Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    52s
  • max time network
    53s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/07/2024, 15:44

General

  • Target

    http://scamwebsite.com

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://scamwebsite.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3644
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff975e1ab58,0x7ff975e1ab68,0x7ff975e1ab78
      2⤵
        PID:2388
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:2
        2⤵
          PID:3636
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:8
          2⤵
            PID:1828
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:8
            2⤵
              PID:1824
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2960 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:1
              2⤵
                PID:3304
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:1
                2⤵
                  PID:432
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4296 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:1
                  2⤵
                    PID:760
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4436 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:1
                    2⤵
                      PID:2616
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4236 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:1
                      2⤵
                        PID:4524
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4628 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:1
                        2⤵
                          PID:3520
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:8
                          2⤵
                            PID:4428
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5060 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:8
                            2⤵
                              PID:4992
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5060 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:1
                              2⤵
                                PID:1544
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3264 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:1
                                2⤵
                                  PID:928
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5484 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:8
                                  2⤵
                                    PID:4448
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3192 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:8
                                    2⤵
                                    • Modifies registry class
                                    PID:4464
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=2008 --field-trial-handle=1828,i,17400524080721031976,8957631640728193829,131072 /prefetch:1
                                    2⤵
                                      PID:3424
                                  • C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe
                                    "C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"
                                    1⤵
                                      PID:2756
                                    • C:\Windows\system32\AUDIODG.EXE
                                      C:\Windows\system32\AUDIODG.EXE 0x48c 0x4f0
                                      1⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:4220

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      168B

                                      MD5

                                      ee3b3f344a3fdb219e5ae79258eb0454

                                      SHA1

                                      5d607601b87f41e22ec30537deb4110eb15ea8d5

                                      SHA256

                                      6526f15ec60cc452304add0852d6894a3f2f0b2e8b4d22d58529b394b0dbb0b9

                                      SHA512

                                      e4c200155c01a540122cba8a8706541289f41e4791ecb34b1c2ef1eb2dff1dbd92a38ab40581cd4d81a88416e6785dc8c0da796fd27a5f2114cb5a8e1da50645

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      744B

                                      MD5

                                      ab69061fdc1512b32e323cb9d74b151f

                                      SHA1

                                      d25279661defea071f9b8faee231680741c18634

                                      SHA256

                                      f4ff670a0e5a630e83af69a07165d975a10410c202484d01ebe69159f599038e

                                      SHA512

                                      06c74936e1b53b7befb8502a5b2c3436877ef50e146f6cb911bc65943b29b7c0e026422f55b34f5b5557bdbc6c24db962d7db0f17ffdef071825f612ae3c1ebe

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                      Filesize

                                      5KB

                                      MD5

                                      275ebc68a731bc13b76f520901e467d0

                                      SHA1

                                      1224a70931d486a1bd5105363151b790efef8e47

                                      SHA256

                                      9faf7e5618cc3f75fcf714479ceb9b0b6885996018f3d76eb00efcf9ac153969

                                      SHA512

                                      0a6f6e56bda0f03cd9b53c0f1357b4be6f6db670c5c720a8d850db467bb07f33d36f5a0f955d60afd232965627f5f9f50c92751ef3e8aac2182bf53239b47985

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                      Filesize

                                      2B

                                      MD5

                                      d751713988987e9331980363e24189ce

                                      SHA1

                                      97d170e1550eee4afc0af065b78cda302a97674c

                                      SHA256

                                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                      SHA512

                                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      1018B

                                      MD5

                                      c9bbc1e73f49865f7f18649653ef3894

                                      SHA1

                                      575fd9f5f1affc989b9c5ddea484cf1f1b752108

                                      SHA256

                                      b9c63feda781b85830ae1989ff1a666b05ca446d5f8a4137fbfc33a37c66c124

                                      SHA512

                                      b4310e2d014aa70d9b82d37dde07c6889227e8c1538169260e879a35ae80004f8f88ff342e403f93225caa32f329dd2858c7497303f271a8a30acd69c3206df3

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      522B

                                      MD5

                                      ecd7b7af91bf40cb80eda93c87179866

                                      SHA1

                                      d5a9a555410e976ef8a2dfa8de06b7bcfe414543

                                      SHA256

                                      4becf2895d1a1d7d212381b4fc24fe3db6fbd1a0482f2cd4ed6ba0277ed8e553

                                      SHA512

                                      07b8c8d4e156ed6b9b32e4061275eb471bb86c5e0c9a18dfb9a08505a86ab6eef440ff725fa17df3f3fd9eaae821a31b863697e420d1bc9bd417461111ed3b91

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                      Filesize

                                      1018B

                                      MD5

                                      0cc7cdb9b79d23fc9ca75f1a28e686a2

                                      SHA1

                                      7a488a7b0b79aed387a1e8cf8d7961905f524e3b

                                      SHA256

                                      df97783d48c8467b30832370d08618c0a72ffb494498277064d1ae22e6cf8291

                                      SHA512

                                      5a3dd17f260c6b99d7ec22a3197143bccd3f30eedf79d1a900e7e9c6c7e01662190c25cb8f99258a2987d5f9250d4d00bdb1656a1c82cd290ff069066d8dba80

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      dedb355bbe29bc37375ed8877adecd10

                                      SHA1

                                      0615da2620653c2b706bd654edfad26e27b4cca8

                                      SHA256

                                      197b7e60411d2e629cc27a36d651a0f6d39f61b534d1edf7bbb59b8a62d37af7

                                      SHA512

                                      c847bcd601667b9eee0e1afb25562ec03b8d7ebcccf1507d6658ff509793e5377b69c93647902e3cb6cb9cb1b70e23f59eed73a67bb915a69b8fddfe1c71ba46

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      8KB

                                      MD5

                                      6ea1dc6d1195a0cf27eb7f31abeafb7c

                                      SHA1

                                      decd03ec9eeb55ac01647cca607d510d32f9df06

                                      SHA256

                                      93f3cba2f2f77383646558c6a3f8cb7830081d3a65b88193b5df0692b13bca4c

                                      SHA512

                                      2f39b8d0c72cf594fd957360bb5be9a1342eaadfe9a2a14957fe0f040e8de04107ca34bbe4f7cca0846d845c3ce316863710534dc96fafbc69fb862fe4bc66eb

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                      Filesize

                                      8KB

                                      MD5

                                      8208ec1724dc9f48a4cf713ef745ee97

                                      SHA1

                                      f2c41f1a4f78428518b3185c6eac91b0b51b5f52

                                      SHA256

                                      d69da01de3183630ba5fb5d50381ce863c6c4d72a167741d3ecf16ebf36ee15c

                                      SHA512

                                      916134ccc612b0c0da6bbeb50230fa5147e601a5871302bc42d1650c3fe341d876353c137df843d98c1e1f0c38c70d3a003bbc360d7bfe34b885cceed1ed7b7f

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                      Filesize

                                      176B

                                      MD5

                                      704613263966badf15495799b28d650c

                                      SHA1

                                      13bf83e079609555e80b821a34f7f8ddd50104a4

                                      SHA256

                                      e6d1d0eabc3e5e5c9347fa89f4b5a5351c16771c90e4b03119c06e654676b6a4

                                      SHA512

                                      429dc7a975fac6035a46bef64cca293e23f443f4354b02a8b9a2ba4dab1a7c1020a31d66b8f4ff249f7e4e4f73438d9b5c1b3b01ad70032c830674ceb03d4732

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt

                                      Filesize

                                      112B

                                      MD5

                                      177fbebfb08fdc77af00dd2391ecd0d2

                                      SHA1

                                      2b0fbd0e81dac67d50870b88a7f6de4be8439be6

                                      SHA256

                                      77ce859c8d48f555fe609f9f0ef99953e67f15aec36aedbca68c5108be686660

                                      SHA512

                                      57b7b2ef3d195b2efbc70e60166b338e4866872f13f95f38a2ebe95e5652329e5aef9f0bfc442fd362d234fcb11cdfbc2c117d1f266f43dc9aa97e8e77fd1fbb

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\379f1cbab5b08b6fc9e08681e42d8be311441c88\index.txt~RFe57bc6a.TMP

                                      Filesize

                                      119B

                                      MD5

                                      b6bf4e6fd3bbbdf062fe95b8a722a4c0

                                      SHA1

                                      844cb3a547ccee1ef6745b9328bd85bce17b26ae

                                      SHA256

                                      af9be4ac28224926f669168bf0b4f6dc7743e440c351aa3d87d3013f12b0ca93

                                      SHA512

                                      a4ce664c69485e02a0d0ec0d517040d21ce1a98479e1fd332f7e2dfebe14d380b6af8cb9382a151a92d3c6a0cff067a76087f19598c6b770edd0bff6a03545ae

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

                                      Filesize

                                      72B

                                      MD5

                                      ec0b526fb82c2236b2ad62d88dcc6a2c

                                      SHA1

                                      eb6a1e6210e5e2dc0180531863daff99ebf4a83d

                                      SHA256

                                      f8aa11341ded63b924ab5b1eb5b513b61766e07f8e5125c29f09e729f9598a8d

                                      SHA512

                                      22d9d1cb0981e753fa4859896d13a7b283b3aa6d51f31090ccf58fd49b755ba0d4f4d3ae7cc26c162c8040e6cb77a3007a823f88b465d462601baef38c7eba52

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Shortcuts Menu Icons\Monochrome\1\512.png

                                      Filesize

                                      10KB

                                      MD5

                                      7f57c509f12aaae2c269646db7fde6e8

                                      SHA1

                                      969d8c0e3d9140f843f36ccf2974b112ad7afc07

                                      SHA256

                                      1d5c9f67fe93f9fcc1a1b61ebc35bda8f98f1261e5005ae37af71f42aab1d90f

                                      SHA512

                                      3503a0f4939bed9e1fd5e086b17d6de1063220dffdab2d2373aa9582a2454a9d8f18c1be74442f4e597bdba796d2d69220bd9e6be632a15367225b804187ea18

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp\scoped_dir3644_1413905401\Shortcuts Menu Icons\0\512.png

                                      Filesize

                                      2KB

                                      MD5

                                      12a429f9782bcff446dc1089b68d44ee

                                      SHA1

                                      e41e5a1a4f2950a7f2da8be77ca26a66da7093b9

                                      SHA256

                                      e1d7407b07c40b5436d78db1077a16fbf75d49e32f3cbd01187b5eaaa10f1e37

                                      SHA512

                                      1da99c5278a589972a1d711d694890f4fd4ec4e56f83781ab9dee91ba99530a7f90d969588fa24dce24b094a28bdecbea80328cee862031a8b289f3e4f38ce7a

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      138KB

                                      MD5

                                      0e0319eacc7beefd394a127a30bda6fa

                                      SHA1

                                      00f229eb7439205e67082241ba619686fb3cdd09

                                      SHA256

                                      d89bc94c5876ab4a32a086bb5e94930e6f4eb297de3e7b3f8e67b85a274d228c

                                      SHA512

                                      17e05d72d30964cf58bfd5ff9cb71a6c3346434bf7e22002a600fc72a4ab7e4a1afdc2235f65e9fb24554cf56b091e62b3d5d2afd5df243a58f32be505ed7879

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                      Filesize

                                      138KB

                                      MD5

                                      1359c736e3519f6641507969c866fcb7

                                      SHA1

                                      a136a289677dbf4a917608f1a431b923f7d2f6e0

                                      SHA256

                                      36ba7b4856f31a2fcaf7081917d9f3baf752811da0c317095a4d3f02b3390b9f

                                      SHA512

                                      b4a8734bc134eab989773afa220142515316ec12ced722c7b239e9fb8eff055f6891e73c1eca39c9c13ad6f57dc6b5c05d1209dabfce27fea39345deec5b6fb7

                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                                      Filesize

                                      264KB

                                      MD5

                                      58a625cf63c3cf0b7f28adf00b70e071

                                      SHA1

                                      3d5e6268d7270586a2a062bcafc77b21aa7a90e6

                                      SHA256

                                      e88327d4ec749296e043986b72e9718955a6590c6f9cab348d9cf32827057db0

                                      SHA512

                                      1de26f6b0f076f1b94063ce3bcaa3a68d18ea8470281dc9ef02881098631d63e8335ec66459379b011e4bf282142c662d21fd1dc9b4817e2e33f1e08e5581d2b