Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    137s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    11/07/2024, 19:54

General

  • Target

    https://s3.us-east-2.amazonaws.com/scxweuyfgbfbhvxbhcjvy/fiuyjmkhjsdsywusdfhjksvdfjk.html?{an,31#yNkfXKjxRFJGGPCnfDGnvNvFQbmVno&4EleOllKyqV&127679/198/wrmwepdpyo.home.php?sq=1590-331270&lk=256860-18&page=107

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://s3.us-east-2.amazonaws.com/scxweuyfgbfbhvxbhcjvy/fiuyjmkhjsdsywusdfhjksvdfjk.html?{an,31#yNkfXKjxRFJGGPCnfDGnvNvFQbmVno&4EleOllKyqV&127679/198/wrmwepdpyo.home.php?sq=1590-331270&lk=256860-18&page=107
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc9935cc40,0x7ffc9935cc4c,0x7ffc9935cc58
      2⤵
        PID:4996
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1804,i,15201331538415769012,4832633320214568918,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1796 /prefetch:2
        2⤵
          PID:1124
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2036,i,15201331538415769012,4832633320214568918,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2100 /prefetch:3
          2⤵
            PID:2460
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2172,i,15201331538415769012,4832633320214568918,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2368 /prefetch:8
            2⤵
              PID:4408
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,15201331538415769012,4832633320214568918,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3112 /prefetch:1
              2⤵
                PID:2284
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3076,i,15201331538415769012,4832633320214568918,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3248 /prefetch:1
                2⤵
                  PID:4208
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3524,i,15201331538415769012,4832633320214568918,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4436 /prefetch:1
                  2⤵
                    PID:2192
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4620,i,15201331538415769012,4832633320214568918,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4616 /prefetch:8
                    2⤵
                      PID:4072
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4808,i,15201331538415769012,4832633320214568918,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=740 /prefetch:8
                      2⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1740
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                    1⤵
                      PID:2784
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:3352

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                        Filesize

                        64KB

                        MD5

                        b5ad5caaaee00cb8cf445427975ae66c

                        SHA1

                        dcde6527290a326e048f9c3a85280d3fa71e1e22

                        SHA256

                        b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                        SHA512

                        92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                      • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                        Filesize

                        4B

                        MD5

                        f49655f856acb8884cc0ace29216f511

                        SHA1

                        cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                        SHA256

                        7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                        SHA512

                        599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                      • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                        Filesize

                        1008B

                        MD5

                        d222b77a61527f2c177b0869e7babc24

                        SHA1

                        3f23acb984307a4aeba41ebbb70439c97ad1f268

                        SHA256

                        80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                        SHA512

                        d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        120B

                        MD5

                        f46c54a779b2cc8feab7a7cda3c2db45

                        SHA1

                        65b0054199eb4bee57d0144f14cba9ede8e4bbc9

                        SHA256

                        fc75a3dc8e803e5806a37a55e5ec9cd1924edf0a36f072490ab6b0f927de36a1

                        SHA512

                        fc5a38dabf1f5953fa9546e636b402b43c20e02deb91a479a0336d8cac2441772406c16f73fcb15a1435a220c553c0b7ae7757ca4068d83b1cd77cc75364b5f6

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        1KB

                        MD5

                        e38beb09499c098006deb28990c356a7

                        SHA1

                        22fafae8f8a5533c51fe28f43026ec83f3df87fb

                        SHA256

                        68d8bd9324ee968ee2369f9bf5744be3db3046c364e031c37bbd284ad576eba4

                        SHA512

                        fd43363961ff724bfc3993409a81a66eb352afc6b3e0bb0e99bc70f10e29bc7b416fa8ee066f969dcf96febf762f934d227ec475b0da8750fbce3b28999d152e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        ca1e4e3ee263bacbe671c07e64601be0

                        SHA1

                        8d343f9b2465e7bb7f19681d780e2cd901dc2882

                        SHA256

                        efa7ab67e129193fca4c03de446a12741f6cd258d7c226e5bd27306049ccf28a

                        SHA512

                        2721bd09498c44affb759ddc4d2d922893be585d12706817adf8490f164f67d6ff981865c2824a2f35c4b345b8a4a48d031a20d489c42a5391456e8d23ac080f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        ba31dbce935a3582a2e618778eae973c

                        SHA1

                        8a5cbd9b44c3b51e39e7f58f64f1c1d319d6a6df

                        SHA256

                        048ce528236f11445a00269b39056f75773fa1c1ba0dbe6ca4000850281cb4c6

                        SHA512

                        8052fb56b1a169a6e8aee549fcc0aab45f803cbba2112dfdff5ca16f68f4269ea40cea7a307cb68d1aebf5fde9472d7e394ae0eaf154fc26f09ee41c322021cc

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        16e0cbd83f1662f20bbb78994e76392d

                        SHA1

                        22ac0f2a8af1d6c813d143615f090fe5d0e1a187

                        SHA256

                        224c53bbca7db3d9a13835b4d276b5a38e3242a4acf5087be91bdcd2c16fb1a1

                        SHA512

                        a61ef03e8c34bacfd84555264e9860fef823a3405e70b8232bf4113086404a0304bd94af737e2ddb386fe2e0a6c3bd022c32d595dd7c793ae94fc47c83400050

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        13d788fa29cebb64289c7b8a49668287

                        SHA1

                        1d4d1c831e291d0f5ebf232f2b1084c4f812681a

                        SHA256

                        ae56a1c2b51a27f7ab625aeca112f543b77c5746fb8e9809a3d7475ed81044a9

                        SHA512

                        d1afc683db558259e708bc0f06cb769fb375a6d173589802d4e2002c17e25f88f0b7226c06a5c3cd20f530885542354c82b50068be2ee13f85a4e8e621c21b38

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        34a21fc5d5a8906d2381bcfe79c9492e

                        SHA1

                        bb454e7cdf91f4b46dcd1460475fb1aa7ab219ff

                        SHA256

                        585468db0b04c084e1969ab7bcfc9436218945d6c8c7628493c9b11e44c1d0f6

                        SHA512

                        0d8566a80242dfe2f45b1b242705687358614e4aed5e55534a1a17b82294df1fb59d6b0b74bdf7c99c8aa7b7ecb1b7d13af5c33a8f2bf5cc4eaacb5fbb55435b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        92KB

                        MD5

                        28f1734305f8ab5641d75fe6ce2db7ab

                        SHA1

                        1fc523e1dabbd101a88a63215a2a5c8ec812b6d9

                        SHA256

                        ff9e47ed2097dfbfbefc90c10a91a89bc97a3a11a8d1e74e74b6802491efe6f6

                        SHA512

                        05ec962f892770ffaf13ae2ed029740cd30be483c00e58c3ca987aa42482d74abd57329a87272cc07c1140168f7e1333865560c5af27fbcfe5a56974c5ca5526

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        92KB

                        MD5

                        1493e21b34adecc8691060ccd3b4fd2c

                        SHA1

                        3cd1a9325caf9b7db218f86fef14ea23bad5630b

                        SHA256

                        098e35d8a174725648bea1bc0534818b8f1a6344aad4eed99ad0a339ea2e77c4

                        SHA512

                        7b87072f584b79010fa8b868f66bb99ea18572576fdea752104981bde0bf1fa4529b6b793fef9166b79d037e5eb67c1cda69b5fa4478605f4e44fe96d098b623