Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/06/2024, 04:51

General

  • Target

    https://e.usa-hydrogentech.com/hydrogentechnologyusalz//Preference.aspx?p1=MCQDU4MDE4MzJTMDcyMTo3NURCMzg0NzUyQUM2ODM5NDU2RDUzMThFNkMyNDU0NQ==-&p=1

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://e.usa-hydrogentech.com/hydrogentechnologyusalz//Preference.aspx?p1=MCQDU4MDE4MzJTMDcyMTo3NURCMzg0NzUyQUM2ODM5NDU2RDUzMThFNkMyNDU0NQ==-&p=1
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8c58ab58,0x7fff8c58ab68,0x7fff8c58ab78
      2⤵
        PID:184
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:2
        2⤵
          PID:4996
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:8
          2⤵
            PID:2408
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2208 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:8
            2⤵
              PID:4832
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:1
              2⤵
                PID:3224
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:1
                2⤵
                  PID:672
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4432 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:8
                  2⤵
                    PID:1772
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:8
                    2⤵
                      PID:3568
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2628 --field-trial-handle=1916,i,9970769986422486923,5398615589833932070,131072 /prefetch:2
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4936
                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                    1⤵
                      PID:5084

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      2KB

                      MD5

                      3e92d09c6c2de44e78168b84e631c492

                      SHA1

                      0504b895a79e8c4a149fbb7bdba4a14fb5dc5431

                      SHA256

                      da22bdd2041339f21e867f6e931d311ca48878614f359fb766767b321857ca64

                      SHA512

                      97999f85af890ef28ddaf23f0ed2493bf029c55c5724ab87a4667112742cf99532d76fbbac232a3d86bd602c93bb4ab0638c949c2a6b266aa0c7250b3b85a97c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      692B

                      MD5

                      2b817e264fd5705c71a51a3fe3abe161

                      SHA1

                      af75beed0491343349732c09073dce6b637fc23e

                      SHA256

                      6639a9985f851e4db97f0f83e50f10b592e26579a99893ed717d0d45aee0ba70

                      SHA512

                      254908f1822ff1efc515a796e506f95ecb6b2f4da2ac85e07a8009546675371a1e306b513c0a29fa632ecec11bdc30ce1f13b9b1a1b24163d5f5d2afd20dc18f

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      692B

                      MD5

                      d313bcfa35c76e65405c962482e69c97

                      SHA1

                      05cbadae3eeebef147e96c96f7dcaac8b5edb048

                      SHA256

                      bce9f166de64abe9ea9d574ad16d71bd19e91ee6113d3832a376e7d971e86bb2

                      SHA512

                      4dc66f77fec17ef86b8ad44d15c7d1d02327b3f1604701a9b9ae120a779bc19daceb7796ff963c0e3588b4f638f98005434e59916ba26d04948d1e49f907be12

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      7KB

                      MD5

                      096ed20d8abd131d17bcfd7b6d4b2244

                      SHA1

                      9543c400591c0e24f1b1f7545073f841fab3079e

                      SHA256

                      478770b7c9c680c86a167c2ae4c9660f2488dc84bdb470a80a44f74d4a1d727a

                      SHA512

                      95eb17233f1c3e1a254c40ee9719679d4f0d2082ce79da5ee5cb62cf348a94192fd015a0a317f6b77570f4dccdc2ac1075e5a393b58d15aaf4976bc11afdb498

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      7KB

                      MD5

                      e17c4008576dde655017cd17462c3887

                      SHA1

                      0692254a194d745a37bf2c9c6979a00fc8c765bf

                      SHA256

                      d3cc8106bbed8e677ad3dbb173afd2adf59d766e1f81b559f334e3b695525531

                      SHA512

                      ebc99340ee13d3d0cafa9686b5e16b4bfefd71f1b40526e95931ecf775c2b22787f926f86fddd560b441e4e8f2649063d75f0c6d14ef56c43c0bb72d6833921c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      138KB

                      MD5

                      2d7789e58c4cd8054f4d9a1c38cb9738

                      SHA1

                      bcd9b380478f3b7fd2e47e9613b15af7100623c2

                      SHA256

                      72f83c5561b0af413f2c9bc3542ea82af1545116b12d08d2fcfbd30f3baf4306

                      SHA512

                      3f9c536c7f08a1e2346303b49981d592e81c34f5971cc1a643891d4d38b214dc4464b65a02dad410bb912edf86298abc75fbfaa14285e8fc3617e8c0e5d885de