Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

31/05/2024, 20:23

240531-y6d54sca3z 6

31/05/2024, 18:10

240531-wsfexagb5x 1

31/05/2024, 17:57

240531-wjlwbsfg8v 6

Analysis

  • max time kernel
    660s
  • max time network
    647s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/05/2024, 17:57

General

  • Target

    https://WTmrVfzBEi.esmeriocontabilidade.com.br/Golf/future.com/5MTE0XyUvddHaCu5rQ21ZpgdMMqDVaFyCyeBzYy3YKiKgHKLLWq8pXY9KiAVYP2BTqwZ9gFjZfUghzQcC9kyB1gfJmu2ebUNmRjGCzJ4RwcxVJWJH9pv78uuEjWKhL0iAz9Mdy7JQaLNFi8EE9y6Na3FjPUp0f1WwxQrJSD9xGypM2nuJy2GKkVGCcLwESgp7y7in7tvLSFZgMKGpr3cN35mAJQhiWpNZngRx-YmFua3J1cHRjeS5hbXN0ZXJkYW1AZGVudG9ucy5jb20=

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://WTmrVfzBEi.esmeriocontabilidade.com.br/Golf/future.com/5MTE0XyUvddHaCu5rQ21ZpgdMMqDVaFyCyeBzYy3YKiKgHKLLWq8pXY9KiAVYP2BTqwZ9gFjZfUghzQcC9kyB1gfJmu2ebUNmRjGCzJ4RwcxVJWJH9pv78uuEjWKhL0iAz9Mdy7JQaLNFi8EE9y6Na3FjPUp0f1WwxQrJSD9xGypM2nuJy2GKkVGCcLwESgp7y7in7tvLSFZgMKGpr3cN35mAJQhiWpNZngRx-YmFua3J1cHRjeS5hbXN0ZXJkYW1AZGVudG9ucy5jb20=
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3136
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaef7eab58,0x7ffaef7eab68,0x7ffaef7eab78
      2⤵
        PID:1792
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1772,i,9855524321587528926,12197852924667785173,131072 /prefetch:2
        2⤵
          PID:1652
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1772,i,9855524321587528926,12197852924667785173,131072 /prefetch:8
          2⤵
            PID:3144
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1772,i,9855524321587528926,12197852924667785173,131072 /prefetch:8
            2⤵
              PID:1528
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1772,i,9855524321587528926,12197852924667785173,131072 /prefetch:1
              2⤵
                PID:1952
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1772,i,9855524321587528926,12197852924667785173,131072 /prefetch:1
                2⤵
                  PID:1232
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4448 --field-trial-handle=1772,i,9855524321587528926,12197852924667785173,131072 /prefetch:8
                  2⤵
                    PID:3828
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1772,i,9855524321587528926,12197852924667785173,131072 /prefetch:8
                    2⤵
                      PID:4976
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 --field-trial-handle=1772,i,9855524321587528926,12197852924667785173,131072 /prefetch:8
                      2⤵
                        PID:3316
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4072 --field-trial-handle=1772,i,9855524321587528926,12197852924667785173,131072 /prefetch:8
                        2⤵
                          PID:1488
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1772,i,9855524321587528926,12197852924667785173,131072 /prefetch:8
                          2⤵
                            PID:3672
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2376 --field-trial-handle=1772,i,9855524321587528926,12197852924667785173,131072 /prefetch:1
                            2⤵
                              PID:2320
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3216 --field-trial-handle=1772,i,9855524321587528926,12197852924667785173,131072 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1108
                          • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                            1⤵
                              PID:904

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\3de13fd4-71b8-4a18-af2f-fcb098ddeccb.tmp

                              Filesize

                              7KB

                              MD5

                              03684d45b04ca6f3be1bae935ce160c1

                              SHA1

                              7765592f6c9d80c759357acabc4edfa24dff5616

                              SHA256

                              ba7ba5a439b5818b96d6a9288b8d2062d2b341ac10b5a8f16d7de1b1882e94e1

                              SHA512

                              c72459051ffe6be7b2c7ac722f9b4d38ca228ec1899fa198a84d3f8d2b4b78f526e26295e74cd1ff51e0f5402235b8d5a48892ebb30b3c681948a269bee3c49e

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              144B

                              MD5

                              1b53b345154c7d0357840de79360c0a7

                              SHA1

                              1099ece639310d8f43e298a11e89c291610c7bbb

                              SHA256

                              e015e097a0bcbf33a36b1be91ae72197a7a6192d51778c65778b3f557bcebfa4

                              SHA512

                              f9cf44b4de67086eedeb20e679cbe839fa1e42391dcc4eeebabd50ddcb908b66d4d8acb911e78b9564055f6396b1c6d8e432a4d1b325ac03efa74f9d9bf16716

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              96B

                              MD5

                              6857c15223b2b823b759dd31c3fae5cd

                              SHA1

                              ef0ef070d1dc6f8314d857aa30abe809c878749f

                              SHA256

                              f93868315a39c6d967247e0934d9e951d846411f037c93ea5d9907bcde37c6e1

                              SHA512

                              3de23c353eafae553c6d93b9d7cd29ae9f7b94727e7eddbf791ee6c4d2d6b5d4761940a3c8818890d7beca9e789e0a08409ffb27f4ef8271bb4434dda40de9be

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\3fcae3d0-9af3-4936-a18c-b95341d7819c.tmp

                              Filesize

                              2KB

                              MD5

                              a1acacacef1decc182178b770299c659

                              SHA1

                              0295dc0b3f01f3a3eb7d21ec029801434e2bac0e

                              SHA256

                              43c1cfec7ccb05960863f3c37cf45dfb141bbf2bc90fdf8477d148f0671c56bf

                              SHA512

                              f52e9608f5531635b8e73c10900d0e8a79ebc115de6a53b519fbdc21865c03bc0c17045f57ca7bcaddfb9868a1763cf770080b7370f5933dc23cf2a66b739a51

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              08f522c00f675688ee74d31c58c249f4

                              SHA1

                              674a57e2924101ad51fdf8f93d0317e34d011212

                              SHA256

                              0cf3b4df57335d7af67404216a15823aa07cd169db393023fbfdf47a673be0f9

                              SHA512

                              543d32b28ffe9f168dba0909785e55c8374692fea89b5dad0778984665626244b66c6331131a5748ed08a1f78210c6ee33128dec7d4a6ff799d10e698813c1ba

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              f0c97a79a07ce90c262340ffce6bd0de

                              SHA1

                              7d41328081bef1cf30cfcfbe843727a78af05e19

                              SHA256

                              d8d3b265126cdfd2ded8304988e1aee7d7eb06a2e0b11d206947dececb475c18

                              SHA512

                              57c61ed5b05d92bd26939719c81b5ea2bc46f1e8555d58ea6a460e54b24ebb41bd673edc93634a0035e2601112fdc1e7fd7d2c3441560f713c5bfa1980bfa883

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              39e9869f8fe0f6189a1f092e44b33947

                              SHA1

                              3bfc2c63002ed17fa97d431d8597104d371f4647

                              SHA256

                              de8a066d132b073f14257cba298583a381de18418b896bbfc2396dcafe52a24e

                              SHA512

                              e20a4c3d510b180ea2c6c7f3eafd32784d118c0ff94032902e4f1fed56715d2721beeecacd55236da9cb8894151c757793f8e135ffe0ebd5dc0e3787d1e47dfd

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              498d197448678272514c99e39a382c1d

                              SHA1

                              032640420a0194c3f2a586a47341f0e8c9619c4e

                              SHA256

                              29c4ff3a0ac0828d8142d505bb0222ec5e68ef72c7dcb92922ce8a6375d97339

                              SHA512

                              c5698572fe12bf3324c9596ddf8e422974936929cd45843066c9a53548d19d41d4f7f2e988264a10978d3dfbd40c9df7994298b9506e9ed8232dee4a5b991692

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              859B

                              MD5

                              082c905b1985d2f83a0ab26586974182

                              SHA1

                              b39a70728ad03cc136df2575b3f64546e4929338

                              SHA256

                              4fc0a44cc998b2b0b63fdf57bba94d8a6592e632ada9c55958d7e1f07d069c2d

                              SHA512

                              a3bf12d2e48a84bf805e0efce9bacaeafb616ada8d189e3ebdb7c37b0335be2623e995267102ba16b58dec3bb6475a102d9e1e79aea14c00045ccd7dd6a95549

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              859B

                              MD5

                              cc95b8b67452154eb5507ead0384f689

                              SHA1

                              30bc754d8665de7470d83dadda47cb06facdacd7

                              SHA256

                              e3f0ec60ec1aff06f07c03b0c776786181a4890f05c208e6af779662210555e9

                              SHA512

                              995916b84fe9a61d45510f684a3c41b289baa8f255e1aa8d8dd8a95dd5f01429b1cfed2ef22b8ed8c04d588aa623b9f09d2a151f791fa74061d42d4629147110

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              51bb9a1e58536b7116ff89c30cba741e

                              SHA1

                              f93216ddded331120750ef0b71f93ff52adf0ef5

                              SHA256

                              06d6491555b82a5eda376b17ab539d5399caf16a793da3ffb5f66e8ca939e71c

                              SHA512

                              1e88a23071b07dc95f17c7d172b2b260a69be89db2cb03bfe0adcd08a6ed5120e9d1209f067ecd91247382f6673da624e19ad277e78c523414a0b9618a3c831c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              131KB

                              MD5

                              8e0512f519bf34bc9558c33ed28f9371

                              SHA1

                              c41491870a514c7bd50b0231a5ba9970a9a2b957

                              SHA256

                              6b15d9c8d32846a18f6b76f2ecf64728ac1995293f236358b12b0780fa3cda50

                              SHA512

                              baacd4f4c7a2bfd64d28595b9ecae2b6ac75ae47d2e120f95a892b2e34fd0ad019d46990a9864303eb8b7f0686865af6ecbb63afadd498018a3cfd7ac2522295

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              131KB

                              MD5

                              704333597cdfc9d406949457e6a299ea

                              SHA1

                              33632304654461e78b2d45f0858c32612a1bd5ad

                              SHA256

                              9560d1186947c32bc11e3d2868b4ea56acc1aff28fce044757f178e1ebc896a9

                              SHA512

                              67c1175b41eecc54ec734d90b1874d8d3421c4ae30f519165d60cf5582ba2be661de97b14cb28b9e718f9f5cea0121808bb8ffa3c169c3d94e362467a1e1b3cc

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              132KB

                              MD5

                              45b57f82b8bf97b048eb18d8be7392f7

                              SHA1

                              02260cb917268522234f83786d138a86742ad02d

                              SHA256

                              34cc30e0516e0e76f2d14b8d0591126ea44be118007a8a7cd99ca59fa24b3ceb

                              SHA512

                              b84d3c31fc8d1430132a2e4cb0c4927ea028e90d5957200f21f9ba3c0cd72ace227a68d3e161c9580ff88dc872f266855c05f29300e9c2acd6a44b63f5bba74b

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              157KB

                              MD5

                              c988a181c657a0d1dce5aebf68b3f116

                              SHA1

                              9cc910451264780ec8ad027ad1699c763af139eb

                              SHA256

                              cb4981f8a2efe612223bff41237168a7efd4074c48243c3dc37c2fd6fc3654c2

                              SHA512

                              533fa3c34e9a4aa71b8a79dba050cbc5fb0a452dfd4c727790f69a5241e91b1de42bda39d3d10f5194534d5307f48a07604d3ae53a0b9b59e0b5ae9cdef0d1a1

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                              Filesize

                              91KB

                              MD5

                              583bb6de7f7095ed7c6dc696b06b6925

                              SHA1

                              ff08faf592f152e271de4ea5f6c510d8fefeacdb

                              SHA256

                              477ffa4550bb189546149ecbc0de78d0cf17ec8991fa69f1fd7fa89160044127

                              SHA512

                              241f18eeb5b3275d5f2402de4159c8485fb3ab669252d51f88e55bc87df1ceca475e66b99426b6f641d63273381fbecf199e5cbeb34f97228c5488da324d65cf

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe581652.TMP

                              Filesize

                              88KB

                              MD5

                              b87ccd4886dee776b750d155027d61ce

                              SHA1

                              a210cdf79496bab99138858d5309700e356d32ae

                              SHA256

                              5067bb2319ed6a6d84afad604c0fa41acf7401c78476f1b9de585e4d2964a8ea

                              SHA512

                              b23a9285f4e07393132b0ef71e93e36999f9924de77f0f2033e7c43b992eb18bd690e57846cfe5f1358e215419186d08a418d50ef3e70aaca44b8775addd61e7