Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    186s
  • max time network
    187s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/06/2024, 16:41

General

  • Target

    https://github.com/rahulunair/stable_diffusion_arc

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 17 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/rahulunair/stable_diffusion_arc
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea936ab58,0x7ffea936ab68,0x7ffea936ab78
      2⤵
        PID:2908
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1972,i,17617755260725590010,1179304113997408480,131072 /prefetch:2
        2⤵
          PID:1732
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1944 --field-trial-handle=1972,i,17617755260725590010,1179304113997408480,131072 /prefetch:8
          2⤵
            PID:452
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1972,i,17617755260725590010,1179304113997408480,131072 /prefetch:8
            2⤵
              PID:4552
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1972,i,17617755260725590010,1179304113997408480,131072 /prefetch:1
              2⤵
                PID:4440
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1972,i,17617755260725590010,1179304113997408480,131072 /prefetch:1
                2⤵
                  PID:5008
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4684 --field-trial-handle=1972,i,17617755260725590010,1179304113997408480,131072 /prefetch:8
                  2⤵
                    PID:2728
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1972,i,17617755260725590010,1179304113997408480,131072 /prefetch:8
                    2⤵
                      PID:5116
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4476 --field-trial-handle=1972,i,17617755260725590010,1179304113997408480,131072 /prefetch:8
                      2⤵
                        PID:2332
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2004 --field-trial-handle=1972,i,17617755260725590010,1179304113997408480,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:3020
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1624 --field-trial-handle=1972,i,17617755260725590010,1179304113997408480,131072 /prefetch:8
                        2⤵
                          PID:1488
                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                        1⤵
                          PID:2548
                        • C:\Windows\System32\rundll32.exe
                          C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                          1⤵
                            PID:4508
                          • C:\Windows\system32\OpenWith.exe
                            C:\Windows\system32\OpenWith.exe -Embedding
                            1⤵
                            • Modifies registry class
                            • Suspicious behavior: GetForegroundWindowSpam
                            • Suspicious use of SetWindowsHookEx
                            PID:3056
                            • C:\Windows\system32\NOTEPAD.EXE
                              "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Temp1_stable_diffusion_arc-main.zip\stable_diffusion_arc-main\text_to_image\Readme.md
                              2⤵
                                PID:4140

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              1KB

                              MD5

                              393acd487e20fb03c41585944440db75

                              SHA1

                              4734b5fc60ca468b1bb2feaf90e4255f47b58cd2

                              SHA256

                              4a08a35dc5a4dc1cf022c65733515bea0a23e78fb96f011f8ad2445f2cd5f166

                              SHA512

                              d78d6ac0d1a00d2108ee6498ac443ff185efb6dae5cfcba41b8a58f7991f3f693e3a0d8ba5aa800633479aa6d376ecbdc4bb45eef3d93963f5724463be7fbf65

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              eaa4ed7cb566f0c7fcc511d620cea4e4

                              SHA1

                              19fc8482273e184379ffc3b1652dd8db45e04c91

                              SHA256

                              ee72c76ca73165a7dc38f203ae54ebfb2ae673213246e090f8f3960ddf8ce25b

                              SHA512

                              82b578cfc1147ce3c82c6752f8a06bdab6cee311fd8e3b1ac23de9b2bdfe04b62074c83378bde8f627b84fbeb81d249a4f89ecbe37c63fb10d1a708696cc5ac1

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              16e1e10123ab878055fe68ce846cfb8a

                              SHA1

                              518e13341baaa6cc0da96a173edfab4061d1e75b

                              SHA256

                              40f8a94fc9c28a03eedca29b8a725f5569ba09fb19270eb2d989968f15b88faa

                              SHA512

                              23e2906a345b559dd13c8b282c2a3bdcbe776d11acb29f6c3e0b397c025651846682891cdaa47064b344f949a15b65505d99be2edb5314ddf296e165dd16723e

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              81a24e537db9935e047bb6d7949e0a7c

                              SHA1

                              2593aca4d34696633cff57af102b7d00560efb1b

                              SHA256

                              05d718eef785832b14cbcaaeadfa249798bf58ca0f7a5a8e33b0d761ff3d7c09

                              SHA512

                              dc19e86d7b29b98351bda507e3b272fd2afe25874e045781f517e7f6182fe2c0deb5e65e8d26f917d6ba4878af3fcd72fb8bcd7bab2c055148809b9d394a6c45

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              ade96d4906df0ccb1ca8a60c7de8d2b6

                              SHA1

                              349b69332679e9db1dc7bb24c4bdce5197b1a5d8

                              SHA256

                              25631f4a65f6cd8ba12dde64417757a995ebf311437acc7c33666e99052682b8

                              SHA512

                              8efd829c8550e6247344bb0cad2cf79065221b309f26cf88ca93d5e48a5086c59455f684368589a41b0d1ecff78ce36b609ce08abdbb5c1f483154f0c4b45af6

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              f043a95642d1d8a9f08ba0411e4e7902

                              SHA1

                              2f482b5b6f0d897420da0339e3f2dfe9dda500e3

                              SHA256

                              259c98afb830181a1b74839935d6d3ceca2de74f3efec39622f30b47d6e9e1e7

                              SHA512

                              77963f723b1ce4ff1cdb00d085ac419e16460b95369b33b4193d595d368b4b7792b04945a74a3cedd4abe797ebba902ff9572011058bcec89dfc97e5ba107e82

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              7KB

                              MD5

                              013aa0db504918d17f6018d904a71965

                              SHA1

                              87604bb4e072c172fdacfcbcd2462c7e9fe06559

                              SHA256

                              cc58bb0c17faccddfeef6528d9cca0f73bfe5b1e57265dc85fbc42abebc053c7

                              SHA512

                              fa4d75df451f8eb0b23b6ab66f6349952249e0b9f71e5372c9651b03a34af7b06ef84da80ade42845976691c62450e284f2f9b59cbf233dea9db29e291ee0d0a

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              130KB

                              MD5

                              d5869cf8962b93c8a5f80840d916b69b

                              SHA1

                              272fb0d440daaf8fcfd6ce91529a54de32007a21

                              SHA256

                              77c305b51582a45dd58568eccab6135aa35d3d2cb3dcb14177e10663cb7a26db

                              SHA512

                              061fb06ebed7dd67c95feacd7177ceef0d34acc4c1072a99b2e78eb04369d01a6fa08fe3205f3f4cff98124b7a6bf42b77aaf0788b2d7e63e05c910b68b39bb0

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                              Filesize

                              97KB

                              MD5

                              25cdedd48b421600dccb68c9be65c643

                              SHA1

                              dd09430cfbb7689a6a7c09405c9a863855860f25

                              SHA256

                              f9c658fa5b9b2f8ffaa313f9ea2f73b75797966d1a50f8815a497d4a06c1704c

                              SHA512

                              b0513dee3f00807379d6a807f80304b2c2ac06678bb32ed6f79150d34b93d69e13be55a9736ceeffc576405e9d70972dda661e04dcfdf44d4095bf9e24d69703

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe59716d.TMP

                              Filesize

                              94KB

                              MD5

                              e2a5011d2eccbcd213a0e9ff8d9641fe

                              SHA1

                              c1375b913bd479046ec14b71d973d4a86c8d8155

                              SHA256

                              1b6855f6669b3de332da9afcb4fe14fbdc40f5855e353f8d3cf526f8a47cf864

                              SHA512

                              b0b644e6713d1dcab1f1805e313e06a2bd6064f359f6afb33ca55070a5e126256a5277b39ad303bf6ccdd8da27b9e63603218e53b65ee67079a496012c53260d