Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

25/05/2024, 11:23

240525-ng6tqaee9s 1

25/05/2024, 05:30

240525-f7keeafh55 1

Analysis

  • max time kernel
    672s
  • max time network
    673s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 05:30

General

  • Target

    https://h2.nexus

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://h2.nexus
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3668
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f40eab58,0x7ff8f40eab68,0x7ff8f40eab78
      2⤵
        PID:2228
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:2
        2⤵
          PID:2416
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:8
          2⤵
            PID:1384
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2196 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:8
            2⤵
              PID:2408
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:1
              2⤵
                PID:2000
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:1
                2⤵
                  PID:1844
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4732 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:8
                  2⤵
                    PID:508
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4640 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:8
                    2⤵
                      PID:1524
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4764 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:1
                      2⤵
                        PID:5116
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4172 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4136
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1900,i,17412898825936454127,1186983617942024978,131072 /prefetch:8
                        2⤵
                          PID:3924
                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                        1⤵
                          PID:2104

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a

                          Filesize

                          206KB

                          MD5

                          f998b8f6765b4c57936ada0bb2eb4a5a

                          SHA1

                          13fb29dc0968838653b8414a125c124023c001df

                          SHA256

                          374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

                          SHA512

                          d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          840B

                          MD5

                          31a99e9927394f9933a25d88bade5f69

                          SHA1

                          4bef1d98edd36a624f4dbb22b97cceb5a4095629

                          SHA256

                          d4eb4812e413412afdf38ab1748065d628e070635058f7b23dfa36b6b520b3ae

                          SHA512

                          2ee67e92e32457232912a841f782c99dab0919497f6fffecab7d7f45d2e9ea028761275a60a8635994401ba4f47c98e291a808081f5f8b30a48cc6a8eed3603d

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          1KB

                          MD5

                          6bbf21159af0ab0c9b463d18ba8066f9

                          SHA1

                          5bac787a6c696a4ab282d3bd9d6e69901b37bfef

                          SHA256

                          88d50bc57cb903dff06cda6e9feccfc7063cdda3afca33ae44cc4d94f70a3578

                          SHA512

                          5cd994a5c26f1c374c8a1e840736c53692c1114a7464aff3a5824475d61f94e46b96dc00a3aa41c1aae5b5aa1e70b1ca494e3e93d4ffab1cec7eea67e0d92d01

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\CURRENT

                          Filesize

                          16B

                          MD5

                          46295cac801e5d4857d09837238a6394

                          SHA1

                          44e0fa1b517dbf802b18faf0785eeea6ac51594b

                          SHA256

                          0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

                          SHA512

                          8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\Origins\MANIFEST-000001

                          Filesize

                          41B

                          MD5

                          5af87dfd673ba2115e2fcf5cfdb727ab

                          SHA1

                          d5b5bbf396dc291274584ef71f444f420b6056f1

                          SHA256

                          f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

                          SHA512

                          de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1b938b8f-94ea-4b76-83d5-e3a020f654e3.tmp

                          Filesize

                          1KB

                          MD5

                          5b9bad0d67e296fc4fd8df979a7b4a5a

                          SHA1

                          ef11151116d51e2a65fae0936d50e4a2b676f8a0

                          SHA256

                          500ade2cfd6a9607f98f5f3f8140e5f72ec8fa84d8f56f8078661f1bcc21d689

                          SHA512

                          f1a334e1a10179418e06148e6965504c868fef5e54aef1dbe0a109f8e75483f9e0d7f8fe2462f26317d54dc66e53751d7e86cc31cab18c55ef6aba42cc1aca12

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          3KB

                          MD5

                          a443481df5f0fac5f594d5f56276988f

                          SHA1

                          068ee60b6c134f253007e627758f3b30194fb2c6

                          SHA256

                          0acf5024d9791c31389d0bffa714156f8b727bbf4f4f5006abb1639dbf392968

                          SHA512

                          bf7427fafab2578d557a6ff86aeb3b0794d0fbcd7afd68fe4cf834ad879902a954caf2656856799c9c66a4328a0228147383170027afd4ee78bc7569b0860ab0

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          3KB

                          MD5

                          e4681c203b2a376a9c1507ec22a21a57

                          SHA1

                          b73fb9dd70a06ca03f23ff35f3538ea113422631

                          SHA256

                          aa14bac827c757da0fea70c4112016ebd0675d6620a722c3a70512591e3a56e6

                          SHA512

                          6cd4506de0a1c0f6e1e6e1dbf879de5c1a4ea20cff2e749b03a19d5c0e8f5397f2d30df0994adf26ed9cb47f929dbd73765f00fcd5f66a6991ca8834f15de2c1

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          7a9e9bd0cb06e4213ef850907a204b08

                          SHA1

                          69678b0cb002c9728a36c28afa6673f773ba5c1e

                          SHA256

                          5b28d6d34d076dbb42b9a759c9bef5ffed0556a8cb367f0e14dc0f247cadd858

                          SHA512

                          fbffa98d641b23f1fdc472ddaf3c41c3504767ef02d36f205636a4def0f38a613fe35903018efc3218e86599b5a5360ed4f053fc9264e210375d0ab4ba103550

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          859B

                          MD5

                          5ae1444b9fa40ff5e2029b2ca18c1aaa

                          SHA1

                          bc3c120b43bb3e0b3d82e350a22ad7332c88aa00

                          SHA256

                          9660724cba7b46f8b2caf94749567ef9c67e52f58a7c4315c292e29ae013c9e8

                          SHA512

                          d3ec53bdf4f3e7604905869e308952098311ef7933f542b459f7a3ab1e1d54c927f3b43ebe89cdbeae83651a8082e464fb7b609d92eade63befdf0f96c8e1975

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          7KB

                          MD5

                          ed963d507a0a255f9e84f7a0d5b6aa48

                          SHA1

                          9a6b117bd36693655905ab2cc677312e19a8e9a3

                          SHA256

                          eabf5be60bd60ceb8678aef4a91c67ad3c6fe8401ca8c7db355c0a584cc90b76

                          SHA512

                          305818b8813a447056b08b7b23e341848b15d807833b6524b7a6ef9281cbed49e424c1b74c10f970c81a8047714f4529825c41a166956049947390ae65228add

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          7KB

                          MD5

                          57fc68b8a24395c5dae4f4b10f7d1dff

                          SHA1

                          8a31ee258f3d01ab85175e6b5b06d7ef3c0a1142

                          SHA256

                          eec1404da6e64de308d6fece3aa16b6074196e9fb78b006bc15fa703d15f3113

                          SHA512

                          b60b051166834824dd6d5b370fe02ca647183e84c49f64465e52a866b263a568e1e7dba70faf9103afb86ad459c97d9ac7e89d493035eef07cc4eae91fbaef8e

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          7KB

                          MD5

                          21d7d793dd59864e8a4ff97ac2b8ad45

                          SHA1

                          b3e68604ead46b8d4ed0806fc2e8aa0145b1a4ab

                          SHA256

                          53fcb52af59c4b85bcb9105c84e1a101900123a79413194a05f9fc46d1e44033

                          SHA512

                          a045a216b66c8e61524407bb63d5ba8d831c2881300c817d5214081b60b4e552341308ce31ba6943cbedcee6ebfbe6fb9aba0e7c877b5b1127347e9b137229b6

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          7KB

                          MD5

                          4c16928e07bbb58bebbb2acc87217782

                          SHA1

                          01f04bfb4edaeb7cf3fb1c896d8c9619ee571e96

                          SHA256

                          471da2110db674c1efc4e86c413c863c4f1313a3a340625689e2c5d2be67308d

                          SHA512

                          5e39c581092f7d0fe951b4423eccfaf113c203fc9760d11af0c77f7d975b59004e2e8a0620a583691401e1a62556606eb7e79ee92f4ad9f88b5abb63cb4cafa4

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          7KB

                          MD5

                          a216d76abe10a116458f3321723b32f8

                          SHA1

                          e63c4b75af68190e2d6cb49c9f5771bcc04223b5

                          SHA256

                          fa4d15f853344b82bf54fb6b80492f92c35c88ca7f79caaa00519d68d2e8ad27

                          SHA512

                          59ddc86596deba66dec808414c66f81cf833e53296255f1413d4954e62bb4f221193cdfaa6fa2ef95fa920dc77a912f92a24b5b5e337a21d894aedf1cb3c1c75

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          7KB

                          MD5

                          bd2b6423eb67349358a7557e8669a822

                          SHA1

                          3bfa54cd3ed6e7deaa4a883c3b7250f66801b6ff

                          SHA256

                          abeb952f139e4adad0ca7c8670d5240eb068d67e0f07f4ee8432dd48396b0abc

                          SHA512

                          272a4647eaa25705792bbe40b8fe3c9f24ed29963050e1c1eb155611f3c8ec80065a4298673150e59d250623dbba08cfb944f9fe4c8dddf012989558e652c38f

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          255KB

                          MD5

                          32c9d3a2633c7274f47b52c470cc3771

                          SHA1

                          5aa5c9f66c42da13ea4bd474aa5e7797d23495ee

                          SHA256

                          c78f731897715271bead8786282be938acddea64c969267c8f28318c58558c52

                          SHA512

                          dc555370351392ae6d65894755eee4b28f289f39ae3a6d288f6cd6a88a64fb0bd329855252a009748885b2d7cedca2ca9b92b750af6e992693149ef934d62b9f

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                          Filesize

                          91KB

                          MD5

                          07e44cc14de83c67490c15c5d59bf720

                          SHA1

                          bd39d4a4a0248b94766da8a5eb93a27a211e14dd

                          SHA256

                          59d129cf2b91182cfbef2c2570a7d9f5480c08e512bca1008aed007127b813bc

                          SHA512

                          c57f13ca7db671698213d4edd5feb64255f3d67af95678724d2359386836ddfafbad0e66c1c6617d0504fe933edf4331461f11b70900ca252d2d1bc48c442784

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5d1cc2.TMP

                          Filesize

                          91KB

                          MD5

                          3a5f5986456875edfc0b92d242b0ff32

                          SHA1

                          4652aa28d9c43a8e45c08f897c5bdcdf17320176

                          SHA256

                          cd02a0f5864541ba18c2bd26c34845a281deb31fe9c7b5786a45f4f543d0ecc8

                          SHA512

                          13e67f18da11bac55ec02c5225c54ff7158583b4f788fddd5c40b2d5148c8e7567290aba3cd9f8f1a382d8712ef89ba30f57d29cd055745feb70423d5daaa9e4