Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/05/2024, 15:14

General

  • Target

    https://www.markelonline.com/forms/download/MPIL10830415

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 33 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.markelonline.com/forms/download/MPIL10830415
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4680
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdbe8ccc40,0x7ffdbe8ccc4c,0x7ffdbe8ccc58
      2⤵
        PID:4704
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1976,i,3078912281843518543,15394957595946108803,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1972 /prefetch:2
        2⤵
          PID:2168
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1892,i,3078912281843518543,15394957595946108803,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2076 /prefetch:3
          2⤵
            PID:2068
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,3078912281843518543,15394957595946108803,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2296 /prefetch:8
            2⤵
              PID:3992
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,3078912281843518543,15394957595946108803,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3136 /prefetch:1
              2⤵
                PID:2864
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3120,i,3078912281843518543,15394957595946108803,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3172 /prefetch:1
                2⤵
                  PID:1564
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4588,i,3078912281843518543,15394957595946108803,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4744 /prefetch:8
                  2⤵
                    PID:2448
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4952,i,3078912281843518543,15394957595946108803,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4972 /prefetch:8
                    2⤵
                      PID:1772
                    • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                      "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Downloads\MPIL10830415.doc" /o ""
                      2⤵
                      • Checks processor information in registry
                      • Enumerates system info in registry
                      • Suspicious behavior: AddClipboardFormatListener
                      • Suspicious use of SetWindowsHookEx
                      PID:2272
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5064,i,3078912281843518543,15394957595946108803,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4608 /prefetch:8
                      2⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5148
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                    1⤵
                      PID:3856
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:2956

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                        Filesize

                        649B

                        MD5

                        b754a3ccc7b28aa42176f446b5a63bf1

                        SHA1

                        a486a756c54aeef3df764ec9933035894d10e3be

                        SHA256

                        e463a279bc057d8116e8502297e3e392a1196ba7dc6e929a82b4d60cf2cfa09e

                        SHA512

                        8e48df20462288299257ed37ee2c7723ef81c30470b79c56982df17b4360d5487c08585fee960eb0df04b5220145954815e436db10866a4d69d03b73578ef695

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        c73adfc082fee23d5d84acbd800696b3

                        SHA1

                        7b13f0249224350bfe4033ebafc74e4c291623a4

                        SHA256

                        38359c82b9f2b016aec276112eacb1dfc33e37a711f1cabf23d11a6e58fabfdb

                        SHA512

                        efad1b0aaed546f21c7609fb120bf901ea9210ae350eb5705ab9fda0e6c0264b86548592838a4ae5d372ddb000150d297f28bb04d160a6ac7dec5c6e198ccce7

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        fbfb9d0c02bf3d9bf8d49495215b2cb1

                        SHA1

                        e8604fe621db711768207b7c9111a3c25c40c3dc

                        SHA256

                        2e54e31559aa5afbdc090697ab6e2673e3f55c55e68d523365522cc51d4ad0a2

                        SHA512

                        b795a1b08f5288a51d96197ff5c892caeb79e825f6e3b1170fd82cfb054b83599c3788420444d027b23245d300807947d35bd358ed4f9f858982400d03df7679

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        524B

                        MD5

                        2073db39541ce82db3eabd1c6dd1a370

                        SHA1

                        b8699ee4e3e873c4c19e69f0683fb99caaecbda9

                        SHA256

                        76783695e43ddbc119ae94341a2626c6a51e18fdf5222db84814377d0f2fb19a

                        SHA512

                        22f0582728356a4251147f8a7a0e8893859c98311b4ae2ba77146b1f3c26b9e9b7d6cb79ebafd144a7074161594300a82f4a2cee29f1ca57f91c421d4caa008c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        8KB

                        MD5

                        6871d11e80e8d0cff44e48030cd90af0

                        SHA1

                        1689f3792ce465f7b9f7959675c5917990dad6b8

                        SHA256

                        20f7686da72086882bcd8386f6343f7a8620d332dec0f042fd76b91e0458778d

                        SHA512

                        774c52a87bf6f7676f3437ae66d4066569bde4d0202e3196f3a31e2478afdecc1afff8fc56915449558b16d2e2d47827b0819847bd5ac9e1cf34537102191248

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        bcb28238e73ef6ecc8c388e27e88e033

                        SHA1

                        bfd4605dc6ddb5df0e334bef3b5a56ba5fedc39c

                        SHA256

                        d2640a012a25ee921cc54bb8a52b90d3e3088cf4c0cf935704e809a71562b01c

                        SHA512

                        82c3d74d951cee6c42886160b0f300b18fb5166d6bda1283caf0516ca711f407803a414c5a808e9b297878a2f7b1c2ea43efe1374fe7fd5726ac929c6c347d51

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        3c551e5fd580133fa534abff62bcddaf

                        SHA1

                        6598b061fe99425f146b70494c15be99c3dd8a9c

                        SHA256

                        7e83b8c14d8a9baacc22f353edfd01eaca24e9995e1d5470c88177ad1ec0678d

                        SHA512

                        b2b0b2a2017a104cc1c7d1bdea2122b6c58b4585679e6aa6ca3514d602ad003fa72f2b3c33cfd14cd7209e84ebf3643b2a6361d4c869d3ee273f35bad1284325

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        f085c363177840fe31decd58805c4d95

                        SHA1

                        dc3dae4e33b7b2f9e7f5ff42149cb824ef4c0fd4

                        SHA256

                        78f8493bb0154ca75a264ffe1671b69b41c295eda1334c19ab6c1727dd4ebd33

                        SHA512

                        7a691afd6df2eb9ec3eec24bb1858e608628b1c50acb39bd5c0759cf179e3de13d4cda73fe5486b55910a7acbdc6c6e48e8ac49d1b92b0f6f242cdb17821e88c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        33fc9ad3404906da3aab993ff73ad6d4

                        SHA1

                        bf21740d9145a45e6b3cf9f78dc5e2a626642dd9

                        SHA256

                        848b5df50e71749b94397372018e57504b1d0336d50ed86b7b7abc5046acffdb

                        SHA512

                        05fa0fb0f67b2c97c3e2552c6691b279f1516e8dc234f2959ea780b60159b38ad32853ea642f68cc12ae82c3a889cfbc140b4c042bfad8bec08970303ab7ff38

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        8KB

                        MD5

                        8c3ceae7f9e99bd229717fcf25e1e4df

                        SHA1

                        dd7e0e8482c94b3a727e459daec775de7538f4ae

                        SHA256

                        1a1f4b055bc69f04c87f4bcfedfcbe3ce59cf4322ed42439dd52bc0a8e520571

                        SHA512

                        8ff9f6427792798824d053e0bbd09ad79f500283c3bd35c1c92112d7684ca56345aa5dc98ce4351300642bbfca46ef8492facdbeab5c30ac8d110c1214276d49

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        07926193a01ca677c3ed301e65a16e66

                        SHA1

                        0fcc5922b34bfac895b3357bdbb8a84e25b24c69

                        SHA256

                        e883b6abcf30231ccb29986a10153875e65933b11544aa0301d9a518951c7c92

                        SHA512

                        9ba01ee5e6dc2fef7c3fd7227282e80e90e59a8e3b62aac3611d4ef6ae3373754f98254b2763c6eaad31199ce4afed39cd89a3ec0a83d38fe815ecfd95495852

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        77KB

                        MD5

                        37f4042d4636819018e6965a1ead92c1

                        SHA1

                        5264db9dc4a5583c1e372c82e6fc56631167d53e

                        SHA256

                        7c05e566a52ec44587d10554381178b642d6ea0e7aed50038880cd6c464769e1

                        SHA512

                        84f248d2808a20d6ec037aac3eae2604c50d6ee0537263241a8f626625bb6a53ab8a7795798eb93dfb5eacdb1d861a9ec095c18993e5d92e7ab6b05bf6951b7c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        77KB

                        MD5

                        a81246c6eb5699e8dcdea0ea420919bc

                        SHA1

                        7daa3f1cee30496bf65246b97cee2a9f8168617c

                        SHA256

                        3701998bcd9cb6e9a595f07dffcdec8da37be806fb897a0bb99e91205e2c4334

                        SHA512

                        85ff2124fd5e69dd74f97f80878921dd8d6354a026d60978ea84373f258072f9bce9630ef9d0d5a8bb505f8bc5f9de6932c97f776bd40861065edde987c67b31

                      • C:\Users\Admin\AppData\Local\Temp\TCD8B3E.tmp\iso690.xsl

                        Filesize

                        263KB

                        MD5

                        ff0e07eff1333cdf9fc2523d323dd654

                        SHA1

                        77a1ae0dd8dbc3fee65dd6266f31e2a564d088a4

                        SHA256

                        3f925e0cc1542f09de1f99060899eafb0042bb9682507c907173c392115a44b5

                        SHA512

                        b4615f995fab87661c2dbe46625aa982215d7bde27cafae221dca76087fe76da4b4a381943436fcac1577cb3d260d0050b32b7b93e3eb07912494429f126bb3d

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat

                        Filesize

                        257B

                        MD5

                        4840ed3efa9aa451042a02bf3893cda9

                        SHA1

                        41d30292ac28fe4e87da2881bc3711f0601542b3

                        SHA256

                        caa1e909feb0118f71e462beddc5a35abe6f0a1bdca48e0664b00c4ddc7a9b24

                        SHA512

                        9ca1bbe43c148256c32f78a13352b241bf7038142488299a67a8a4f9f6b576aaf8488d51f531e4aa6ccdd517ecbb22bf34aa022da325144ef71e97fabecbb65c

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

                        Filesize

                        3KB

                        MD5

                        33bb4255b2304992d541d539a429e7dd

                        SHA1

                        73d8f5d7efb8c4e2169914f4157a9893c529a488

                        SHA256

                        de9145c7a31a182fa4f85b4a56951594991c154598a29670307752f8eb049d97

                        SHA512

                        ed310a3e21a8874e85275c56c430a9ce406de2977519ce4fae86c8ec5c950a305c4fa6831421f780f882b6b9cd19866a9cd11b127dadcf8ae7b3d0e61365049a

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\fb3b0dbfee58fac8.customDestinations-ms

                        Filesize

                        3KB

                        MD5

                        c4c149eb32ab91e84d8a229c845c6f5e

                        SHA1

                        7b9762a084399e6c111b0a414d6a90d53698b206

                        SHA256

                        bd124b714e3181f2643c7d8afaafe2c9cafe0ae68b33ea1151c9e77ce0962ab4

                        SHA512

                        89784ae0bdf4c176899e7a7a3b6eafbe99b008cff2cea63b0fb5d328e201e47ab7dadc3a9d41c062b8d1f97159741c3b893dd3dc94f1f4500cdff8a8dae5fb73

                      • C:\Users\Admin\Downloads\MPIL10830415.doc

                        Filesize

                        34KB

                        MD5

                        6abfa63f6ef4b8fbf8c86d8273f35fe6

                        SHA1

                        b4a9633690308b81d9be958525f75dbc1b591a1c

                        SHA256

                        f33710a349a98d623194b384c75d24f8d2efb065f774f6dc3ce60844a57f50c1

                        SHA512

                        65a13ba96c2f46831e901bc3c340c9ac769e6907c6ef4fb20efc4e6d28fa9d0261daf11943a2e705ad1db9efc8c24032c071d40fa5ee08fe207470e1464b6d9c

                      • memory/2272-51-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-54-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-62-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-63-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-59-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-60-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-58-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-57-0x00007FFD8AA40000-0x00007FFD8AA50000-memory.dmp

                        Filesize

                        64KB

                      • memory/2272-55-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-56-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-53-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-61-0x00007FFD8AA40000-0x00007FFD8AA50000-memory.dmp

                        Filesize

                        64KB

                      • memory/2272-605-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-52-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-50-0x00007FFDCCC90000-0x00007FFDCCE85000-memory.dmp

                        Filesize

                        2.0MB

                      • memory/2272-49-0x00007FFD8CD10000-0x00007FFD8CD20000-memory.dmp

                        Filesize

                        64KB

                      • memory/2272-48-0x00007FFD8CD10000-0x00007FFD8CD20000-memory.dmp

                        Filesize

                        64KB

                      • memory/2272-47-0x00007FFDCCD2D000-0x00007FFDCCD2E000-memory.dmp

                        Filesize

                        4KB

                      • memory/2272-45-0x00007FFD8CD10000-0x00007FFD8CD20000-memory.dmp

                        Filesize

                        64KB

                      • memory/2272-46-0x00007FFD8CD10000-0x00007FFD8CD20000-memory.dmp

                        Filesize

                        64KB

                      • memory/2272-44-0x00007FFD8CD10000-0x00007FFD8CD20000-memory.dmp

                        Filesize

                        64KB