Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240508-en
  • resource tags

    arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/06/2024, 12:32

General

  • Target

    0544ce429a95ba5699c43d4ff5f5609f245105c82388296e852b5ad3e2ba7182.exe

  • Size

    2.3MB

  • MD5

    79893e931a1368ba6724110ca28247fd

  • SHA1

    c0ac618dbadc8862bb774746d4e6184354fa0872

  • SHA256

    0544ce429a95ba5699c43d4ff5f5609f245105c82388296e852b5ad3e2ba7182

  • SHA512

    3e06fad67a5bb4260fe4d13b208428315258a75f6f014bedfb8ae9544be3b6d1ee5cfcb22232729e9006f25360a5996bb6d6402990b4af742c578967e71aa75e

  • SSDEEP

    49152:R75gfdDlqnt41NdL7Lo45+5gYx+m+l6Id+csx+GV22i:hSqnt41P7RE5Zzm6IJu+GX

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • AutoIT Executable 18 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0544ce429a95ba5699c43d4ff5f5609f245105c82388296e852b5ad3e2ba7182.exe
    "C:\Users\Admin\AppData\Local\Temp\0544ce429a95ba5699c43d4ff5f5609f245105c82388296e852b5ad3e2ba7182.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3556
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:824
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffdb439ab58,0x7ffdb439ab68,0x7ffdb439ab78
        3⤵
          PID:2840
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 --field-trial-handle=1832,i,4636434745607773057,17345183991550480859,131072 /prefetch:2
          3⤵
            PID:2492
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 --field-trial-handle=1832,i,4636434745607773057,17345183991550480859,131072 /prefetch:8
            3⤵
              PID:992
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2188 --field-trial-handle=1832,i,4636434745607773057,17345183991550480859,131072 /prefetch:8
              3⤵
                PID:3712
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2808 --field-trial-handle=1832,i,4636434745607773057,17345183991550480859,131072 /prefetch:1
                3⤵
                  PID:1892
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2816 --field-trial-handle=1832,i,4636434745607773057,17345183991550480859,131072 /prefetch:1
                  3⤵
                    PID:2160
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4172 --field-trial-handle=1832,i,4636434745607773057,17345183991550480859,131072 /prefetch:1
                    3⤵
                      PID:748
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 --field-trial-handle=1832,i,4636434745607773057,17345183991550480859,131072 /prefetch:8
                      3⤵
                        PID:2296
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4424 --field-trial-handle=1832,i,4636434745607773057,17345183991550480859,131072 /prefetch:8
                        3⤵
                          PID:1928
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1832,i,4636434745607773057,17345183991550480859,131072 /prefetch:8
                          3⤵
                            PID:1628
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1832,i,4636434745607773057,17345183991550480859,131072 /prefetch:2
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5064
                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                        1⤵
                          PID:4932

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          216B

                          MD5

                          4ddec32dd010907661111d388e965145

                          SHA1

                          dd7c3040af27017ca61af9cdc2380a42080bd1ea

                          SHA256

                          a42797fe43991f511169edc34fa17d96fc6349690f7d05c9354a68ca4ec81152

                          SHA512

                          e10bc4b53cdb39dd1db1f447ec5f49a1b49fa5461fde4963b61804bcd277e1b2031cf73f5901d6aaad4ef0df5df596a1101905416218a3a08ab33cfb9d697b42

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          2KB

                          MD5

                          b6283f44d1d4ad5e638e96656358b424

                          SHA1

                          62c44fb4e15bd531d4dc9f0e88b94832d3b53826

                          SHA256

                          61ed2584aca59b40326319743f20b39c6ec8b972f658cab2ef4b27a47d64c429

                          SHA512

                          d544c8ae5006e8da289d88c743e9a2198553b506e1fe1e0c4e2d133cdf7783b1f697e055c1f5f6d04f84db9f81430ac788294cb29ddb2720082c9bdceb67244c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          2KB

                          MD5

                          ef3322a54edb10a39604a426e7753ea7

                          SHA1

                          711b691be113fa736b427d485b4af1f4d827006b

                          SHA256

                          3bd21d0a753ff0cd77213a3ef6289a99a70f75ff32254e814b6a26b89bd2135e

                          SHA512

                          78d24453ffd5bec1e3afa2ea985fc4026bfdd36559f6763c685b587907a08c86fc7755c0cfaad67ddf136538b3c35b43b9c490a3ab3a7c8cc1ffe73e3bf89f09

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          692B

                          MD5

                          d0c162959358efa5f131af6732a5530c

                          SHA1

                          f3a5e6500e1553d7725365fd115ad8e4394e1bf2

                          SHA256

                          0dd7e1ca7f40225f6021c68304a3732d9e82a6b86fcdb1ff510f3fa1756270bd

                          SHA512

                          bd100caf913f3f6c570f32048bfc6d255e62b03cf69f6c789e00073d613bc7cef6a7e3d7c564330ff7c31014fb6ef3a986b74fc378ac5745e46c87826cef21e9

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          7KB

                          MD5

                          72e2e90e873f90d6d9c2afcb59a340f0

                          SHA1

                          93f0a3513739de26dfb64148f7be7c75c1cfe4aa

                          SHA256

                          e9bd3cca2083db3c0513121d89d768436d4cbcf9d76753a2137b1a23b9c4e3cd

                          SHA512

                          b2accaa7fb9a71c2f4246575a31bc1786df276dc68e7dcdabdd1cc330f3d7c8748df86a7a9025618e7477c0c84d874841039a56da8d912dc6fa7ae5f50317f87

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                          Filesize

                          16KB

                          MD5

                          478bef65415f705a0c2fbe7568890598

                          SHA1

                          565d6728ddae400a28fa4cfaa8de1107e39b2f17

                          SHA256

                          cd64675b78554484f7e51f0228010c1a0f8ad53257d7ee8a5eaefa80aab4aeef

                          SHA512

                          464f8acc9d654f04263ab2bb20e83e4a86a9869a8be1206f75ad04ade227d5981ad417846462c166eac57e288a225e529c2ddf9b653cd65bda2679769259940c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          273KB

                          MD5

                          edd3b9233cab25c316ed8a7585b5de72

                          SHA1

                          d63deaa6264620564eda615bb145bee706a435e1

                          SHA256

                          197058729b998cffb2618a81342184548a6c4469030478c3e736e68f8fdfa46c

                          SHA512

                          b53ec82f346e08bf03f80f95a2c6555c5e8e561a49cde64ed7e319579479dc4adcefdce598d21ab9caae7f738948381d8cecdcef87d6370aa71ed60add4f4607

                        • memory/3556-7-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-2-0x0000000000621000-0x0000000000685000-memory.dmp

                          Filesize

                          400KB

                        • memory/3556-12-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-13-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-10-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-9-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-48-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-64-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-0-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-5-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-6-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-11-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-89-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-90-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-91-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-92-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-4-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-98-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-99-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-3-0x0000000000620000-0x0000000000B8C000-memory.dmp

                          Filesize

                          5.4MB

                        • memory/3556-1-0x00000000772C6000-0x00000000772C8000-memory.dmp

                          Filesize

                          8KB