Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1799s
  • max time network
    1685s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    03/07/2024, 16:59

General

  • Target

    https://gofile.io/d/JIizmL

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofile.io/d/JIizmL
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2820
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd62259758,0x7ffd62259768,0x7ffd62259778
      2⤵
        PID:1860
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:2
        2⤵
          PID:5088
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:8
          2⤵
            PID:2648
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:8
            2⤵
              PID:788
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2808 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:1
              2⤵
                PID:1620
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2816 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:1
                2⤵
                  PID:3008
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4344 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:1
                  2⤵
                    PID:3400
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4368 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:1
                    2⤵
                      PID:3044
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4988 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:8
                      2⤵
                        PID:2556
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:8
                        2⤵
                          PID:3460
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 --field-trial-handle=1804,i,5102463115480411904,9122884613755195786,131072 /prefetch:2
                          2⤵
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4576
                      • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                        1⤵
                          PID:4384

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          288B

                          MD5

                          7280a9bf376500123593981766b51336

                          SHA1

                          70441bdd2c901b247f43a71b5eb0c229b5a1623d

                          SHA256

                          fef7f4a354de68c90c7f225e5f9f3712d03eb2708b65fb96baf99b6b45281bec

                          SHA512

                          38fc418c93bbc8ac9ea38f22074e969f6aa570fb90fc54ad29b7618ec87c2df790eb01cddb213c5d56f40ad0bea80f205c90c2afeb7d841797b063e3049e9a8b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          b78f0e66f65efe7fe38c1660075d3381

                          SHA1

                          d6b073da60d355873d58fc7ebcad46f67379f8e3

                          SHA256

                          16b0dc7db2e63e2792ba940c1b1a1809e85c891543762ae4763d97ecc377c23b

                          SHA512

                          3afe37471d3a4318b021942270cabed89c7c7594322b8a5c07e1f359059406cba87a1580b0dbbe4237920f01ab2a66ad2e6fd0a0a019a9d7ca54414387745190

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          873B

                          MD5

                          671b92b073f266558bb8c2a9ffc70e26

                          SHA1

                          4b30c8d733a03ebe8aa5371e766dff55f5cb0a2b

                          SHA256

                          ebc2b14b51c9920ffab6f42aa2912ecc5e4a215b771a50a9b64b38942e9adbb5

                          SHA512

                          2ed278defbda183731e5c69d3238c1f029a7a5c8d8694cd2d832280cf9ad18becd3686e6065f0da6db32251c85c4414f6aa9a0aba8e8d11bb4cddbbe0b2088c3

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          0ff8f2646b83f8790c64c6bdb5e0f080

                          SHA1

                          42f4e28cb5ec03cb5503c7095990d72c89c2fda8

                          SHA256

                          3f6edece02bc5a49338bc71fef373473f4d20cd120e1a7b460b4754a7b6bdb64

                          SHA512

                          33c27831be2b4e9c8f66044a204421d60237fa2322f352441756df7b1b99f72fb8e43eefdb5517b3c5aa8c4cc377e88ef9a024040a436fc042800b61f24d917e

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          bf7ab549ba9356142de6be77e456044f

                          SHA1

                          7638ff1a9ac12d06f6d6b968b234dd43e526fc9a

                          SHA256

                          45d617e3c774ea22a8e09457b83c2e90236f25258ec0de3bd6d540b41d7b7536

                          SHA512

                          1fa794a6a76a3bc1e21db9229b5631750968268f9b359806b57756cee53e3345fe5c728749e73e44e777d1963b93214726ec419b0c46143db34e5bba914358e4

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          6KB

                          MD5

                          cd395efa5d3b1aece0b785992e71446b

                          SHA1

                          9c5c423fe601632f8626c0b0b66d4f41012e89c6

                          SHA256

                          f1fb51029cf600ff17039e82507ff568cf613cde28b909bdb50e21ef2e167aa6

                          SHA512

                          624423f03d6facacc109e2bcccb7fd9e60b61528832a6dac38506d15a649ca3074e1675fb347dcc58d6eb7e00292647e93ce6a359762aaa1e379537a8d901cd7

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          136KB

                          MD5

                          5ea76e7de2819d0ea45878e5728ac79b

                          SHA1

                          1c3f09983249c6b46305f31f0705d6db2b943e1a

                          SHA256

                          3e674d36632c7a41f8bd1bd826655229dcc65a1998bb12d6cc9f434c29df6905

                          SHA512

                          233baf5733fe7c65fec8a512454da15cff01d40339266fec1407c900b6ca1509803d65a611b369e249657f9d84db7e074576ced5706a3300d356c12705bbc52c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                          Filesize

                          2B

                          MD5

                          99914b932bd37a50b983c5e7c90ae93b

                          SHA1

                          bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                          SHA256

                          44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                          SHA512

                          27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd