589a4a4d56d7fc9ad5bfa412a6434781ab0ff

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                          Filesize

                                          371B

                                          MD5

                                          67410dfdee20141f26c610740e17ff6e

                                          SHA1

                                          540c1e602035f632cd9d57cbd07d9e001e73260c

                                          SHA256

                                          d307fa1f60a898f1c9c33860407e6a01ef93ac23857ef5074245fa628f3bf574

                                          SHA512

                                          e7d248542221a5230f26e4d2d7e0aabf97a39edc68f2ceb269ccc5eae08eb2da88924c38d223c24361e1929e7be0408a24003b1fa7370d1c73c571dedea51d9a

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          7b3b7a3a6907af9318b715ee1362a27f

                                          SHA1

                                          4c378dfc7cb7257d8a6d13eb6570dca61e9770a4

                                          SHA256

                                          5cd0fb78fbadcf001a76fc569d8f864e46715ee75467c74d3a653a8fbfefa60d

                                          SHA512

                                          a7322fd95e7e41d0d1fc572a378f6ba3e20edb6eb0e6843949a359a1d266f3b42f0694160822f9eff9aa2d0699aaf0af3087326ecb767cc12ea3777090147d4c

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                          Filesize

                                          6KB

                                          MD5

                                          ea81b02afb9f34c4ad18b577ce2e95e6

                                          SHA1

                                          bc4f8d789ec98dae88ad78afe3eee461093d4b8a

                                          SHA256

                                          8874ec1934349ba4e2d77c23f75c1419e542c926eda5b7f74f6e60cf3dcca4d4

                                          SHA512

                                          185c3c010989401ce843cfbd2ed16f71d7c48825f39f4ca69f96e96f5ad22cccbb7a95f8491503ee5633e7d9d7e3a48584254b1361fc00e1815c3c095492d4ff

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                          Filesize

                                          15KB

                                          MD5

                                          b19c1ac5578a6125a780f9c7eefb89a0

                                          SHA1

                                          1cbfc2eb395c345523fcf9934c53b3ee93286e2e

                                          SHA256

                                          6f4355a3f1894ae21212a7e80abd190cdfc857c9f50ca6459748b9c2d3406625

                                          SHA512

                                          043331263acd7fac732999be4aa422903e652f73cc0a16b1af522d195e76e725ef8e146261f655ba9db87b975bc7b25c53f7a2d39f73271b0a3bb60e26cdbf29

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          274KB

                                          MD5

                                          663b13be0fcf9aebcf303fcc58534874

                                          SHA1

                                          5fd201670a3e7e36ee4f7b8553af590c0a4104ed

                                          SHA256

                                          0e3db05c9178f1ec9b333a5927cdc02f6f1d16e60ef5c909078f7efcbcc29267

                                          SHA512

                                          a77aa8c25b4924618201459c600be6aec9a3d6ff9f531fcacf5ca974dc780bb1bd25cef3b83d30cb0e329c370fe824d9dc4db68ef4cb21dec17fb4f1c133a38f

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          323KB

                                          MD5

                                          8661b27086f2e8204515ceee2892e0d6

                                          SHA1

                                          4205001377b19b918e1efbb87af6665179c7c05a

                                          SHA256

                                          9c303768ef9d85ba22a40d1aa6bca34b615a379bda4c1a83b5d15a6094a77e77

                                          SHA512

                                          b2815efad34a2ac01eb773350de466bcfc032e76334f2698027de6a77f1ac10d3e7657f5116e77f6c9f51d1f05c2e922f5e59710436466ead2c6cf586448c436

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          137KB

                                          MD5

                                          cdd0035aeda1023b89143334f9c229f6

                                          SHA1

                                          45bdbbc51777c3e65ce2d66b562345b8c9247530

                                          SHA256

                                          2f45bf1f0cd9db555814eda1dc0923dc7448d969dacb5d53f8e1ff086e36e368

                                          SHA512

                                          c6abd260bc6bf9ad0d9fdc54097f0b27cc3951df1d4028258abec2ed3ce84b2ab10043d10644b7322849cf20b35d86bcd6e37bf64f65be880a56ab4e511b70df

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          275KB

                                          MD5

                                          b116e2a361cda7fba4d30676bd7fa36b

                                          SHA1

                                          84b3dc176d9f9ec2fc4752b4c775a07cd843d28b

                                          SHA256

                                          e9a80c9f8c5ff25dc136438b7291339e18842495c95d39260d06138711a1e9a8

                                          SHA512

                                          cc5a1765a09fd599dd6d208972d8e5fa81b1a4082db1f63466745c2289828a9ce18676d026bfe4192d1d8a1361eac3aac3df8003d852ffccc9a33a1c4828bb27

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                          Filesize

                                          138KB

                                          MD5

                                          2a343dc31185e34ad1d202c8b23ea8a8

                                          SHA1

                                          3ddfdbf2262b96d5108630e5c7d46232eb51bb44

                                          SHA256

                                          58dfb9bb423fb3284345d8aa5d8049335fc4e3c802c207c97aed256e530eae2b

                                          SHA512

                                          5a9358e087cd88a537fa19db5a9a5fa318e703ab2bdfef47d96cbe25c759dad036fc93f550a925f325ad1405e70b421d512fa96348d1bb393563ff2b11ebed06

                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                          Filesize

                                          2B

                                          MD5

                                          99914b932bd37a50b983c5e7c90ae93b

                                          SHA1

                                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                          SHA256

                                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                          SHA512

                                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd