Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1799s
  • max time network
    1685s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/05/2024, 23:24

General

  • Target

    https://www.google.com/search?q=h&sca_esv=b30eaf4a2d3ca62b&sxsrf=ADLYWIIp08vEwG0URVEHwzYKqWQfw5VSlA%3A1716938669046&ei=rWdWZq_AAvmkkdUPiuS1kAg&udm=&ved=0ahUKEwjvyuD7vrGGAxV5UqQEHQpyDYIQ4dUDCBA&uact=5&oq=h&gs_lp=Egxnd3Mtd2l6LXNlcnAiAWgyChAjGIAEGCcYigUyBBAjGCcyChAjGIAEGCcYigUyDhAAGIAEGAEYQxiKBRgKMgoQLhiABBhDGIoFMgsQABiABBixAxiDATIREC4YgAQYsQMY0QMYgwEYxwEyDhAAGIAEGAEYQxiKBRgKMgoQABiABBhDGIoFMgoQABiABBhDGIoFSI8HULADWLADcAJ4AJABAJgBlAGgAZQBqgEDMC4xuAEDyAEA-AEBmAIDoAKlAcICDRAjGIAEGLADGCcYigXCAhEQABiABBiwAxgBGEMYigUYCsICExAAGIAEGLADGLEDGEMYgwEYigXCAg0QABiABBiwAxhDGIoFwgILEAAYgAQYsAMYsQPCAg4QABiABBiwAxixAxiDAcICDhAAGLADGOQCGNYE2AEBwgITEC4YgAQYsAMYQxjIAxiKBdgBAsICFBAuGIAEGLADGLEDGIMBGMgD2AECwgIaEC4YgAQYsAMYsQMY0QMYgwEYxwEYyAPYAQKYAwCIBgGQBhO6BgYIARABGAm6BgYIAhABGAiSBwMyLjGgB4MN&sclient=gws-wiz-serp

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/search?q=h&sca_esv=b30eaf4a2d3ca62b&sxsrf=ADLYWIIp08vEwG0URVEHwzYKqWQfw5VSlA%3A1716938669046&ei=rWdWZq_AAvmkkdUPiuS1kAg&udm=&ved=0ahUKEwjvyuD7vrGGAxV5UqQEHQpyDYIQ4dUDCBA&uact=5&oq=h&gs_lp=Egxnd3Mtd2l6LXNlcnAiAWgyChAjGIAEGCcYigUyBBAjGCcyChAjGIAEGCcYigUyDhAAGIAEGAEYQxiKBRgKMgoQLhiABBhDGIoFMgsQABiABBixAxiDATIREC4YgAQYsQMY0QMYgwEYxwEyDhAAGIAEGAEYQxiKBRgKMgoQABiABBhDGIoFMgoQABiABBhDGIoFSI8HULADWLADcAJ4AJABAJgBlAGgAZQBqgEDMC4xuAEDyAEA-AEBmAIDoAKlAcICDRAjGIAEGLADGCcYigXCAhEQABiABBiwAxgBGEMYigUYCsICExAAGIAEGLADGLEDGEMYgwEYigXCAg0QABiABBiwAxhDGIoFwgILEAAYgAQYsAMYsQPCAg4QABiABBiwAxixAxiDAcICDhAAGLADGOQCGNYE2AEBwgITEC4YgAQYsAMYQxjIAxiKBdgBAsICFBAuGIAEGLADGLEDGIMBGMgD2AECwgIaEC4YgAQYsAMYsQMY0QMYgwEYxwEYyAPYAQKYAwCIBgGQBhO6BgYIARABGAm6BgYIAhABGAiSBwMyLjGgB4MN&sclient=gws-wiz-serp
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3064
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc8f6ab58,0x7fffc8f6ab68,0x7fffc8f6ab78
      2⤵
        PID:1512
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1824,i,14554162268509316952,9136276842461912752,131072 /prefetch:2
        2⤵
          PID:3100
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1824,i,14554162268509316952,9136276842461912752,131072 /prefetch:8
          2⤵
            PID:936
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1824,i,14554162268509316952,9136276842461912752,131072 /prefetch:8
            2⤵
              PID:2912
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1824,i,14554162268509316952,9136276842461912752,131072 /prefetch:1
              2⤵
                PID:2556
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1824,i,14554162268509316952,9136276842461912752,131072 /prefetch:1
                2⤵
                  PID:4960
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4236 --field-trial-handle=1824,i,14554162268509316952,9136276842461912752,131072 /prefetch:1
                  2⤵
                    PID:4564
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3204 --field-trial-handle=1824,i,14554162268509316952,9136276842461912752,131072 /prefetch:8
                    2⤵
                      PID:4268
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 --field-trial-handle=1824,i,14554162268509316952,9136276842461912752,131072 /prefetch:8
                      2⤵
                        PID:3300
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 --field-trial-handle=1824,i,14554162268509316952,9136276842461912752,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4340
                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                      1⤵
                        PID:4028

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

                        Filesize

                        206KB

                        MD5

                        f998b8f6765b4c57936ada0bb2eb4a5a

                        SHA1

                        13fb29dc0968838653b8414a125c124023c001df

                        SHA256

                        374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef

                        SHA512

                        d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        144B

                        MD5

                        d4cbf3278b31624b042d02c1356001a0

                        SHA1

                        34a5dacab7a367800cbd83a6e3885b071f4345a6

                        SHA256

                        f48c085bc0ab77f7df22ae5b20465da9dfa38b7d814829c2893e60d2f12e188e

                        SHA512

                        a75d02719977c16a94318a7210fb81ccc3101e7e2690f87ba566fea5b6289f3a73c524860bb83108707d0c3309e71a9910fdadf1a5050a7a1ff960d651fb1772

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        9d3e76120e4c8d74dea11c3a8b2a9b88

                        SHA1

                        c6a13a17048919ec880c8282242e2334e8ebf906

                        SHA256

                        45a2a684540c371c991e75b42a54cdc38c6af3b7cbef17d80f6e600c3c93c310

                        SHA512

                        4c9dff61657f857f21803552e020dd3de95e0885b31f4bbb61ec53d4fed74ef05047ddac912b2fdd117037376607920a13538107e34b9f26eb862028df4261c7

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        1d33c7c1b7ebdc064bcac439458dee7f

                        SHA1

                        004b397055f7e8b05fff5f67cd86a14e992f4527

                        SHA256

                        8632c0f1334f322fe41a0940ccd0917bf0ee314f36d3da3b7289977049608130

                        SHA512

                        f360584cb1f2972b4a99aadbb63d9a429a568a5e3b437ed5bae9326c801dd5f187d5263bd2a463846885e4da4d4eee594e162496f6b469e348dc73ba758836fe

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        da3e3e029ec7d2eb5e0b5ea08166ae33

                        SHA1

                        e3e08d7c84fc6ffc686ee1255af71eece1f5515f

                        SHA256

                        542b15c48c39dc65871cfd5f3f6493f2f7212bfa4d3040df7b04721dee707f14

                        SHA512

                        4ec08cb7930497ae7c9964aee96b7d9996eadd899c97b36e3dc021f671e1b0243cfdfecc07a979f79a1c1ef1382671b628beb3a6b20520ba73e0ae8e65e32392

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        356B

                        MD5

                        447bde47acf037121eeb61b2af76c632

                        SHA1

                        279ba65286e48a5c4fc70966759e66d1ace94b04

                        SHA256

                        83d816645429132edebc8c34e5c8b5f3156c4b57576347420cb4242b6cb95755

                        SHA512

                        0490c463750da2aa8104a79544928bc9af9e10a7a85bbe7e63795201ee2a9343da218a7f17faf83fc8f4044829fe3fd1191c771fb1751f62150ebf1951fea1e3

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        7KB

                        MD5

                        13e0bef94502f6df69395d5340972dc5

                        SHA1

                        25940c7ca69fa6e94b2c274ab9204d47b4d9d358

                        SHA256

                        07a38193c0f1b418065e4529bb811f1bd9637c62add4bb22b95ac1bf1707885c

                        SHA512

                        faaefc473a7f92a81df98d6572019a6eb9398e4c25e4d089a385291243943043f6016a463e0a66df328bee4db8054c683b921335cdd8a450b3405c55ec17aafb

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        130KB

                        MD5

                        c6e92804137a59d8917179e227ca1e3c

                        SHA1

                        d0008537f0377866096e38951bf19c6a87b07d6b

                        SHA256

                        acfff8f147629782ca9ecb5d2e7cd5f1c67e94abf4ec7eda97516fd8d6353b41

                        SHA512

                        e4a9b61826fcffb9351eef9d1790b7b0ef169865abbc20e226b7ea8aeb0cae5b86eb701e7995104c458d4bc1efc155b12a073add66cf9b2610d47e6eddc6894a