Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    21/07/2024, 14:58

General

  • Target

    Saic Tuesday July 2024 2.html

  • Size

    489B

  • MD5

    558a5793e054f1f0eb6df36858198e88

  • SHA1

    80f775664ea167ca7899cad1e9a27b659443e616

  • SHA256

    0aa5f295edcbb6c72e08d71eadadd1283ffee03422485df34cfc0c42673985a7

  • SHA512

    9c45fce7858ae06bef24fdf0f91a4d4a093f188edfb9435034fce3384ff108bd8b3c1222566f1ff9a9c125d42da717cd606d472ec50a3bd1a6301d659dab00ea

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 28 IoCs
  • Suspicious use of SendNotifyMessage 14 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Saic Tuesday July 2024 2.html
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb90c3cc40,0x7ffb90c3cc4c,0x7ffb90c3cc58
      2⤵
        PID:432
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,5589387363698306847,17971509346940697971,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1788 /prefetch:2
        2⤵
          PID:1688
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1796,i,5589387363698306847,17971509346940697971,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2076 /prefetch:3
          2⤵
            PID:3012
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2088,i,5589387363698306847,17971509346940697971,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2384 /prefetch:8
            2⤵
              PID:4456
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3048,i,5589387363698306847,17971509346940697971,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3096 /prefetch:1
              2⤵
                PID:3244
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3056,i,5589387363698306847,17971509346940697971,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3124 /prefetch:1
                2⤵
                  PID:5112
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4496,i,5589387363698306847,17971509346940697971,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4508 /prefetch:8
                  2⤵
                    PID:1548
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4844,i,5589387363698306847,17971509346940697971,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4832 /prefetch:1
                    2⤵
                      PID:1492
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3476,i,5589387363698306847,17971509346940697971,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4880 /prefetch:1
                      2⤵
                        PID:1440
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4940,i,5589387363698306847,17971509346940697971,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4960 /prefetch:8
                        2⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        PID:540
                    • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                      1⤵
                        PID:2036
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:236

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                          Filesize

                          64KB

                          MD5

                          b5ad5caaaee00cb8cf445427975ae66c

                          SHA1

                          dcde6527290a326e048f9c3a85280d3fa71e1e22

                          SHA256

                          b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                          SHA512

                          92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                          Filesize

                          4B

                          MD5

                          f49655f856acb8884cc0ace29216f511

                          SHA1

                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                          SHA256

                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                          SHA512

                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                          Filesize

                          1008B

                          MD5

                          d222b77a61527f2c177b0869e7babc24

                          SHA1

                          3f23acb984307a4aeba41ebbb70439c97ad1f268

                          SHA256

                          80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                          SHA512

                          d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                          Filesize

                          649B

                          MD5

                          ababd1cd4fd119368c204febd76cf1e9

                          SHA1

                          e2e6a6ece4e840fd84b404b053d299500e7cf590

                          SHA256

                          022bf13c9fb3b742ed7492aa1d35fc70836bbfeaacef6f313f54b3420aa00965

                          SHA512

                          3b8b5e527cbe26df245b895d6aedb048d69f0c50b36dbf1fb62acfd6b9fa1cf9f8948e3d08e04f666afc9f5e641e7e7011a29f3adde6f8def93ef33b66fe93bf

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          e81a35ab3009361c967fcb10cc7080b3

                          SHA1

                          f3207e3aa0873d338043aa874b075c3530a45583

                          SHA256

                          b8065549c21036ba0e682c11d3f02bd7d52f3e0d29fb8b6feb530bbf75589e7f

                          SHA512

                          727bcea1dee3fe613c07eb66359e0948530a0fa08af836c4c286b5e9c664e570f821dadb33b5ecaf5bff6948bcb16a6ff83fd340b0b310e5dab799ed2518da7a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          8KB

                          MD5

                          9dcc06f206d85e29fa14ad5f22df74c3

                          SHA1

                          166479678180df18e0ce312dbcf0da76fe92a9ac

                          SHA256

                          14a2aed31b1bdbf97d07d96daaea6c60c2c3e8c7d4ad8d609d3205b7c0ed3855

                          SHA512

                          9ddfe36b6f01de239c03d12a3d00fccade7318af92e03d9e352797fa3fed18eed78e7cc5a8d3b2d33a44e021a83e481bdf1ef484768529c9972415f82e0a3847

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          354bd1d500bd429bc12140bd9be4bd14

                          SHA1

                          9db0383debed138734d4f4f2e9dca9bd9394933d

                          SHA256

                          4df929d5eb983a05396d99a11677db1a6a7bb2d6fb0c6c5a5c6baa21457a2984

                          SHA512

                          32526b5b22581f372e6142e53c3167b69158eaf3ac8ed8b313111ca7b213673f6dc72cc5143ed5937b86a4b344bc4f9402dfe8de2f9eba2aee8882b6ea0eb7e9

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          79b75d12661712579b7e8b0fae114751

                          SHA1

                          82a283a3adf264ecb73f1d77f44d96fec2e907ea

                          SHA256

                          d704965afc4af602f0d8677a9707c830f77ed675a11372deade42f4a8b9ccbe1

                          SHA512

                          f017b1169351019518e54cb9354042788d54b888615a94bd36a14b5c72ba026736be5add68aa0d30218bc5d127420a83b61436a5c6680c08ec300b90ca2db567

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          3d6f5935e94959b09ac0316d193661a4

                          SHA1

                          25bbc654d0a85018898da5ce04049aa54f3ecb58

                          SHA256

                          9abd30751b5c6af6c0ac60608e23382382096fd164184b0dd44a5bcb24cc15c0

                          SHA512

                          1349aa6ecee124a99887cf288d5df42085205c043affee9b919ea33594a79c8a26457e5107c2dcc26cd559008d85bf5754bbe78b0a4a51d07b446410d4cc59d7

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          97f4ffa755458e4cb49e0ac044477327

                          SHA1

                          0d584f9a5d097ad61fe6d041c710a9c36b1c81b3

                          SHA256

                          f8f0c3316e35b48e4103470bb2396ce5bb6ea5efa09b667297b6dcdc9c5935bf

                          SHA512

                          0742d170ebcef8d0a728c5db53a278fe1fc21b22fa9e0c7c1c9ed90173b923889e344cf8eed9ad04ca81674ccc8ba882107ea5b2bfce09bd8616b2b1ef646936

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          80c31374e3a3d3ddde052a79c3549e8d

                          SHA1

                          537f5806c444e09d51d009cd1038b6bc8662a66d

                          SHA256

                          4ea6f1137dc3400d8a16357ed9705dc466962042fb50e6e595c72509bc2304ea

                          SHA512

                          dbb14015000f9c78cdbde090b409fe381a818b70012768ffba19a189c3b996dd9ce95ab6efd0f47684c475d086f89ba3b2fcabba335ce46db333a562bf57fe82

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          78e804211de9be8f1cddd9fab9f2968a

                          SHA1

                          f7440a9336abd438a64f9f904996b440e345df2b

                          SHA256

                          b48bd710d916133238e2e0ec4f46f12d6def0612fce83e7daff595be8d382d23

                          SHA512

                          7858c16ab695560c248c413d2d4b9d6f930c58ad69e90d744872859a5586c2514ed224f279b6382f6a1b4a73e0bf6d730288b57281a58c7ddfeed20554151ba3

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          92KB

                          MD5

                          4887d6106567d0edadf8da340f06d3e9

                          SHA1

                          33e5d5d2d31b9555bdff2b5085312d4012c2b758

                          SHA256

                          2556f9f0fdf7a62bf13a991e7334eef18e9c576afa9ca85a335cabeac29f4ba2

                          SHA512

                          843e6a2166df5b2f66eefb624be3648a94b35bbe9dcdbefde8b432d23106c342820fce3e53052e6218a217253ffa07864271e5590fd14a3b3e8db969d33be49d

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          92KB

                          MD5

                          7f6cadffa9220c2fce6a977c91726bc0

                          SHA1

                          46c1e69acdf9163761be33db4add839ad36514ed

                          SHA256

                          eefece65e556924aea6a141a6ceebc2e20a9f957ffab00d3a07efbacdfbb556a

                          SHA512

                          a257d3285fccb2245712f87e19660c7df75338e83be3f0cf78cb754fa9000030e36c6720537cf8c2188c2f10f0b3a41eca2d6172304d7245f784973667e48505

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          92KB

                          MD5

                          e0fadbe8ae80a23f8408fccc8243f503

                          SHA1

                          6ab3261a4b4f0690471b68dd704798df210ad3eb

                          SHA256

                          203ce985801e027c01938afc66b0783129623eaffc95a8d683ac0bfdd5d3cc44

                          SHA512

                          58d589a41c79764c9b729f4dcdbfade26681515d122dbe6cf6a122b7e146a63cea70276a3262d598b022b761fd2e9efab4aba8971777c530aced93637b3a1697