Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    299s
  • max time network
    273s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/04/2024, 04:10

General

  • Target

    https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/RAT

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo/tree/master/RAT
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1404
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff91783cc40,0x7ff91783cc4c,0x7ff91783cc58
      2⤵
        PID:3596
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1972,i,12428646496430816540,12194742138940982181,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1968 /prefetch:2
        2⤵
          PID:1560
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2132,i,12428646496430816540,12194742138940982181,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2164 /prefetch:3
          2⤵
            PID:336
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,12428646496430816540,12194742138940982181,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2416 /prefetch:8
            2⤵
              PID:4300
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,12428646496430816540,12194742138940982181,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3152 /prefetch:1
              2⤵
                PID:3012
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,12428646496430816540,12194742138940982181,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3200 /prefetch:1
                2⤵
                  PID:3288
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4576,i,12428646496430816540,12194742138940982181,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4584 /prefetch:8
                  2⤵
                    PID:4104
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4376,i,12428646496430816540,12194742138940982181,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4660 /prefetch:1
                    2⤵
                      PID:712
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3296,i,12428646496430816540,12194742138940982181,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4900 /prefetch:1
                      2⤵
                        PID:4136
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=208,i,12428646496430816540,12194742138940982181,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=5064 /prefetch:1
                        2⤵
                          PID:4608
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=964,i,12428646496430816540,12194742138940982181,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3348 /prefetch:1
                          2⤵
                            PID:4112
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5056,i,12428646496430816540,12194742138940982181,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4932 /prefetch:8
                            2⤵
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5092
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5016,i,12428646496430816540,12194742138940982181,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4848 /prefetch:1
                            2⤵
                              PID:3188
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                            1⤵
                              PID:2660
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                              1⤵
                                PID:2672

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                Filesize

                                649B

                                MD5

                                7a5de53bcf9444635eea52623ddba826

                                SHA1

                                afdf468f7ab3bfe0448ff1b3acd74717b239cba7

                                SHA256

                                e7a5c258e756d70659a64e5647620adbb221a0fad51751ac82f83c9f9a498f29

                                SHA512

                                f8da0ff69e57a313ad89791a9e54cca2cc0208d6481f91fd4f9d60277d6acfa970a4e4a6a4f5ba6014c653ce8691f59dd52fc1bc6ec6b45bf7702dcc2163e263

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                Filesize

                                2B

                                MD5

                                d751713988987e9331980363e24189ce

                                SHA1

                                97d170e1550eee4afc0af065b78cda302a97674c

                                SHA256

                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                SHA512

                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                b075fad8d29051a44adbe716b17c6cb5

                                SHA1

                                9e83c44aeee0fec0e4a47fbca27bb356ce42b463

                                SHA256

                                e88bdb3db3524090e6ef02c1ae624397f9d7058d97e13bc66302f3928bfadb7a

                                SHA512

                                d04df0b8af6e7ab129390120c311d43100f86c6915d1a4967269a9cdef73d995fa75e5f611e0aea55726ec7090028bd6c39e9a16b9ae10a1eb0f0cb0503eb38c

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                8KB

                                MD5

                                781a9efe0df4ffc64357d66dd49164ce

                                SHA1

                                2b67ed43a71640208928f08081ab17151bdbe07c

                                SHA256

                                196ee4f60550d10de1e096289aa16a53cddf30e18ccb33518be38984362fc75b

                                SHA512

                                4d75ed7d930e3b03e806763d250b258b631fec274d51457b8b7bf25b3772c50dc9b9d7b0cb6037d3b335352f6730297ae05e68b86aa265b9c8f348212016106f

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                2c10c52b1e414e0a46ed8bc908843295

                                SHA1

                                e5503f96f4d24606b9632bd28132bdefc8631fe1

                                SHA256

                                26a47313d213d9b13598fb278125058af4e71f4abb6323e60db62199f43a2cfc

                                SHA512

                                a1d905fadf8a796e092e28ed6669624d36db28ee819f6cf37078f3c3092e72bd5b2be3fbc6ab373524b9379bae96e990556e5973a12947e9fbbe0eb0a7958144

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                94a30fa9781a4a1d3b4b2d8b37d1c743

                                SHA1

                                253838f6f3b717875f78b256f19e1dc0dbfd6c3e

                                SHA256

                                c0c307a774cb9a42305e2dd3038b467f78ee2aaf199fb578fcb01cbf47dcdf69

                                SHA512

                                7d0da8c489fcb5e7fb98da26911398c9d33e1e755c15fcbde60134756b1f9d149246d92aed2894a633a2c47fb7e1768453248cb800a55b8cc05f562a99a090dd

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                be24b2d7a08150afa88e93f112ed4042

                                SHA1

                                ae2a12198605282f99adcce687da9fd63eacf293

                                SHA256

                                bf261cdf48a2f7c7b06395bf7bea138602e94aed7316782e79da993234ff2583

                                SHA512

                                4263efb38fed05c793ce56777920552f46ed4262d934fa55ed50f5267bd2bb821da00cad2f82a9cc3c2cca4abef06c82c516238a9c98f4a2bc32ef6b32375747

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                28aa8c95085b983ae5825a35287eb6a9

                                SHA1

                                4da5e96c1c1221c99977de913f4117bb442fb9d1

                                SHA256

                                946470609f9048236a269db6e09de1db4dd1e57c0030cb9ac28ff917f2c7f4dc

                                SHA512

                                2699c6a5c0c05d1793aac38703a5f1af2d0b03fea94981863ad39c9b9e40f8a82e10677189b24e7b5af64ad968096e4e1487e2da82985c633314364d44a6fcb4

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                c865dee896910e9cfb0ca4372897fa57

                                SHA1

                                7c485a4835500702ff2d0030ec9e77d1b0b5165e

                                SHA256

                                82f536f381c3fdbfa3177f136aba4a5e6aad225970308462558b1be6adb24e2d

                                SHA512

                                685e3200d642c1072f9aa9dcd8c9691c3741fb28f7db3995aa09c21035707ffe656f52a5bb63b72e9a50137e004680068eae3141808e18148e125a488236aba0

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                5a06a4f24ba2b8664d840f75e442a8c4

                                SHA1

                                323c0aa03556380e46c3974dd2b0d0459104f61a

                                SHA256

                                a4e449bef63f898a0a47b1915438b6e098cf943385f000b4872ba61251fedcd0

                                SHA512

                                8feef9ea65abe7c8a036c32c2e9255ee002d75e8147d6b1bdfbeef268b121bd0ac7ae323bb093f418f968246b3745c1dc7767e62a4899f785389d037bf81e1bd

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                9518874fe1531eb2fab0faaac4dee739

                                SHA1

                                45ea0e66500319f455f61515874114ca45af5ad7

                                SHA256

                                8324ad27c23896df6bc657de9cb5e24f691b6a9cd25419356affd29e104b581a

                                SHA512

                                6f76310767353ec692805d0e6c7483a598bcb3815c044be25c6e794ade39394411c3f106a485e7cc451c17e422c80e038cb718b83c042aba477ae826c2a18f5f

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                49f862dc3f7ea47d2b0ded783228583b

                                SHA1

                                26f110300093cabd8b356f218367317b3f5c8382

                                SHA256

                                55173631a4f5afb745d2e6b5920720b32cdb519a782ef1123fb65cb48292172f

                                SHA512

                                01783701852fd0f8a4ec975608a353117e27d37da3d26515fb93eb0a7a9875b18bf9d35179702441cc10a7b13a2d1b6561e05180de7f254eb582d1485d8affec

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                cd6e3adc5e14c6773188c7cab5809c32

                                SHA1

                                1bcaccdadd0151437643f6580a7518e7da3dcc9d

                                SHA256

                                85027eb4272b346bcca076ddb360cea4557dada32a4ff9249d473a805f9e27b1

                                SHA512

                                18f2c80c82ae83182d01562f45d88cba255ef1f384c92801326cdfcb0e4dc0680f4dba6587accfff01850912936d8a002958ed892c9c48a0366fc84056eafe4b

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                f3aa091ed3fc1dec6a60e29b840d3dcb

                                SHA1

                                9eb1b5edc23b2393791c024dcf18fd291e85b17a

                                SHA256

                                690fdafaf83cc4cacb5323d54f40b3df109926f83f3614b24104d935a54b1112

                                SHA512

                                c96b117d1f534ef3c74875e74670fb06575f31183148e45d0a769414bbae1a800febf9eff21d1c623ee8a3108764f2cb00b885686a02119653acc07d05e010d5

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                4850e00f8a453697f38d671802c01b3e

                                SHA1

                                f20d2c3b5696baa7975750bd8e06b70f9c2e8821

                                SHA256

                                45468adcec4946673de232ec44dc2a5d50f6e28ee1c2bc4cc10b576a60698551

                                SHA512

                                23fead05c62a63597fe13c002e24557c75b5c099ee1e25e38ee7344b85c8009714568672feeba866dcedcdd539ae88c5cc747c9dddec13826ceb2ca1c2886c31

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                f0a7061ca2f95caa2569be7a64ee4394

                                SHA1

                                eef73f67e3cb596db3371c928613e0d179605342

                                SHA256

                                81a15c6571d8fdb5eb20a05931f6288f9ffa4e61dac5c90a87154cfc3100a980

                                SHA512

                                2b0e50d984e9329611734bcdee0aa10801fb48c3281aff9cf928c7e745c0e02411eb6332c158de0a6b5d1155fc191b337da98d5ec97b936e0d5d70e2d25be9ed

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                c3c533e7144b49bf3b09343ca771602d

                                SHA1

                                591b30886f99b9c771ef1e21a1754045878a0239

                                SHA256

                                7d74a38392b6389d95d3e142aeb7e79d667e9fab069a1b25f3d46d3504b47c9e

                                SHA512

                                d967b38ccec90f59736ac6057decdf1fe0282ea41fd7bb9bb28096dc9a5c3b61b2753ee0ad54d2ae9944e780bc4a3fa25308898a207423c1b7e4c7a29916c75d

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                e456792f558f6ef7fba3f987d16dcecf

                                SHA1

                                f838de9f70139cc17c01b383d5eaf136195f6fc8

                                SHA256

                                54692903061215d718c8703e5aa940cd3b080901a07d5bfdbbfd374bf9b54ae9

                                SHA512

                                c59e5dfb9879ce2899be30616a33bab5ffb0e002757f92c1105b98c83d7e923e6c2dc39eabdaa6e8847432648fd1006a95c6a4f86f54dca56211dd3f05dc904e

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                77KB

                                MD5

                                77d4ae1a46ab3f7a2783f377364fc547

                                SHA1

                                d94b3d07ec8a3b184817231f25bb042cc3d4cf02

                                SHA256

                                7db4dd214f4586c091835500e50004ea351b40e2b9ba79946281ee391600c6ca

                                SHA512

                                613aa5d3b9654ec6c28e955f91095cd46d8dc3042fc115e50700acd9cc7783dd7e0a7e393fcb90c639ce5d209ebfb23206c92ef55b14610ac58b5416234c898e

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                77KB

                                MD5

                                07e22303effcb6eb53bd2eb785d5ca03

                                SHA1

                                7cf3f0acb3bb3b5e9f16f9338396ddf41106fa20

                                SHA256

                                2f6cdb4eb85c089be1ee79d6e13c2d1e2771fd00f401773e9cdc136f87d9f8f7

                                SHA512

                                55054bf0b5b0859b62fccff886af4580b149f330108f5811bed229335a5796aa8f3ca735c8aa2cc659f7659fc39a958c7662346689031f3b2f58645361fb46aa