Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    125s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240412-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/04/2024, 10:01

General

  • Target

    http://www.mclland.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.mclland.com
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5068
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ffffab58,0x7ff9ffffab68,0x7ff9ffffab78
      2⤵
        PID:3512
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1924,i,2312533556191221058,4094817387155590153,131072 /prefetch:2
        2⤵
          PID:3016
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1924,i,2312533556191221058,4094817387155590153,131072 /prefetch:8
          2⤵
            PID:2088
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2236 --field-trial-handle=1924,i,2312533556191221058,4094817387155590153,131072 /prefetch:8
            2⤵
              PID:4492
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1924,i,2312533556191221058,4094817387155590153,131072 /prefetch:1
              2⤵
                PID:3444
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1924,i,2312533556191221058,4094817387155590153,131072 /prefetch:1
                2⤵
                  PID:4876
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3568 --field-trial-handle=1924,i,2312533556191221058,4094817387155590153,131072 /prefetch:1
                  2⤵
                    PID:4008
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4516 --field-trial-handle=1924,i,2312533556191221058,4094817387155590153,131072 /prefetch:8
                    2⤵
                      PID:3880
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 --field-trial-handle=1924,i,2312533556191221058,4094817387155590153,131072 /prefetch:8
                      2⤵
                        PID:4912
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=1680 --field-trial-handle=1924,i,2312533556191221058,4094817387155590153,131072 /prefetch:1
                        2⤵
                          PID:1756
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2944 --field-trial-handle=1924,i,2312533556191221058,4094817387155590153,131072 /prefetch:1
                          2⤵
                            PID:800
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1924,i,2312533556191221058,4094817387155590153,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:968
                        • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                          1⤵
                            PID:5052

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            480B

                            MD5

                            3368379b68f6df7c5e337abae3bf4f34

                            SHA1

                            2c3c24c53fd798a758e8f97538a0e5c1c203e44f

                            SHA256

                            6d6656e5843878877d6f888fc921172a33d2fca862e314d336ad1f3ad348800f

                            SHA512

                            49cc98f381cf500c858e3856512ca4659f72f440f6ba6f54a3a0dbc8ac94c3f52c132e19d0379fd28ed0860c7ec7f4b7938902d37839b500a32f80070f33b7b5

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            addc5bd31aad0f949b264fcd8ec53a72

                            SHA1

                            1aef5822bd04741f570f03791c566027e51b1f21

                            SHA256

                            8b727f9ee692bce1e649c32589852606c2f7ea9e847de3dcd6ae0626c0a3ddcc

                            SHA512

                            9cbfddc46c348e76c6a1e00b9f547c17a74eaffcffa025f84de19ae159bb2c1d33c06545666fbaa9e48a2f0a55c0c9ab398ef919400a869f0a2560c5f284f24d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            d506baed034e4e1f8673c6b9477be9f7

                            SHA1

                            13c2b31c92a97f7b1fb7f7cbc105ab5b7201ef22

                            SHA256

                            e537cbbe49f965fc2ea98f2e5413453a0c443656c907d0f2859f3efdabe1770d

                            SHA512

                            bffdb80d8ff999f8565f64914bc58d4a9d8fc4837bd25d8b82ce91e905265d41c103efa33664109fca8c5db7e43cbe1456ce54ae5b6f9ada12bdd28653ea2954

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            3KB

                            MD5

                            9cc8cd5f4e553b8df2f333d308e9ca8e

                            SHA1

                            5eb66d57e163c887563e465dc7d12e0dd0ddefc5

                            SHA256

                            6818f141e41ca4f7a6823baeb56c244077d57f0b7a08a8e0f606b6a28f1794e0

                            SHA512

                            df77d964c058fba3fb83a578e8cabb6e1c6c52df82ce1e5c62e5f0023c28957fb88156ff96688d3a1bdd8d42f8bd1c034bcdc93e17cdad12e00836ce23e73c40

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            691B

                            MD5

                            d326ed655e6076fab70a212c5939c3ea

                            SHA1

                            dca6b6c2a5f10990727091d2185f1a4467b0f689

                            SHA256

                            8416dd2a834228eac01adb004bfbe75bf190604ef36e578218aa8d588def4217

                            SHA512

                            03fbd1bd3561a24299c38b67ab5844b17e3f742e7ea90617baf67853fca9df260a585d6dfbec6aae01dde348b3f2778e6dfc5ad30d7a58fd82fe99f989a498bc

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            8aabec4d5b1c9b9ebbb6f42c1b49c70e

                            SHA1

                            e52228aa082f5a230d1c2ea79d16bda2fe884300

                            SHA256

                            b2629b579017d03154ffb82b5d733c92900428735c278ded76e1e1d4f5f06571

                            SHA512

                            950a411521c28cd96aab0517b6dbbb8a5b935180cb79ddd111d9ff30484780c38fe7048bf78a29c693f8197512621bb033417c75b0ee5befd94c2cd8b069b735

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            858B

                            MD5

                            c23bddaae1703b7c0ae7873c1bf1f26a

                            SHA1

                            dadb6e3739daa75334c3ad204cd414b25dff0ef8

                            SHA256

                            c2f83b97c194e17df2e94f9d90989cf8aa87339ecc87c460c775fbb6e348cf1c

                            SHA512

                            6780dc1efab0c32edca0d9ffbd1d591422e982a51e6aed92e9ec8404533174f34b6817a58391a183f5a1013fc008a07f0ce8513f08eb774949dda430edc61476

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            f913a09512f63a83b9cdd83b4e61e00f

                            SHA1

                            d8e1eff14b07a2fa6246322c43f188276d6f6193

                            SHA256

                            70d55634d032f0ff230e0796b083137d6aac410bdb67f961ca6a95e3ca6c386f

                            SHA512

                            2ac1f3d3014b26d78e0b71d459ef904dec8022899c9f59c5eec92557aa75a00b7f549db52a57e2f87b00f3ce5a813e41e17baaca1aed85c86c57471be1d2e683

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            55231dc600d3cc84af5566fcac8d01db

                            SHA1

                            2d136d9c4dac2c7436ff3aa73c6809884c11b9e9

                            SHA256

                            c34d3bcf4953e501b101d07c192b0ba0785c07cb9d5270647eaef46f426b3cbc

                            SHA512

                            e62f23e8fd72cc43a264c22b3dbd26b6a7cb25cef95968582778b6def91101b7c19601a544e533c78163c98509ddfa298b49d5a99964796227478528ef54a614

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            72a1d0c6513e9fe394d691f8464039af

                            SHA1

                            d6ef41d9737ad929bf748bfe66fa55724d90adbb

                            SHA256

                            7db37dd874359dbf2524bfe5c2653cd7c45f05533807c7665dfe35625fd1f380

                            SHA512

                            dfff556116c2657356eeeb9751d12c734cac51a5158a1bc8615dd819f959d729c26d6137960ff66c29ee7819b4bcae299b043710c3713efcad7f8dea03a116f4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            252KB

                            MD5

                            7ac0681299f46df7ed62a3662b9ae246

                            SHA1

                            0a78740c05409aa7e5ed0b2e82f58bc50dfe863c

                            SHA256

                            9990b1a7e889c57bd84447d5db319978ed8a3f5105d034cc66c0955708a65cb6

                            SHA512

                            d82ee58ab5eaf8d7f9b5f23620e97fd4bc89da3e587e65839c9041bbb467b9ecc8b0bf798b84bd526bfdb37d4d895acb2de788e2f0581e7c0c3f972833de149a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            251KB

                            MD5

                            412fa55a92975e32e6d550f4528c9cc3

                            SHA1

                            7d5affba4287a686b40010dc48960d98a821137d

                            SHA256

                            9710da0c3b9b18877f12cd33e4e850ad53f87503e7dcfa5c777374a5ddb58829

                            SHA512

                            4bc0b20f78f4c9e68c42991ec25fa53eb2692747fd1ae75a11b43c237e53a47cbe40cadc66a739395b4c401637d8148b2a1bbc3939d4e87636ae9da510a835b8

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            252KB

                            MD5

                            7e5378ae3b40b42180adba58de50db1f

                            SHA1

                            e1f33b5e3b31680c7d245a659691dcc01134ee35

                            SHA256

                            8c8981bf2ba9c64bed79c16c7d2d0dd3594c7a1b3160e0bba2cac0b66593c8bc

                            SHA512

                            7aa580ee24b44654093254da7abfa83d049eb63ee39243f93bff61ab4b4f2409e03b9d2e77938c2e5157128c71574eb8576d968c5405207008caff6bb29d6767