Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    209s
  • max time network
    188s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 17:19

General

  • Target

    http://only-fans.me

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://only-fans.me
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1804
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8cfeab58,0x7ffd8cfeab68,0x7ffd8cfeab78
      2⤵
        PID:4636
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:2
        2⤵
          PID:4364
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1884 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:8
          2⤵
            PID:1636
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=1948 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:8
            2⤵
              PID:2340
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:1
              2⤵
                PID:1704
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2920 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:1
                2⤵
                  PID:636
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4304 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:1
                  2⤵
                    PID:436
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4452 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:8
                    2⤵
                      PID:1480
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4296 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:1
                      2⤵
                        PID:732
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:8
                        2⤵
                          PID:1032
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:8
                          2⤵
                            PID:4040
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:8
                            2⤵
                              PID:5052
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1608 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:1
                              2⤵
                                PID:4084
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5144 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:1
                                2⤵
                                  PID:4600
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4980 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:8
                                  2⤵
                                    PID:4316
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5344 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:8
                                    2⤵
                                      PID:3460
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1932,i,7095609179948015547,10451870230722654504,131072 /prefetch:2
                                      2⤵
                                      • Suspicious behavior: EnumeratesProcesses
                                      PID:212
                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                    1⤵
                                      PID:3052
                                    • C:\Windows\system32\AUDIODG.EXE
                                      C:\Windows\system32\AUDIODG.EXE 0x2f0 0x304
                                      1⤵
                                        PID:784

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\5f9fbce2-92c2-4548-bd67-e3eb9116cc2a.tmp

                                        Filesize

                                        92KB

                                        MD5

                                        fb361e334ed79bbcb57dae74fe2b0f03

                                        SHA1

                                        fb71cf03185ca84dcedfe66dbc93c3da31113cc0

                                        SHA256

                                        a8c0a3f57f9ff1f17bb6e7974006d7f6faeb313c95127004d99aaa485172f9bd

                                        SHA512

                                        a97bd418827aead6a38763face9bcc273160881b02744671a429dcf1dcacfd21039fd5fbbf62c9356c8878f81ef0290dac42949ebff7408b739596b189750592

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                        Filesize

                                        168B

                                        MD5

                                        d2b5e959e32f667027c323f7d8e56465

                                        SHA1

                                        e01b816b2af4cd3564c82e6873556d5a6d88c178

                                        SHA256

                                        5f63901b239ac6fba148031b31c681b8d4de6e3a5625c263dff1afbcba9ffff4

                                        SHA512

                                        30c59c918aec83e40143009af45ece9aa0c8220e761cfebe9c1affcf382cc2edb91a086e6c882551a401c1d29a4a62c42bd97746a6ec4a9d5292fa478b4d09b2

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        3KB

                                        MD5

                                        169efb8751ecd45a2ebacb65e02f302e

                                        SHA1

                                        42df6ee13221795f1100981e4c06e4beacadfcda

                                        SHA256

                                        dbade7b5d39146ac96a2176a63d368524ccb6ff496932eaaa9ed696bdc1cd238

                                        SHA512

                                        851e8c739cfc5e73637f863cdea911c5c54a1b6eed8a2f0030c2afb80c008292455c3fcd7a5d9d34ec15a709644728543a17ea9220d89bf6ed7a9a236a20cd5e

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                        Filesize

                                        3KB

                                        MD5

                                        c637383d858088286d5b3c07fd631312

                                        SHA1

                                        92d8f4d4b3e676bf1f793093a9cd89256e283242

                                        SHA256

                                        b05ad176e8066c757441719244ecd438e3cc3f2315806ca7d575b1216c6be022

                                        SHA512

                                        6da8f4799944358845c6d9a5695e0afca5b5c67b0f51e51a0b0f9edbf166eccb51b1813eb87bf8736827d036e63009cb6059ac9655b041fdc8cd8f73e3f5081a

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                        Filesize

                                        2B

                                        MD5

                                        d751713988987e9331980363e24189ce

                                        SHA1

                                        97d170e1550eee4afc0af065b78cda302a97674c

                                        SHA256

                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                        SHA512

                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        691B

                                        MD5

                                        a0a1ea2ddee34ad1fb476f4457cfb2a4

                                        SHA1

                                        b4b6b0defaa162a1347c1bde3e6675ab45d2e2c9

                                        SHA256

                                        ff2be112c351de59673a19efa090fdaf560bbcc443d1de651df0c14b44f84428

                                        SHA512

                                        f50983619578e31c89753886b76843a7829f95c1cb761dabe6f95fe394561072e39beaa35d15f79d29284b323c08737ba9efc683c40c2490b95393995a50c2f4

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                        Filesize

                                        691B

                                        MD5

                                        ab8d7499f8fb5267224893edb5a348a7

                                        SHA1

                                        5310db867bb42c0f8d430c01e879b7628d037c31

                                        SHA256

                                        481d3e9de3411b995ad97ca1c1469ee7c3a1d1f9f846c4ebf491db4b667bc0a7

                                        SHA512

                                        a2af977092856785bf4ab1a8a737aace43af84b48d3e55dcb33e10a262c2f4d15d930774724b039665ea0b9455dc28d654f8fb175f81058fb1541181cdea6f65

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        87448f46056b9ab6516b43bf95235bde

                                        SHA1

                                        719451fbbc8a0ba46d00478b4f872f299e5c76cc

                                        SHA256

                                        174228a846f21d5480ebed09b0839e48b8988fff15e2aa0e68f862ce956ac316

                                        SHA512

                                        6519123f6424316e91b73b5f1a4df55a540d350271b60c5a30211f2223ffea5c87293b8d9b8779be75755416bf39805685574a5d51efada13380c01debeda9a1

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        e2d9166f75e7a9a411f66d60383a6e10

                                        SHA1

                                        c5355c9c35dc607be30bba76e15fe2fcb02bfd5e

                                        SHA256

                                        75ed858ce8e56c2ccc6da09abfc4b5405731dc3ffad9997370c2b46cb5511c4a

                                        SHA512

                                        ff0807613e9d3c306970aed872c8a4857a4e51623a3fd56d0ca87d73c810c2c270e655a40757c3a03346febb8f050a321b6b45f312a1868650edaf9663d0aebf

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        0041f8940e93b453411b3e1dd058bc7d

                                        SHA1

                                        3f23d54487dc816062a952a355620adf5adaba16

                                        SHA256

                                        68e76178d04d5086d15e4fb4af6cbceab3a06ab7fc85a46fc970a8815bd1dfda

                                        SHA512

                                        3e0b1e65518dd69b5509da99154c19cb11a104bbc29e704c7259e37ea29f4c9d0ff3bd0a4fa699c02cc174221edb9a97bbc60510cf45686c31e2c35c600a1478

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        130KB

                                        MD5

                                        aba6b863f16b0871185d745815a36f72

                                        SHA1

                                        42922c6e80a8aec66056453530d2dfd52f82ae2d

                                        SHA256

                                        d46272967a0d573cc1394fc631492cdfb046fb8580ea8b9277e25d9f49bf546b

                                        SHA512

                                        a067abba64c883c63d16549c2a29044ee546977366ca853bd7f87dbaf2c49ef44f8b90c8709bc97d52106be0c5b94d0c6ce9417ddfb6bb7c4273661ad65c6fc9

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        130KB

                                        MD5

                                        263c0a315126a08cb88a463d624521c6

                                        SHA1

                                        9b58b9f3e2f29bd500dd00e188d2b6fbae0ae678

                                        SHA256

                                        9ffffcb2190b9a6ac322077d2c9e9c532e05dab653ff83ae167f82be4fd826a4

                                        SHA512

                                        ba9e09ad8fe4595ac5500888d10979e879ba5da3edbbc2fda5e2b0a740bf5e81af5e89dc8ca42b2bb3f42f23f74d4bd4e73aa774cc60560595e43513aaf97f49

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe580422.TMP

                                        Filesize

                                        91KB

                                        MD5

                                        d3bf610a40adf9a34ab7336ee86cc6a9

                                        SHA1

                                        aa50dd5963253303f3d152ff244f74274b85b4ef

                                        SHA256

                                        041b9aba5730d2909b3c86c1cd634f386ad5e2bbf30ee3b7d932e712a58e2514

                                        SHA512

                                        160441ae11f6afefa84973c13bff8e7520a815f13ec85ff3a58a07bca3bd0f531f6279bcc10d47ba9c2a28396e732cff906b09af5487daa4b9de6a26b0578516

                                      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                        Filesize

                                        2B

                                        MD5

                                        f3b25701fe362ec84616a93a45ce9998

                                        SHA1

                                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                        SHA256

                                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                        SHA512

                                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84