Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

15/07/2024, 08:23

240715-kahlrszdqg 5

15/07/2024, 07:59

240715-jvvldsygmh 1

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/07/2024, 08:23

General

  • Target

    https://bit.ly/3Ljov8n

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bit.ly/3Ljov8n
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa560ecc40,0x7ffa560ecc4c,0x7ffa560ecc58
      2⤵
        PID:5016
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1848,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1844 /prefetch:2
        2⤵
          PID:2280
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2196 /prefetch:3
          2⤵
            PID:3960
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=376 /prefetch:8
            2⤵
              PID:848
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3144 /prefetch:1
              2⤵
                PID:4124
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3180 /prefetch:1
                2⤵
                  PID:1056
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4596 /prefetch:8
                  2⤵
                    PID:1564
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4872,i,4384998907042505082,1170400102487492567,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4884 /prefetch:8
                    2⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    PID:3212
                • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                  1⤵
                    PID:2020
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:1448

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      120B

                      MD5

                      69b532a5c8b3a57111ad9f53d937aaf6

                      SHA1

                      bd7f2cb70ad86eaa10d084295bc0db255579ed13

                      SHA256

                      737c808a2e873ee4e4a8346b3d0c00a919f46c438a5f3a60adff22c4a00b5a7b

                      SHA512

                      dc3e0eccc9e0b57d07d656af2ddf87b3767ac6896791f489ae4deb86c26e213404cf86f47d98cd5b18309abeee351e939e7d21cd269427dace96416a5dd706b9

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      1KB

                      MD5

                      cdb3f1e590dd00687c79a85db46c3880

                      SHA1

                      219050259d014a633e93027290e7d9ad3f5b1c7b

                      SHA256

                      43607152c80aee14b7bd42a2879d02b27c99b26c0adfc5830dfbd22a2a25561f

                      SHA512

                      9353c0b6be574655c5d8b8bfe0140e6038bc145fabd64bbc19560da91b0e99f57809093756eb27472bb19a3d6cb28380842d10a52b6b7d859989fe8792d5e0ce

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      521B

                      MD5

                      4935af3dac1871bbf18e68226418ae51

                      SHA1

                      160cad3f5f46b978cf3ecdaab17414bdf721cafa

                      SHA256

                      cc10fb329dc940aab8790339389abf03ce523c71e25a9d3c24b3a015b872703c

                      SHA512

                      0c23fc876bb334dfc00bffebd9957ce0e270fee986529eb802005f2fa11a998d3af841dece60ad5b5cc934706c257d7d9d41cc46e51d3284069c2f3ffe0bbc85

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      8KB

                      MD5

                      9e1887cf4f5e992a9a80007c5e37a26b

                      SHA1

                      1027b461733cbba86e75bee3177c435129b80a68

                      SHA256

                      d28b2bff93c12bcd0a282a4e37666e6e5980c955870be322fc3c1ef125d0be29

                      SHA512

                      402a1b096e1f15c2f29e083de5d9d98d72465e5f31851100b5a3b1c8c4b20d7e5cb291c6cf7c64f0da0daed9145c226d0bf797c6b8a8a14419ac749b19ffec07

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      0a73eb3197ecbe47e88517222c7f0d7a

                      SHA1

                      7c59df5e4839421d57e49f9fa7afebdf4034ac35

                      SHA256

                      cf1bffa16cc6433a9fb01cae0b278f073cc9a8d6fb900e4e6ad2ca3667da37b5

                      SHA512

                      f53c31aa78385bcab7df76a8397b4b1e0b2053dc5d92ec0bf5c1a41a2257f10b2c50086dfb78dd4d4be06732f0aaef0edf4f76b3392aa3f13dfddbb8a3ec3e90

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      fbba223be50ddb194a0825e1ba81167d

                      SHA1

                      6cffe9fd022104b720f2a0eec8ad04e7533fe15d

                      SHA256

                      75a5f9f59b48ebfe0f65df182628eea392728e40bf10c34875fbe6ba010897c7

                      SHA512

                      579dbde6cf9913c69a35a42aa90f3aeb6b3587e2f0de4a061de1bd33dfb292763fd90af93d2f9cb46be9469de04c1d9b023c467d03b187f7c08681cc6950fe58

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      8KB

                      MD5

                      3101a2fe42faabd8ad974876d6c7f2f9

                      SHA1

                      68cd10af495760f2f4cbb7db2ec2e51db4061625

                      SHA256

                      a4fdfc1c185fa5573aca21bbeb2d06f0138b79a7dab4756e319448b49c655d8a

                      SHA512

                      468cadf3ef64cb72b670340ac0b9fe387f4f93e24fd3267e3ba1e5638b39480c520fe5de1ec8fb25ae98902e161312c445cc6a223a26fd6a25bd4216125474be

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      c27113d1ce870dcf79c74515e46ab555

                      SHA1

                      5d71f8dfb1620ac2baa559bdd1261ffdab0e47bc

                      SHA256

                      288338db8b14a54ac2427bd25968c9b0ac2bd709040eef1c97ce45887865513f

                      SHA512

                      2e2d1512d60d73c6873a4dd77d6e905dd9f2acd43d3558c19ed4d1d303a3037cfa8f5fb5998e7ac42e26e1be6cc7780e606e7f539484373e4972f59e129e5e96

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      8KB

                      MD5

                      67a0a8e9b397e34b1fb9bfa49fe2a7b2

                      SHA1

                      1ecf13bcd5002899f9e93dbbe995c39547ef53df

                      SHA256

                      ad6bc23d58ace21f5002dd390748cf6d181426c9dbdbbbae58f67b5747f095e6

                      SHA512

                      e2828c27419da5aac367ff08f8c9f6994cd3c44fd882972d72c328e785ed0a487a48cbd4371d548c76c2659b48f7eb9c5cf74586efcd3919059fb2666f715bb8

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      72d00451de5a349b7ddec63300a4eb83

                      SHA1

                      cff7e591af1b8c249396a06a33cb9f3b087cf2ed

                      SHA256

                      9cc07de51d111d4550d2ded78f99706a31a4ae5044256bb52934504a11fe5f1c

                      SHA512

                      da54d9859103573a06906fc3ab8073176225aac648d814e71993f2299471a552362a25faee0dbfd437207f34473a285e566d957d149f66d500d3c10ea42274c3

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      8692228ac995d3d5f556567437c3bee9

                      SHA1

                      61ed6d32de1bc23a12fd889bd345258809cd3d1f

                      SHA256

                      65c4c5e72fa5f76df381534b7d07eba1acd9cad02d2b816c189937f96c7982ad

                      SHA512

                      d62d2af5d9907c1e41d1a064d60c80071b40a91448f2585980ddc819869bbf7ce67e3d0557070cdee848dd4abbe1a254854017b6a6fcbc60fcbb49459f49834d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      92KB

                      MD5

                      12ccf9aadfa5130c96dc26d3b9f5bfc8

                      SHA1

                      7072775b004ff195109329fc6cc7e1107b15e659

                      SHA256

                      7e8c127d0ed0da9fb7b230ee38182352ac2dc9d1bc681c77e9e3d6fd4933d8fa

                      SHA512

                      421d2489041e59cf65f289b7a60f392e22cf55a5d66f05bfc2d0827b6ba90e352590fe6b47a42680d93fe7ca542136f1006edb49c3f7f5982a98e4ac79faf386

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      92KB

                      MD5

                      facdf0f1bf7602bcc4b514ef9a6b7718

                      SHA1

                      16496c4912e76a2478eb26f79da4bff1400f8a11

                      SHA256

                      3ff121d948ddcff7874bb0cddbf88b1cf27cad4e3ba321dd15be371ff7a451ce

                      SHA512

                      5527d8f0871fa102c3181722776ad113c70bc7c09b7b56fb7c432d390d9e8a2d4dcf421040c94e2508e99a16a3695d8385045ae9fb9fd7e4922ceafc0126a8eb