Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    29/06/2024, 02:10

General

  • Target

    http://https:/gofile.io/d/mqoAua

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 54 IoCs
  • Suspicious use of SendNotifyMessage 48 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://https:/gofile.io/d/mqoAua
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff12eeab58,0x7fff12eeab68,0x7fff12eeab78
      2⤵
        PID:4052
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1044 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:2
        2⤵
          PID:2060
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:8
          2⤵
            PID:2568
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2228 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:8
            2⤵
              PID:792
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:1
              2⤵
                PID:1364
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2944 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:1
                2⤵
                  PID:2876
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3988 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:1
                  2⤵
                    PID:2652
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2944 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:1
                    2⤵
                      PID:2664
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:8
                      2⤵
                        PID:3536
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4424 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:1
                        2⤵
                          PID:324
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:8
                          2⤵
                            PID:1788
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3184 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:1
                            2⤵
                              PID:3404
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4480 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:1
                              2⤵
                                PID:644
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4204 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:1
                                2⤵
                                  PID:3172
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4352 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:1
                                  2⤵
                                    PID:396
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --disable-databases --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4168 --field-trial-handle=1868,i,6106271075285312250,8004405261505908712,131072 /prefetch:1
                                    2⤵
                                      PID:2688
                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                    1⤵
                                      PID:1888

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat

                                      Filesize

                                      40B

                                      MD5

                                      23e6ef5a90e33c22bae14f76f2684f3a

                                      SHA1

                                      77c72b67f257c2dde499789fd62a0dc0503f3f21

                                      SHA256

                                      62d7beeb501a1dcd8ce49a2f96b3346f4a7823c6f5c47dac0e6dc6e486801790

                                      SHA512

                                      23be0240146ba8d857fc8d37d77eb722066065877d1f698f0d3e185fcdae3daf9e1b2580a1db839c1356a45b599996d5acc83fda2af36840d3a8748684df5122

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000005

                                      Filesize

                                      211KB

                                      MD5

                                      151fb811968eaf8efb840908b89dc9d4

                                      SHA1

                                      7ec811009fd9b0e6d92d12d78b002275f2f1bee1

                                      SHA256

                                      043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

                                      SHA512

                                      83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      144B

                                      MD5

                                      e8768f458898a05dc4f2d29fdd35308e

                                      SHA1

                                      db378de53a75d5a3cab139587a539b48aadaa99d

                                      SHA256

                                      39425e46a9606f5ac89de54b87e055a18a2ef420426a5884dc0d250da63f82d2

                                      SHA512

                                      547ce711b7abd950b9ec3b70bade913f0884f550ad44c57593ae5d8a4e83ffd1ed519b3724ebc860f18226db38738c72606807349ebb89430a973a506879d8d3

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      1KB

                                      MD5

                                      a35069ee626d31316be65fd639ebdda2

                                      SHA1

                                      4b69adf27ac35ea578214efb07457c1c02091d83

                                      SHA256

                                      d8429ebae17912d6ae44823ea97bc6ab66d27dcba982b9f6de5c8578af8d7f63

                                      SHA512

                                      00023be8158cce2d7157b87f918a1c1b2c3f0206fd317eb9913c8b44ce705a2b20606044bd845cd83ae5dff12155c7bd4ddb8d41997820c6beac35a3c9a4bbad

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                      Filesize

                                      2B

                                      MD5

                                      d751713988987e9331980363e24189ce

                                      SHA1

                                      97d170e1550eee4afc0af065b78cda302a97674c

                                      SHA256

                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                      SHA512

                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      356B

                                      MD5

                                      21dae47e04365e613d16e5e212f53162

                                      SHA1

                                      debcf35dfd5bf9ed6ec65671130e0b7707bc0456

                                      SHA256

                                      d39f41f33aec6e4d7d54e0510725c38677be681da56edbc507873b14c89763ef

                                      SHA512

                                      82084fa3feeda130e0d3e3b1219445764831ef9a19bcf9200546e13f7852422808e63e82c72d59691fc96404e47cbfff898a43a4b12de35d7bcc3edef4f57fea

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      53ed128487c7f8356859881204ce7435

                                      SHA1

                                      b7dc79e0a026a54c9aaef89f48ff70566d49fbb3

                                      SHA256

                                      6d80bb938d4db5c6ae82e50accdcf747c303ea26f98e9a8a1a76626819d29fc3

                                      SHA512

                                      88d0c68e5c5dc1bbc727a21210c27b548c088452bd944a055a1cd66a5eac260fb4468a8635a7c95cacd9034130452d7aaa5656e0d91880e508cd2c80a5e79e52

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      7bfdf7f266990f2fb27a1285dbfbd838

                                      SHA1

                                      68b9537f0602cc51884695bad53a37ec12718470

                                      SHA256

                                      7458c1c76947df3a033e950f9e6a98d6c3b41cf0e53ab8a4fd9d7fa8d0c137c6

                                      SHA512

                                      1974d02fbf9b95d9d1b871099fc0854db9c011f4d693fd6ba856ba9c71c2f79c1aefb110b487d43096d343410ef36f833facb567a28005fed7de068f2a2022d1

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      255KB

                                      MD5

                                      bca0e5eef35dda7b57261c39dee57d60

                                      SHA1

                                      484769c1428e50081c02466fdbd72d8aad29c630

                                      SHA256

                                      fb01e6d9abb401effd4a6977018f302d7c292f308caf91494932b46dcf1b2272

                                      SHA512

                                      eaf2e473f0801bed92e80086c3b9453fd984a7dc4d870b38fa288f49fed7c87a7d4a82725226ad59871ca944bfd3a97f16ce74e1c6c8a1da7d17dba4cd965ac1

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      255KB

                                      MD5

                                      b05a087299186e0b2186054e727b909e

                                      SHA1

                                      8467a725c3bdf0e3a9dfa458a542fb0e8cd76270

                                      SHA256

                                      0d311db77ed46567df4e3f44b7ab3fa7feeca64c6d8478449355317b0d2722fa

                                      SHA512

                                      73515d53d5532163860f4f86e09747527013fff2773e967b9dee9eb88ef360b8ed8c469eca0f8441e8131ab0cfcbcc09d640baa6c591d5d87a53cdb822516d9b

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                      Filesize

                                      264KB

                                      MD5

                                      44fad34864e90b1774685b2274b3024a

                                      SHA1

                                      4b58b9ea2e1ad3031fec9db3033301a785ca0845

                                      SHA256

                                      b4727cfc464fbf867d5d961c1aa984329ac9f10451a010ae100c98faf3108c73

                                      SHA512

                                      514fcabbf57f17358ef69ac9672ddb22b6048196c7533c04d8e6d234f61a1aebdcfc7aff5f00d202d8e59b4e22121ad916f1e344d2315b6338be0a11b0f5370c