Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2024, 10:51

General

  • Target

    e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe

  • Size

    2.3MB

  • MD5

    d06913fbee09bdfe1bb7cbb2b392c798

  • SHA1

    127509ec2204bd8d16ce2355038755a0c53b01f7

  • SHA256

    e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8

  • SHA512

    18ae838dae507696a118cd8caacdc38230c20df15679e76b9490f5738b2eb742a161dd587a78d63d3f5bf0a90aac4ee9a4a2aa8fff164482709e6d1f945ad2d0

  • SSDEEP

    49152:ZOC4iuI0MHyCRKsvOqoOuVDZ+bpBgNGOeOq068eNtGeZFLEKpZIYtB0Ck:ZOC4iuI0B9GVBgNGONiFikxEyb0C

Score
9/10

Malware Config

Signatures

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

  • AutoIT Executable 13 IoCs

    AutoIT scripts compiled to PE executables.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 60 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe
    "C:\Users\Admin\AppData\Local\Temp\e6f31f77a9e4ca9640688081b639faaf388e26d6cca5779f05ac5823ed58c8e8.exe"
    1⤵
    • Identifies VirtualBox via ACPI registry values (likely anti-VM)
    • Checks BIOS information in registry
    • Checks computer location settings
    • Identifies Wine through registry keys
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1672
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" https://www.youtube.com/account
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4912
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff530aab58,0x7fff530aab68,0x7fff530aab78
        3⤵
          PID:2252
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:2
          3⤵
            PID:1712
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:8
            3⤵
              PID:3916
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2276 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:8
              3⤵
                PID:3768
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:1
                3⤵
                  PID:1176
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:1
                  3⤵
                    PID:3300
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4288 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:1
                    3⤵
                      PID:2000
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3296 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:8
                      3⤵
                        PID:1588
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3344 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:8
                        3⤵
                          PID:2284
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:8
                          3⤵
                            PID:2716
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=2040,i,11923205151573166313,11945439531157603764,131072 /prefetch:2
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:216
                      • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                        1⤵
                          PID:2292
                        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4092,i,14221647728265121051,6840906015709541562,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
                          1⤵
                            PID:3304

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            216B

                            MD5

                            53fec90f5292fb461da40a4908dd9175

                            SHA1

                            70368787beb88456e7c5a4a91a81960a57e76f15

                            SHA256

                            73cf6e2cda3adc55e4a2158b45bf3a98fb7d692eb0df0bcb32093e9b98e8ccd1

                            SHA512

                            f207da685c970bd4f358421cb53bbf550d5105d7b83de0bfd249e2d40d55381c9fa180288c30b9e3862a6e026395b5b0c7fcc8163e30a7918f9ed6095db5005b

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            26a36b2c09160bef2ee039c2a07812f3

                            SHA1

                            71936bcf2c194aa2d06aa6e836e30eeb489dc913

                            SHA256

                            7285a6e2e2ddb02187953e1543e528bfef9ccde7a3165b3a66186153ea7df96c

                            SHA512

                            b7d3de3477000acfe43dd0c138f818bdf88ee6570f35f4b893fff7ae6b62328a5b820180cc2f0b077e97773cf5a46b47845e33ee2f44bb5365ea8cccc166f970

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            97ef1b960414b9cd60df256ddac6f092

                            SHA1

                            5f217d4423576ae6f14872d7ccf4dad674c81ff6

                            SHA256

                            403482dd0226c9a875580ab7683e9b13ecc2a8806dc154309419442c1c179b82

                            SHA512

                            10126256450844f5b93fe95279bccf40fa011c89201a3a1bc35884b59d301964267fb5cc913e35eb6e581e8fac20c25ca5c08cc60f0ff7ecb534ba172e2a6699

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            692B

                            MD5

                            66d685821c8e7e6e706a6d90b914665b

                            SHA1

                            ec67e63b9b1dfd75d5b3287e8982763abebe2c26

                            SHA256

                            3a212c04492f74808dd4e14330cbc6e42ea2ea8c172d6bc98a9bce10d9592de8

                            SHA512

                            951dd3f36b5435cce4a46839630cf9f248bac46c586decb945c8a3ae46036992b96b1c93721fe3fa851010c99c43583868d8651a7e3c9738911dd4e489a3caa0

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            7KB

                            MD5

                            8a467008b19955b2a48f9e8107825a9e

                            SHA1

                            4f756d4cdeb21ea87200d5442e1e2a69b819e960

                            SHA256

                            7924460c8a252247c5877aefb91addb792b713181f8b853f13e187b45df862c0

                            SHA512

                            4b20cd800bfd3393e76f75259c3d04287a767a34fd38283ff44868cf957261340414745c7aef97422d09f7822e80e687453c4a6fd7716af6316d4d52db2d180a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                            Filesize

                            16KB

                            MD5

                            c71fbaf4ab5fd5907dd547fbb12c83f6

                            SHA1

                            37b0bcbe5d527f7006c3cb5ac7d596ec8ce15ea5

                            SHA256

                            5a7fbd37d3862c3e2146d107b95ac539e165b4b54af622fe06dc4fe658077949

                            SHA512

                            24ba5e772ab6b2b4c8d56d386352bdfa3aa0ab222e473339e6adaa1e9b2db03d84fb77b85875d1c74f56cded6d46093daedb9fcd6e700a909b2d212928fc541f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            272KB

                            MD5

                            15e7c4b1dd5fbec0f7124a03cda15795

                            SHA1

                            3f2b9164cac1f03862f88f1a0cbbab60b1955c45

                            SHA256

                            5e5f6534d4e6efe807ed791bf54f2e185a7a9f9a6c4a52ed9683df54418a09f9

                            SHA512

                            5b6042436b74fced9438a1a80061979378027b03f9e2380efd4e9a511419d95bbdb3372edb5ce0ba7abff6c21bf40fc2a3bd53914cbc71b8b066090111eb242c

                          • memory/1672-6-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-5-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-10-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-9-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-61-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-7-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-0-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-11-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-4-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-86-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-87-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-88-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-3-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-94-0x00000000009C0000-0x0000000000F0E000-memory.dmp

                            Filesize

                            5.3MB

                          • memory/1672-2-0x00000000009C1000-0x0000000000A25000-memory.dmp

                            Filesize

                            400KB

                          • memory/1672-1-0x0000000077CE4000-0x0000000077CE6000-memory.dmp

                            Filesize

                            8KB