Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    47s
  • max time network
    48s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20/06/2024, 11:49

Errors

Reason
Machine shutdown

General

  • Target

    twitch_pfp.jpg

  • Size

    15KB

  • MD5

    b7f28efe746714ef69018ac2ad38c014

  • SHA1

    d11a39a32ce3de71c14adda8d99a47c7fd708dea

  • SHA256

    8e1d4b97942d0b374e62c273aaba9fd17151a11f3d11397ed3104613e7fe0466

  • SHA512

    49b22891aa249e9c321fd3487bf2e2b5c809bfce861a1661c16cf5cafd431ffb29317ee4dd9335bc4b82a0bd7672cc90667be4ed1d82af8d53f439784b3eb830

  • SSDEEP

    192:fIy0Kk7gFN9NbmaTDQNrVPXBb7xMJwYFOCgUn7QuivsD26KqgwEvyPQj:gLKkEFNfbmaTgrVJJ/YbI8K3fj

Score
3/10

Malware Config

Signatures

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 17 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 62 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\twitch_pfp.jpg
    1⤵
      PID:2908
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3552
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffa4c52ab58,0x7ffa4c52ab68,0x7ffa4c52ab78
        2⤵
          PID:3952
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:2
          2⤵
            PID:2976
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:8
            2⤵
              PID:3008
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2224 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:8
              2⤵
                PID:1592
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:1
                2⤵
                  PID:404
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3104 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:1
                  2⤵
                    PID:1120
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4292 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:1
                    2⤵
                      PID:3180
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:8
                      2⤵
                        PID:916
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:8
                        2⤵
                          PID:1596
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4788 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:1
                          2⤵
                            PID:2260
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4564 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:1
                            2⤵
                              PID:4676
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3220 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:1
                              2⤵
                                PID:2900
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4936 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:1
                                2⤵
                                  PID:1568
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3348 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:8
                                  2⤵
                                    PID:4856
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3096 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:8
                                    2⤵
                                      PID:1720
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4316 --field-trial-handle=1936,i,13878079968350491706,13937524261430729920,131072 /prefetch:8
                                      2⤵
                                        PID:828
                                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                      1⤵
                                        PID:3508
                                      • C:\Windows\system32\LogonUI.exe
                                        "LogonUI.exe" /flags:0x4 /state0:0xa39b4855 /state1:0x41c64e6d
                                        1⤵
                                        • Modifies data under HKEY_USERS
                                        • Suspicious use of SetWindowsHookEx
                                        PID:5020

                                      Network

                                      MITRE ATT&CK Enterprise v15

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                        Filesize

                                        2B

                                        MD5

                                        d751713988987e9331980363e24189ce

                                        SHA1

                                        97d170e1550eee4afc0af065b78cda302a97674c

                                        SHA256

                                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                        SHA512

                                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        312fea5f5f57a111012eb3a297fd4596

                                        SHA1

                                        faf1b104154320a8f1ac304bab85033f35131b85

                                        SHA256

                                        08d713604437f098321c913e82c8934cb1a4ac50fa073fea3bd26b9558eeb19f

                                        SHA512

                                        3c348e92e95e65eb0e18f2dac966fbcb51d1dc6eceb9148f3d64977f51beacb9c426a8b8bdccd4eb7e98b59e9c28552993a4228af8b7681fafc6f510761a1928

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                        Filesize

                                        7KB

                                        MD5

                                        1ca5fa02d47fc45b2ba91e6df662975f

                                        SHA1

                                        2503e58608ddc668957c8e83dfbde36e28784546

                                        SHA256

                                        b7b9529e3c2e5b78f3dd15475002e259b3cb03ad174c9e9a9581694bbb6b00e9

                                        SHA512

                                        4331e06b56ac12df62e64a786c6bbd5794eb704ed615ab4d672f73407a2d088f0ddc078f63b995327b0ead200c274087219eafa21e8aa5a64b3b7b08777ea124

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        257KB

                                        MD5

                                        40d719843d5aad5638419ecb3c24a800

                                        SHA1

                                        13c66180f2de406cd1a47ed18a539c4f0a3a561f

                                        SHA256

                                        67b0edeca30e905ac13a27e4a7bf085a018a60b3850e34de5d5d2ec7e5fcae27

                                        SHA512

                                        7db514c9bd717a90f74ab8e5f16861b12e0072ac048493b25cfe480500ad8c77b13fa3d20045251985aebba9816308af76048ab386e9608e96dbdd76d082b1ad

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        257KB

                                        MD5

                                        0ad8c847f6178164a05ad7749f78725f

                                        SHA1

                                        1e4fd72abc357df0cc3817a79035f956abba8e4b

                                        SHA256

                                        09e9cbc257773f25d8345758de8b6745d5adfcbb81fa579612c697cd7bc8df8c

                                        SHA512

                                        e514035b474e1003d462c6073af0f46732ecec526d39e08be89993168081b02a622c7450de645070d5a1b1b727e6937febd74551111c1d31cc2c8c6082dc218b

                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                        Filesize

                                        257KB

                                        MD5

                                        9729fd515ec1bb16e4f1bd5d69a8d2ed

                                        SHA1

                                        3c92e459c3094f179889fd695ab11979baea14c7

                                        SHA256

                                        6f16374ad531743896d73ebd71dfb0e078daaa74413c52ad56cd99472e27e77f

                                        SHA512

                                        9c8ee4ab4808eaac0eac2d7327f7893878e1b570dd0b8c9e0f4b78fb20afb3df037c21e1f257ce42a1f71a4b1a7112b02b3cb3699a88f35e35749072d0f229c4