Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/06/2024, 15:18

General

  • Target

    http://www3.fpn-process.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www3.fpn-process.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2348
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccc05ab58,0x7ffccc05ab68,0x7ffccc05ab78
      2⤵
        PID:3968
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:2
        2⤵
          PID:3224
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:8
          2⤵
            PID:2624
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:8
            2⤵
              PID:4768
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:1
              2⤵
                PID:2884
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:1
                2⤵
                  PID:2256
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3584 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:1
                  2⤵
                    PID:3956
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3416 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:8
                    2⤵
                      PID:5080
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:8
                      2⤵
                        PID:2196
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1872,i,14678770059246152385,18259870055526857261,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:5808
                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                      1⤵
                        PID:2376
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4340,i,17096020621006928097,15544233752327415349,262144 --variations-seed-version --mojo-platform-channel-handle=3820 /prefetch:8
                        1⤵
                          PID:5192

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          216B

                          MD5

                          38632c5ed16f03b96f2bf09a6a5c2cac

                          SHA1

                          6ce73e5ef88d5aa00a1c4c42ce0c1b9753004467

                          SHA256

                          81858c679e9f204d513ca1f25a0c0a5c153ae5a09082df578cbc9901a832941f

                          SHA512

                          192681af3f6f742276632fbec7b358ae25b78690d2f00101362fce446511bdc8955161ef1829ac10d99456303039cbae6d267abdf73d45963d09ce401c9dc9e1

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          3KB

                          MD5

                          31d552de82fa881d4f645a8b932fd3f6

                          SHA1

                          cc96da3f33c9424ae2937ec83b9e190f5299cff6

                          SHA256

                          d71ca2bed98d9b767c42b9176375329e3298b01c55181b529793441ddfd26de7

                          SHA512

                          cf4e5a664c6f1052fa70881fe736569578a5e78900a98360ca2e9e9fc63e7bf79c46f4463220727d972c4d4e3b9e51b2749abc530b3468928727a4daebe2ff7c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          524B

                          MD5

                          68ab81bc4280e671815c0e4ab3c36a7e

                          SHA1

                          5d53208f8edb45a512701dbf4b823d9869288d7a

                          SHA256

                          a938ae8a2c9a3cead87d01bea2ee6624cdc13397d736e5500f1126a0fabb567d

                          SHA512

                          1b4b8cc2892536d6091b1f9f4bd5d771020e55c947525e0bed13d80173b05bedf31d4ad0a67001973a0a4721ea0a0815c903a81013cb91b449ce375da6d4c3ab

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          7KB

                          MD5

                          a667c2edbf7854ca47a0ccb4b09b3e5a

                          SHA1

                          6835d2668e4cf4f4b5011334ccf13ab8cd68f8bb

                          SHA256

                          10b174d5bbfb102e501a011cd3cebd12ed07d8b10bd3f660fe6714ea153e0ba6

                          SHA512

                          9266ab63622a6b7e8f2a672e2d7933ac1a1edac37f37be26753a4d81df39672217ffbe984eaccb31e4ba3469bd3e98944ee8b6e56374d38ae93c8e12d456fc69

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          7KB

                          MD5

                          4bc7f55208e2a605fe05cb2f1a5e9919

                          SHA1

                          da041a7dfc4772320e84833563e11a8bf5454a11

                          SHA256

                          38cf4685c6e0cedd738ef8184f36478eafcd8133d7dfecf09cc78c41b413793c

                          SHA512

                          95480fce75fca1d9d4abb7bd739d14aa5c154d3097d0534adf85350c970362fbed0b61214df0009977b3060ffefa46e82873f93cb4a608000f1561cee33081d0

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          255KB

                          MD5

                          f7f17d5e4c86f7e2f07f47dcc052a850

                          SHA1

                          148b26ca8ea9f5a9386dd062bf7c33711608e89b

                          SHA256

                          b87876dadced675db7b3c6042ab7a06aa1c321c5c0a5fa0583fd36b13c6bbdb7

                          SHA512

                          7a97d18b882a7bf42b885abcc2f8ee787dea0383b3de66200a2c56eaf030ee2b3b07e80a2f3fcf9d0e1ff7436f9fcf62b4a59302523fb5039a490f8a7e4f2c1d