Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/06/2024, 09:48

240606-lsvjqace9z 1

Analysis

  • max time kernel
    1799s
  • max time network
    1691s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    06/06/2024, 09:48

General

  • Target

    https://www.wemod.com/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.wemod.com/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2512
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8ace9758,0x7ffe8ace9768,0x7ffe8ace9778
      2⤵
        PID:4348
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:2
        2⤵
          PID:3208
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:8
          2⤵
            PID:4716
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2008 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:8
            2⤵
              PID:1868
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:1
              2⤵
                PID:4448
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:1
                2⤵
                  PID:672
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:8
                  2⤵
                    PID:2388
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:8
                    2⤵
                      PID:3260
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3228 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3736
                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                    1⤵
                      PID:4508

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

                      Filesize

                      535KB

                      MD5

                      5189afe2ed7972ac220c67e700d26ab7

                      SHA1

                      3a5504b829bc8f361c70aeca507fc4ced2f87e22

                      SHA256

                      3dfc1763ffbb24ad2d2ab1588c3652894a13446828b51e39e97139324c5674ad

                      SHA512

                      0e2ca4511c7c7f15b023cb06f37d20a08cca73dbaf5d5bde4be116f84196b25314cd30ad4d7e1ce676391db0a0383fc026107f6be1cd3a5df96479db32e33a8e

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      264B

                      MD5

                      44c00a7ac4a8a85469cccd5445d08ed9

                      SHA1

                      cb1aefef9f1f5227fd0d33d0cd8ede50be85ae66

                      SHA256

                      1b4a972985bb3e507e8244a01c7f20810ed1e214214c88617ad4977e6a5e8417

                      SHA512

                      59ec76fd8577ab4eee83e086d129d3f8b9d160ef2f872eb5a60524bf46dbabaaa9cf59fe5b857563d328c41b29908c9740f9a186ef1de54141a8803c4accaab4

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      2KB

                      MD5

                      2b3b88643b35b056ec87cdbc9db6f54e

                      SHA1

                      d02da7b0793ac9209d60bb4d0c6e5089f240c3ec

                      SHA256

                      9c62eb7bcff5089ce8e322c982d3dd2599c1b9f63cdc362f9c83acfcb2be3ae3

                      SHA512

                      0b9453c98dc402079465f75b18bcf37036001dd1e7d8e847bf31865f6532a942bbc43ef174aa51e9d30a03b6abe3984f41fa9f42c60f517c43e3173c40a2b9ce

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      2KB

                      MD5

                      1ebebc52d7a75f1a8b7117e11ad4f18b

                      SHA1

                      8b8c88e8bb9fab206ad74487e2c3fa69fc3c96b6

                      SHA256

                      8929da807cba1384f92fa97edda390987b2ee7b045299bab4c3281cb9d471792

                      SHA512

                      23c54ba616b0abe9ef862edfd7dc89f344495a85bafa88a567ee4cef5089efa62866a9faf84f0ad5ef330beabba2a2b6bc2cc85dea960bb9bdb7883c30f53680

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      00908322bc2cce83bd8dc3d943da5013

                      SHA1

                      098718922f39e4c137101bf4bf5e1d86299817b9

                      SHA256

                      6b9ecf4ad8a78ce77334f89c87ba5820a2eb3f5c647e238fc7965ce08cf31584

                      SHA512

                      3e88abbafeed353d18dd06941ead22be692448896c31bbef64a399f9a5435b9d1a747a0c9f3bb47d66d9813d867470441c5517ac3d4deb90c98ee42719baf048

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      5KB

                      MD5

                      aa68b9127dae9db2bf797b08f5b172af

                      SHA1

                      8edadc22d7944b5dfd698ada8e601a1ebc76d58a

                      SHA256

                      6f32eba30a3ce7350cca328e026dc52f8c8fbfac9ee88bdbc50ee85e02c1422b

                      SHA512

                      24a96743567aa695921acb01c4a00ebdb092798e6a68391a7ee33d431ffadf35b2ef0f9b917cca23a1bd0398859d3c3c361ec40b06471ab2c96d90847984bf0b

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      aee28464e967e1f5e716677b5f0270fc

                      SHA1

                      049f208e09bf92171b04d4b1533d1d8a6bd117a0

                      SHA256

                      3b6713e96e4a883e45618a3bcad43b9b3589426c8e87ca2ef94adedcc97c63f5

                      SHA512

                      2a3d84e4faccf79bf9d317f45538af91105364384688571debd7c6f37f7cd327c7aa48105aaa6eeb6b88c16c97e6318817c4a447379be0c614de9a0946a58ebc

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      5KB

                      MD5

                      63dd757de365290ed2b248c504af41f5

                      SHA1

                      677d215d0f391e1f65ddf0059292beee967b8bf1

                      SHA256

                      c938deaf56118dba7dba21afd13726c0a4b16a4027d96c008869fc2dd369c1a5

                      SHA512

                      e68674c1809c1c7d697884be312df1aac55fca342c25674369f9e4a5a319460677d8113b035afac493fe8b7f15ae201c8b5160898440fe49fb6a4435a99d95a3

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      6KB

                      MD5

                      d23bf90004ad14d2c6a6a33e108d5943

                      SHA1

                      bd9fa81159ed5a5a89b1e8ad5d43a9a178dec1a4

                      SHA256

                      54a968455f86872bd8098c719b9c054b8361b9a746d3979c3dd1f65d41bba665

                      SHA512

                      b15084c3ef998f8a68372b548643013a8c02d32d17eb28d4e5197e1d0d75a325cf9cf8015ed1138cfdf291225182440e4b00553bbc25bee4358b6f8a8abf7f6d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      136KB

                      MD5

                      6c77f2a2e687dcf548ab3760328b85db

                      SHA1

                      908bae4260d46f401e2a982b69c602c03e1e57f1

                      SHA256

                      7620e6e39f8dfcf199c7e65095e15038cc762b3c4dab4a2c2601302542f1ff79

                      SHA512

                      3457377d116a525370b95607694f0488a180749cd86072b2fa5f5dca00e8a60228418de50aa64f8c818939a48640924a166991d53f3181d3af1785f4e148a73e

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                      Filesize

                      98KB

                      MD5

                      7c2f3a1ccce88e1efba4c19db198e466

                      SHA1

                      7d1b8e6a418e4dc1d95510bcf83cfdf1deb87f82

                      SHA256

                      446973e71afb08e0f4fda8f194568e695ff2327882b2b6fd69b8eb64bb9f0fe9

                      SHA512

                      283e251ae90369e161556190aa0b54041a5e6cf32eff1740d56554f0a5e59046273c460b859eed787a5bc5b255e1fc530a9d9e53c576aec500c0038c82faa99e

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5eb719.TMP

                      Filesize

                      62KB

                      MD5

                      6a0266e67349de1d50ec1ae0057b64c5

                      SHA1

                      b63bd214f57f7b83802d8eac7c904035d5f10474

                      SHA256

                      d61d274f9d6a134d8f9f09bca07c8f97621f710018d045780b9b940e742850d2

                      SHA512

                      4dbc7e036b0c22bb0bb25b50c9612d61d9881a87e663f5b78fcdc1fc13ccabebd74635f018a734703436f4a480b2f5f875f0f775d1f262f2e4090f799721d137

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                      Filesize

                      2B

                      MD5

                      99914b932bd37a50b983c5e7c90ae93b

                      SHA1

                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                      SHA256

                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                      SHA512

                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd