Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/06/2024, 11:53

General

  • Target

    https://ratecard.dstvmediasales.com/rate-cards/2024-08/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ratecard.dstvmediasales.com/rate-cards/2024-08/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2880
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7ffe4014ab58,0x7ffe4014ab68,0x7ffe4014ab78
      2⤵
        PID:5060
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1888,i,10673403741428019177,18414654626130622772,131072 /prefetch:2
        2⤵
          PID:2692
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1888,i,10673403741428019177,18414654626130622772,131072 /prefetch:8
          2⤵
            PID:4864
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2168 --field-trial-handle=1888,i,10673403741428019177,18414654626130622772,131072 /prefetch:8
            2⤵
              PID:3704
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1888,i,10673403741428019177,18414654626130622772,131072 /prefetch:1
              2⤵
                PID:5076
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1888,i,10673403741428019177,18414654626130622772,131072 /prefetch:1
                2⤵
                  PID:3628
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4404 --field-trial-handle=1888,i,10673403741428019177,18414654626130622772,131072 /prefetch:8
                  2⤵
                    PID:3228
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4568 --field-trial-handle=1888,i,10673403741428019177,18414654626130622772,131072 /prefetch:8
                    2⤵
                      PID:1940
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4808 --field-trial-handle=1888,i,10673403741428019177,18414654626130622772,131072 /prefetch:8
                      2⤵
                        PID:3240
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1868 --field-trial-handle=1888,i,10673403741428019177,18414654626130622772,131072 /prefetch:2
                        2⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4268
                    • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                      1⤵
                        PID:2564
                      • C:\Windows\system32\AUDIODG.EXE
                        C:\Windows\system32\AUDIODG.EXE 0x300 0x45c
                        1⤵
                        • Suspicious use of AdjustPrivilegeToken
                        PID:4112

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000b

                        Filesize

                        25KB

                        MD5

                        1863352d87d590cfbd1481a102371185

                        SHA1

                        da5b9d8a6d952a595c9bb59060eeaa2748d3f299

                        SHA256

                        2895d02bf0ca5d01df19dabb54ff87330184b236ac58df4f07dccf09a8d17601

                        SHA512

                        87a24c3fffc9fc4400306f05e6f537b744c2b2486e929478963d78d6ae83ebe611e0956d86a18df1b61a63aa4c410ed20fafd0bcaeb7e84c6386cfe0f48c724c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

                        Filesize

                        26KB

                        MD5

                        51dc20684b74881ded91be760c73a332

                        SHA1

                        8033a935023a32d8ab0ddf0af4ed9dfaa0e6829a

                        SHA256

                        e8e403906c8923f01bd240313ee7d120c3621f9da5e3481ecf531b6c9d0d0a6e

                        SHA512

                        b35bec9b893dba5f9fe455eb3af38505aec2c55cffca8eb2fdc24985db24f2a1ef5e399829da479d440267fe08a34b6a4f54bda884e61d507d56ece5c970ac41

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00001e

                        Filesize

                        19KB

                        MD5

                        192179ef4f168078ac6d6043c43c4f91

                        SHA1

                        63ce5a472c09b7a208e9400a5d7d928cf572a270

                        SHA256

                        c79ac80c5ca5996ec28b6b86ae008b0ffcbe3e8a12127d37779ed65f26de9cd3

                        SHA512

                        7734223a638c83d023387b2677e11b2477185f3a5e3a3301de1591a0c9f0e0217cb7b73712f8296efd29c9269f6fb0b036bc14ff992b90ee252eb24a10ab9ad9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000021

                        Filesize

                        21KB

                        MD5

                        5f3c4751d53da5c40cb488b2361c07c7

                        SHA1

                        482678bba8a395c8e0575d195dd1ab9fcd087cec

                        SHA256

                        3eb944b49780ce34c8f077a704f3287987d965f2bbec1ce3408e03290655fbff

                        SHA512

                        324b3fc81b53311d9215a102c1627a7b354d5be046b602b20c0e971c428e6c18f6ee10eb26e63cbe514e40f681984ced4fdb031990e892997ce9b389bb1be5be

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026

                        Filesize

                        28KB

                        MD5

                        df407f1120502013a471ba480d5c6f0b

                        SHA1

                        3613ed2a87354bbf305f5fd5711d8ed571c4140b

                        SHA256

                        ed78d7e6269ba5a0acf3637b3bf7a9765f6b8137f3e99a63069553bbc5857f36

                        SHA512

                        e40067a37718d78a52387d45cc6132271cda7b3786d6ddc60d2e5528fb9cf9e17035c3b5950132507c26d46af8688deb3c94718c84dbb1baf8aa62027669f645

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a

                        Filesize

                        118KB

                        MD5

                        28b3adb91fc24c9d943c3eaba9e2a99c

                        SHA1

                        a8ce95a98d9bde0e6232e5a7882d6150d2be38e6

                        SHA256

                        a6eba97cdc26ff7b54137cefeea0950fa47986a5b85a1d0073c2c9118e20e272

                        SHA512

                        dd8adcc1acf62c2ba1f54b10cb6fca0dce24320e040edb6fb6bb4ba7f9571ba5c7767b903b3c8afe9df8a460574491b9a1908477b8754e4441878cb2d37404f8

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b

                        Filesize

                        46KB

                        MD5

                        68f52fec2bc2af9efa05dedc291dd64d

                        SHA1

                        8f5b6707cc2e466270f19b287205d8053654f1ea

                        SHA256

                        65d671c63710f50fcfe3abc256bcd0141bb3a99d7d79478f81009a0668b219ae

                        SHA512

                        d8c7c02ba90b976b6149279b61c22041bf0b4f28c6a6514d64de819e91d4ea75f0bdc556cc7b480c45e2c0ba4597c56a35113e306118584ac3822cc531d0d547

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        288B

                        MD5

                        ccf5818601be653a7f5576e7c09abd49

                        SHA1

                        fd6e1689d154d9531416d32ccaee5aebf855a815

                        SHA256

                        cd5f9901bf3a5a3d6d443d166dbdd1525bcab66c0c87cd0548ed928be04f09e9

                        SHA512

                        05c3baf8686c19fc363d6fd01bd961a7a29f9a64cb13e2501f7bd448c1cf59e4f6eb7caa4e917588b4dd0d2b10d9e1b5539834085de2748c86dba59815bd896d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        33f9e43edff64c403fd3018547600c73

                        SHA1

                        7a568c95056c2bebca1f667a0d8ef3cbceec2ea2

                        SHA256

                        cffdbb03035048f2d5eb9b90f33f9e90e40ab3278129c0d8b9211b8094106283

                        SHA512

                        42156ccc3304016669a92d4bf944130695fc2888229bee6fa7dd8f64323172d467a42d294aedd92c1b8d88ab7a03715f3714d52f05391e75406e8ea090afc01f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        523B

                        MD5

                        8a4440681fa5d5f19460699f70215e7e

                        SHA1

                        d217d84e6ecb30d39a501b6856ed5e4e354cc887

                        SHA256

                        dbadc247c28421ee8567ce14b08a83eab69bd563fb791859203c95b57565deb9

                        SHA512

                        8863e8741479a615cce0934892036670b00d13e76e5f78ea342ea77d601b1173460e52e8ef17de3a1144a13703ec731fdeb1908de2ed5653ab67b4315ada8550

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        7KB

                        MD5

                        cfd313e36f5124625d562d8932393e60

                        SHA1

                        34b0b571ce478d0f82c8b5e697e5d57d6bb21b72

                        SHA256

                        0a4f455fd4a11191c90216ab168f05ac8032b220f0988316ac193b13dd5cfa80

                        SHA512

                        6c9256960b8216e1c8d04cdd747b1203a1c3c90685c5a931a1f829afb5f772142ce1f323e12b3ecf380e62ec10e99b0dfafda54605050662b4d9e93b6b119c98

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        7KB

                        MD5

                        0dcb667b48b76038c123cf4bf59f1c9b

                        SHA1

                        48f289be629861cf6bdc406ade958f9a8b9eea7c

                        SHA256

                        122a61c2cecee5ee1ce555989760e7ca028c43ae93e65bc3ca53d05d31242d2d

                        SHA512

                        15067d80d9b6627a4cce5688d6cbad2021b37d4c7a006aa75abac7f3acb03ce4c5fd737f7e2dd4234f0d19d642e3fede1d359fc6e3cd2cf93a92ea41dbb4a2e1

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        255KB

                        MD5

                        3aacb465460e8abdc8c979251fbec4e0

                        SHA1

                        730f6987c49f8afa40c38a1d4f0bce85396d15a3

                        SHA256

                        b1219aa6a079e188b181623060e9f95107a09e3af901459d706ab013b0f9de3f

                        SHA512

                        e43e626c7a96ead1cf382f9e5729a35eb2a04fb1cc93fe1a3e1990460391830268a6ee1c8b0e610a860d1a6db2aa2a1d6c9f676f8360b8d2cdd3af67de753d30