Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    102s
  • max time network
    104s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    12/05/2024, 16:56

General

  • Target

    aromamoshi.png

  • Size

    809KB

  • MD5

    5e951b749a58975a622c292097dcc1ec

  • SHA1

    dd8982aa5456ca0cb80fb269f905df6fa5d638e5

  • SHA256

    25b7c31a557da911e5b41f4ab16f4af498659f5a3a0d7ba019eca5f34b4144ff

  • SHA512

    75695a7a5606e920bf6466c0baad415b9a545d99bb23d88bdea12197dd5b0be76edc3c4f9561d4fc21ac513ba1d826f5edb0aebada63e0fa85880ffdd30949ec

  • SSDEEP

    24576:rcrM+iUtoQa3cByxYoyQii9fm6CSuAiFMM+HMVWwCYlzX:roMkoQasBytyQii9piIaVCMX

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\aromamoshi.png
    1⤵
      PID:4804
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3688
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff80e8dab58,0x7ff80e8dab68,0x7ff80e8dab78
        2⤵
          PID:3216
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:2
          2⤵
            PID:2008
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:8
            2⤵
              PID:3368
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:8
              2⤵
                PID:2652
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:1
                2⤵
                  PID:4688
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3164 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:1
                  2⤵
                    PID:4816
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4168 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:1
                    2⤵
                      PID:740
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4376 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:8
                      2⤵
                        PID:4056
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4364 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:8
                        2⤵
                          PID:1504
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4472 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:8
                          2⤵
                            PID:2496
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4468 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:8
                            2⤵
                              PID:1780
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:8
                              2⤵
                                PID:5032
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1628 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:1
                                2⤵
                                  PID:436
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2748 --field-trial-handle=1832,i,18351706734164019535,610159898231252913,131072 /prefetch:1
                                  2⤵
                                    PID:3548
                                • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                  1⤵
                                    PID:2296

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    1KB

                                    MD5

                                    431c971526711cc6d0a9f46d039587cf

                                    SHA1

                                    ba17491aed0337642a002fc989f287bba7c5f5df

                                    SHA256

                                    7c2c277fbf1de43aa4299b43c4b16cf15e1a12c7eaeee4dd654bbc658a64c8d8

                                    SHA512

                                    9bbec2c4f3a5a7441a0e2e36e56518110a86a419805fbdfcbd41cc1577d234997d99c146f2d08e4df296f5c18d72e8f42d1901da732c6bd38d9fa3efacbabeb1

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    2KB

                                    MD5

                                    0f5fa8bb6e382724a211a9c4db0e629e

                                    SHA1

                                    460668f373a79cb32fc2c737702d90bc5510942c

                                    SHA256

                                    ec31ca6adc08e28f056e89b6222bcc1e067907962291d51ac4b9691c85693345

                                    SHA512

                                    1fc66b5c5db1bace19e4774cd5fb557affd9f51a209a155a33ca70f9c334697c4289fbed153d2a8f3555bb7f3931ae7f4729f6ed7226de1f521ec8d5d21bd27e

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    f368090a0e2f2bec41f094557d278a9a

                                    SHA1

                                    90209aaedd310671c75b5a5d4eef2be79135ff1d

                                    SHA256

                                    0210d1d5092f6e91f8b32ea3dce6bff5807132cfafa052e0c2f7ff07a919658a

                                    SHA512

                                    1f0376b16764f07c2af1ddfe260fdc63245a35f9fc6e4ebbc5fc39869e5b09f7eb0563e100aa010714d319c6fc8a06f92b083de873c61fd9d45a2744de9f6513

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                    Filesize

                                    2B

                                    MD5

                                    d751713988987e9331980363e24189ce

                                    SHA1

                                    97d170e1550eee4afc0af065b78cda302a97674c

                                    SHA256

                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                    SHA512

                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    f0606e2a3a5036cf91a2f1f5bc0ff06e

                                    SHA1

                                    4bb4d7a8f9658ce86201669976454f9838492308

                                    SHA256

                                    f54650eb775dcee2eae4882852d37d035d69fcfc29556eb5e3b78ba1c92d6d22

                                    SHA512

                                    0f8ef00f8187c045a515323dc53b6b7369f1d8c7383120bc347bf7efdc8025cc3f03ae0c2cc247d25e86b6130d942dcea6b178f5be129ca53bf72fe94da6843d

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    356B

                                    MD5

                                    3fa88bda485295e8d2504db9f87b30aa

                                    SHA1

                                    d708b04593584064490a517f97b58ed7e8f3ac85

                                    SHA256

                                    a5b656cb529dbf8da1389100ac8d7183872cabd9155db958464199ea71490a56

                                    SHA512

                                    99d0b6c0a4d55d0b6661011591e5ad2ac78c624edba18fc6c8574d61389090bbb937903dba86d8d9876b83295f7fcac0de66fa1e3263dcfbe83be476e89dce76

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    7KB

                                    MD5

                                    3bc7b8acaa5b8486c27d0837059f49ce

                                    SHA1

                                    9b57aa9df8f44daea1cb3da2fd1195f775b8c26c

                                    SHA256

                                    3d4cc50a40738088aef3f882b56df56fc17b594985e174b43217aa256c9909ec

                                    SHA512

                                    8cdcf79cd018a13ebd38a363411cd09f541ee6191c438586cb5f817dbe4438ad7e5f0be2cba98f017bab6512ceb27b4a634b8558da97bf9b7be8226cd458394e

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    3debebd12a713090f75ada944dea4dd7

                                    SHA1

                                    ee7b6df8d377c4a3d19a654c29e279d59339afcf

                                    SHA256

                                    d2aeb73f72c8e69e374afbddd9728059099bcda688cad3ebb6c729ed0544a253

                                    SHA512

                                    dc1503e6993d372854ecbb51c815290bffcacf11e7e2ad334b1385d6634633815db29683e96b34ebcdd968e5e759c001c3826f18298e07143c70b0e7f84c2d8e

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                    Filesize

                                    16KB

                                    MD5

                                    28f37089865b09f1002ac533dcd2dd28

                                    SHA1

                                    ff8c602e0e49c769852c8165e62812fbcdb7bc20

                                    SHA256

                                    2c0fc0d22c47a4aa64554bf6f355e870205b16f1ea2a651a94a75f9f7cbdc067

                                    SHA512

                                    4fb27e1477ca3b9f6dd68caece596ac0314a7da9d62bb31b802ed66d18c14b3af00c720f2394b7b11340ccb6d7d13826f4351e1cd7167117445aa2f6f41449c6

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f2a93f9f-3e76-41ea-8bfb-2fd8db67fb27.tmp

                                    Filesize

                                    7KB

                                    MD5

                                    9800effab91586f27fdb3ee68f482ef7

                                    SHA1

                                    c8e393dff1f6997e088a27d1864fa0ec09ca6aaf

                                    SHA256

                                    17acb0fd2f08e1154655f5a6a2e837f0ad11f99a4436bfe96cd7f62c8c3ebdd5

                                    SHA512

                                    f9e426760a857af06b3c4171e070f1ca049e5f0a7ec962486dfc285411502cd751e18f06cda0a7c87673beeaf62ba9dc0cbaf98a4ae0d32468405660acc47b69

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    256KB

                                    MD5

                                    0479ad5a94a77e21ff8e9300115a0272

                                    SHA1

                                    2f81e08b1d42daf84a1722bac2f0350019796f20

                                    SHA256

                                    4ff95f3909c134ac65d5dd8eda3bf48182b1fd1a645c86b27e02a23be435e97f

                                    SHA512

                                    6ea93ecb8eeb1ca286009db0f15f5ef2eaee0f893f6c97404b16330cc44d7aef25a9fa1899042f5d9cbdf28235e49364cea6d9a3ad3e7eaf3cca326af7b838dc

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    256KB

                                    MD5

                                    d2c4e4f3a8327ac37291384ce4c6d2cf

                                    SHA1

                                    cee0cb141e7461795168fa4dce4332729dd43715

                                    SHA256

                                    b7c3ee31c11fa2c178c81d60937cc38eaaa766543ff74ab7c37844d83c655ec1

                                    SHA512

                                    d9ae02688beba4ca7ff0703cc9c1497844428c05d4f726575d31afed1e36bccdc2841a47c03ed0f0c7c230908f3d8769005ebcd90bd01a3d9c4b6f7fe54b68ee

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                    Filesize

                                    264KB

                                    MD5

                                    fe10325d29929dcf98d6b9927d1f67d1

                                    SHA1

                                    95bed7ca844d1c090c0fd32536fe99bc367b2cd7

                                    SHA256

                                    46c7693aab1df378b779a719c3e45d92753638b7305363a98313cdd8827c6062

                                    SHA512

                                    209d4e6db3df3aa881edc4d6cd00b6a967ee3a001229df0a6a1927f916f1f23823848417f82b5e183388e2d7f4184d24ca7f08e1a20e433cef1cab2d5cf5801f