Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    129s
  • max time network
    129s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/07/2024, 06:58

General

  • Target

    http://url9769.emailers.drhidoc.com/ls/click?upn=u001.bNj3ncfMZI8ZrtBxmfs-2FLOrZhyBB9SLSHnXYZ5FIjYXgNVW1BKM3pXn5Hw9NFK15ugGu_yWPa6EhGqZEkp8-2BJc-2Fh0znDtuCWaB3RHRr1G3nBgfD3VGgtEnlvw1nWWQnsiev-2BQdCmsvjAsQFp5dSuaaXzdMoJ8FDgR8uBnsd-2FIdicH0x-2BrGlK7uumrxnFnzHzp0XETm93bL0VkrJQXywF9Na-2BcvkJgxUVyyC6UtuXFjCTwsQZFCcE1JgZFp-2B8ZyE5LhPW-2FFXCEFGbA-2BYvGWuitZl6neg-3D-3D

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url9769.emailers.drhidoc.com/ls/click?upn=u001.bNj3ncfMZI8ZrtBxmfs-2FLOrZhyBB9SLSHnXYZ5FIjYXgNVW1BKM3pXn5Hw9NFK15ugGu_yWPa6EhGqZEkp8-2BJc-2Fh0znDtuCWaB3RHRr1G3nBgfD3VGgtEnlvw1nWWQnsiev-2BQdCmsvjAsQFp5dSuaaXzdMoJ8FDgR8uBnsd-2FIdicH0x-2BrGlK7uumrxnFnzHzp0XETm93bL0VkrJQXywF9Na-2BcvkJgxUVyyC6UtuXFjCTwsQZFCcE1JgZFp-2B8ZyE5LhPW-2FFXCEFGbA-2BYvGWuitZl6neg-3D-3D
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffc8dcfcc40,0x7ffc8dcfcc4c,0x7ffc8dcfcc58
      2⤵
        PID:3440
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1924,i,1369132420328317804,6734577258718761838,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1920 /prefetch:2
        2⤵
          PID:2608
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1904,i,1369132420328317804,6734577258718761838,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2112 /prefetch:3
          2⤵
            PID:2880
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1600,i,1369132420328317804,6734577258718761838,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2468 /prefetch:8
            2⤵
              PID:3252
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3036,i,1369132420328317804,6734577258718761838,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3048 /prefetch:1
              2⤵
                PID:916
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3040,i,1369132420328317804,6734577258718761838,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3296 /prefetch:1
                2⤵
                  PID:1552
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4316,i,1369132420328317804,6734577258718761838,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3652 /prefetch:1
                  2⤵
                    PID:1052
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4664,i,1369132420328317804,6734577258718761838,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4796 /prefetch:8
                    2⤵
                      PID:4688
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4960,i,1369132420328317804,6734577258718761838,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4944 /prefetch:8
                      2⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1664
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                    1⤵
                      PID:2560
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:3964

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                        Filesize

                        649B

                        MD5

                        d0cde912df3f199ae609760d0929cfeb

                        SHA1

                        9c0b6a1d45208c2663aeee7141a2ee4c29195036

                        SHA256

                        5755c042fb2ad90f4cc0a0962e9971bd67001a8000ea2911e970dc9fc299f07b

                        SHA512

                        51985edf584f1a5c19dad69b13a345117f632cf97f1ed2df63cace0d0c226f141ec84467c192443e30f65dde7eb275e3c6cb161cef33b93d31947311cea81187

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        456B

                        MD5

                        8422222ee322c71ea46ea91c5319a82e

                        SHA1

                        10f7880e0c1c9c34605c5271e65caa3b85db5362

                        SHA256

                        6d4a724ed8ed1d8fa5a1fe67143c1f9aa9fac97d8d5287c728c540f2ff8d66c9

                        SHA512

                        ae918682aa219e0491ebed5a31e4a7c7f70e4508b594bbd5863465e022cec173385702818c38265860605ec2bb5b454105afa2b345e47effff28766aaafa8d86

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        720B

                        MD5

                        b6e31d8e017b9f7d42c131fcfe7d6648

                        SHA1

                        17deaf685ee90eff5d1dfcc5750b2eb85dd053fc

                        SHA256

                        f7829fb0feae98f1e966ad4c70e35039b72e8ba1e746c9acaec75824cec91d0f

                        SHA512

                        7985127cc2693135b89a570c4bf81916d08abcaa14d5725602f910ce825a6d3de172857c44d6a3678003488b18f811949781e0d321f8b48fa59a18718a98fad7

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        4KB

                        MD5

                        86f5c37792a78aea4a6512967b41558c

                        SHA1

                        c74b47e0489ac656754faa1f0bdce79e5502dbca

                        SHA256

                        60b43d0daa2d1455bd6f3f687f186f500636f08eefe1090ea888c5e71161c001

                        SHA512

                        5539114e3eddf583eee624cec61843281571244037eb86fe54009230837cb95fbd685f91056cbb5d088971af28d8ef075640606e94449f3e73c4800e336a7fe5

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        d25172e41d0cafe3300d7822d2189f07

                        SHA1

                        c027ba79d51ac9d5477849836c522931b80a94f4

                        SHA256

                        fd4148192d7fa6d102381fcecc6faf7c4577ff7465fb15b47726c475ab930c48

                        SHA512

                        af003bc4804af706e0318372b5cdc770e58b4a0bea5cb0571e466223af518374766491597d27f8e7b9a9c6a279419a9f8ba346dff7700f7c834146aed3d910f7

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        79bd07e97f7a51f52da1d23f9f79eb85

                        SHA1

                        51d8bd0dfbe080a0a7495b04eeceba7525d7e95b

                        SHA256

                        ad674dcd165f28c88cd1ff3f55a99beae59aa2a55c0a0205a1ea080121862a84

                        SHA512

                        e553571a752e27d8858483cf1fbdd064d2cd9b2a7365f1da4c7690c4e60e7fc48a7b18b56ff1358a3451ebceb91dadad136adf6708eb8ff16b36d0ffc6d3db57

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        434f1bd0de7ea4a264389152359a5687

                        SHA1

                        b79f4a56d0c6a48098301326600805da74ecabe1

                        SHA256

                        7b18d2382d8bfc2428931a28da0a0dece93aab317adbf58a4e630f7b8d5f7c10

                        SHA512

                        0cda30e26e6d3b8dfb1273ddaad4d5b6ea11291744b6ebf0246087748067c6733e3ffe8f9ade4b4cf2c47bdfe8fb31ad03b064954a9c63967058a466f6c558ba

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        a499d1993ef712e83eca7cbbd71bfcaa

                        SHA1

                        dae361e1b2baa5041d5e45f1577d57cd01d2696c

                        SHA256

                        6d9a6931a75fff35aa04ceba6c90abd29136bcc59de5d85a9be0f05371b9456f

                        SHA512

                        89afd58b70b4056e17dbe801691575b9c9aa7932366072379fc4f8af49c7fe4092b7858ec0533be137243a5166b6d62bb89affee0159f6f4c036ba9da4abb7e5

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        9ed53a47c2bb1ff0308780f122ce9b7b

                        SHA1

                        e3f3b81e8dceb35ee30b5fdd15d9295b7f501c01

                        SHA256

                        5f44aab066937fce51b2cd7f838a2fbfc7cc688799d1fd7a8a85f6cd3dc48d58

                        SHA512

                        2ae14f2071aeb5b45bdcbae689a1e8a05a90e1c4c0fcb2b26cc40fb499cc165a957999a0d0ce4b243274ee1cdbb25f48381054209250dcf7d006656e1ad72ec3

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        7272e085558eddd4100998bd515ebfd7

                        SHA1

                        e0e5272b0bec6dd6a1e628c4f7002161a2c09c12

                        SHA256

                        594f618653753bbd891c504f3930a4c339a359df508eaabaaa29657950373655

                        SHA512

                        438013c7b81e2c4163dab2758a735969c63feeedba5792f62797db7186d87234596dcc02887ac004812e6d527430ca460ba5d1b092045d7d20a4570c89d8f56e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        b1d5402b062d3cfe2380c670a42721cc

                        SHA1

                        e2bc44e2876f0df41f0aaaad48b87ae36506b699

                        SHA256

                        4e13cf8e91b3c37cd098543303b0f934774e4b30c0cac867239b0eb8a591f681

                        SHA512

                        aeff45c04d7799b2b76e12aee66842afb32cf1e844d2cf16fffeee2470f3f0c45b5efed4af9204c13fd4b39852440fc357d7e2ac7d2867f4b3a7ba7069bc438f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        30e449e0d9b19f5d59ec3dcc67a83927

                        SHA1

                        0c4fad743fa69511982760d4c70de6a65301af5b

                        SHA256

                        e730906afe0317d6667ecac259dbcf286d46d890507fcb00fbf7ae66bc5ce750

                        SHA512

                        eec9884807db3a0f7e7eb5b8c394c5286d9c09386125df199c382598977d9f8c58b66d89e5937e84aa301629f62476d9d697b74ed23afeb67233b8bdc2781878

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        0fb6e87f71bdb8c8788603439fe97578

                        SHA1

                        aaabf9d17922dec70cb92ce0abfa88b90e30e2dc

                        SHA256

                        0d84938fedb12d7a9feac999d05fe3b3b2faa87141cfc55b9db2f5d547dcb4a5

                        SHA512

                        b7aafd8be3bc648b91ae6474f351ad4887f5ef708cfe254fed198c16b13f03d5e83a1afe505ea5b1e78df5238e89707c06f2a6e49977dd888886ccb47b11e394

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        842f3a1f6384abd66c4a8bf7c47afbc6

                        SHA1

                        e5d17a4aeb310616daba7e7cecd555a2f7281e5b

                        SHA256

                        f81ad7fecb9f8cd5924826c8072fa0cc3eee73488fee6597539fb5ee98534372

                        SHA512

                        6a4c322fccecb5510346aba10852c8934f9c47d883de2216370c861491a11541c42c7e2e1fddcebf2a199defd31a447bec02e90db4d110850ec8c81ce53ac096

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        92KB

                        MD5

                        4bf5789ece11b9af323d76fa99d55a50

                        SHA1

                        1e7a7ffea13adc0dbe096f98805d0bad392efb34

                        SHA256

                        93d7c8aa3b2ec8049d236971cd6881680516791023de3036b51c3b5b793f4a24

                        SHA512

                        8343d339e450ac4a236f9db1fc9a35d96ff42d8b55bb39963dc8c7a59a1e41cd92fa0b6685fcdccb342a93638fe0fcfca2f91f8d188edbbaea3833e17106a007

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        92KB

                        MD5

                        332e4e0ddec9bd6896a84151e9ac8451

                        SHA1

                        46ab815db22980f37d86840cc91e7fe9217251ba

                        SHA256

                        a07b3a47a28acc84d22142e72a892e96e6e14eefa67e5b8a7cf6e6d82414d0d1

                        SHA512

                        bc68214065cd796f52b6cb199fadf2e1cc3d5310e0e5d9fcf33a0263e80821209cdca68d52a68bf3ee0173a52884e141faf5b8ffd7dc4a4d0660c35b066bb18c

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                        Filesize

                        2B

                        MD5

                        f3b25701fe362ec84616a93a45ce9998

                        SHA1

                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                        SHA256

                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                        SHA512

                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84