Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/06/2024, 14:26

240606-rr1x1agc93 7

06/06/2024, 14:23

240606-rqb79agc63 7

06/06/2024, 14:19

240606-rm83tafc5s 7

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/06/2024, 14:19

General

  • Target

    SparkCrack.exe

  • Size

    1.2MB

  • MD5

    729ef11bb843517bef3f097e4d5efea2

  • SHA1

    f691eb21e61535662ed588957ad798fa3f21098c

  • SHA256

    821ad7168deab1b2ff27f81298a9c3029ffe138a9d9ff2e4d66be4dfe369f5c7

  • SHA512

    f26ad252ac200031e151a31c11851fd306e435ac445070a622a3b860106a59c637764c11fafa37a23cb1da5444e2467940bb60723f9df0dc571f1aef3e6c0e17

  • SSDEEP

    12288:JQ2ujPpZeET9mJwTI6v3c/GNg0KwBtzvwVyDQ8C05Ka+33UMAxpBO+3SgCeWG8EP:JnujDeExbv3c/YjF5CwJO6SgCidKK1

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SparkCrack.exe
    "C:\Users\Admin\AppData\Local\Temp\SparkCrack.exe"
    1⤵
      PID:5016
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=2628 --field-trial-handle=3192,i,2785050981002401924,4037047756083432660,262144 --variations-seed-version /prefetch:8
      1⤵
        PID:3232
      • C:\Windows\System32\rundll32.exe
        C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
        1⤵
          PID:2864
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe"
          1⤵
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:3724
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffed6c59758,0x7ffed6c59768,0x7ffed6c59778
            2⤵
              PID:3560
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:2
              2⤵
                PID:4816
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:8
                2⤵
                  PID:228
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2280 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:8
                  2⤵
                    PID:4068
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3260 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:1
                    2⤵
                      PID:1252
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3284 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:1
                      2⤵
                        PID:436
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4656 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:8
                        2⤵
                          PID:4432
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4064 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:1
                          2⤵
                            PID:3668
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4644 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:8
                            2⤵
                              PID:2484
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5028 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:8
                              2⤵
                                PID:4568
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5216 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:8
                                2⤵
                                  PID:1708
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:8
                                  2⤵
                                    PID:4952
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 --field-trial-handle=1856,i,8862463901790425495,12789591001224285425,131072 /prefetch:8
                                    2⤵
                                      PID:4020
                                  • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                    1⤵
                                      PID:988

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\9e5b5074-3aa6-4646-be5d-827d76984312.tmp

                                      Filesize

                                      5KB

                                      MD5

                                      9a2442ac6f028104d276087fed97cda2

                                      SHA1

                                      58f3b3605c2e81c70602edba76270ca027bd20c2

                                      SHA256

                                      feed698fb21c56590fb50ac0cb8e8d831030cf289870670facd012324b142d80

                                      SHA512

                                      749f2d269c9932ce247ccfb3165608eb6fdda8900a5ad824e5188e61a2aec0d01eed01b5d2e8461291f4b7c0fad45b2173c96d2c0a1f3180255ff4d813d2b880

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      e65cd2173384173c4cf8fee1c304a121

                                      SHA1

                                      bc81d468127aeb6083efd2d4b3b0a4ace7a2119d

                                      SHA256

                                      aba4e61b238338b1067ac43f51bb2bdb42f89ea3ecbe02b10053230bc9708b9c

                                      SHA512

                                      45326c2537c3fc4cdf80a8d480c93817414e44511a2470fb2460c525bc81cdc5090bdc6eebe77413086543f146120be072a5abf1f2cb7e403dedce556c07db77

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      369B

                                      MD5

                                      4dcc6aef969b248e5c93a61e5c5d5cee

                                      SHA1

                                      c92665bd97dbcfbc4332e81c2ab127175deab2c0

                                      SHA256

                                      8faeaa5aa0b4d27241212e18e383000a3a2a6a00df926143a2a199026f45464b

                                      SHA512

                                      c2c8e5cb38bde10134f80d9610c4be8eb5a39ea46c90b46d309f6837ae2ab2cb68bf3abb718ae6ee9dde37ee7a9adf3074ad463d22cafb360387f83664a05c9b

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      700d123c5974d86ecfe6f4c4e9fa4498

                                      SHA1

                                      34669e30842d652ed79a4d73101e0e8ce95a9406

                                      SHA256

                                      3482f04845e5a7174538791fb66495abd90719a4ecee445eac2aff5199c4d8b0

                                      SHA512

                                      10bb053bfc735f0fdd3e5adbf478e787cdb43b7320b56eb249731bdea8963c4b85166881f5ae4c229c29c2b64a7058b9eb48ecd6d29b622048117d11a6217972

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      e061c3b7700c403712f7e469b65262ca

                                      SHA1

                                      9c00d24d5fa00820127f39acdc438219855a2fe8

                                      SHA256

                                      74fbeaa3d584fdfb97afbbfc4810251cb58a1bcd140a4e73cbe27cd238095df4

                                      SHA512

                                      0de80889da1b7120484e49ff1d4f9a54792459e59b3cdb579d12b162516970c60dd65071008f9e8c72dda6a5fea1bd8a0a0ed4ee2f8c123e20fff7c813e55875

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      271KB

                                      MD5

                                      b3ba5d9a7708a540d8e0f79dceb8354f

                                      SHA1

                                      02b4675b91124f3ac6207bd320e9f6c7a01e9a52

                                      SHA256

                                      b34287e420cae1e96edae49dba7974a6e47da38349b879ceaad96d25a70919a2

                                      SHA512

                                      9bc1e78058ddab73e3e1a3143c870da8b22e22e805bbc2e1c14068f6fdbee0f0fdc0ec9103ff769990f70967c51c3a6d2fd05dc86d829915a8b8bec27f00ec1a

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                      Filesize

                                      2B

                                      MD5

                                      99914b932bd37a50b983c5e7c90ae93b

                                      SHA1

                                      bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                      SHA256

                                      44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                      SHA512

                                      27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd