Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1799s
  • max time network
    1800s
  • platform
    windows10-1703_x64
  • resource
    win10-20240611-en
  • resource tags

    arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
  • submitted
    26/07/2024, 03:52

General

  • Target

    http://crypto-drop-btc24.42web.io/

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://crypto-drop-btc24.42web.io/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:520
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa94cc9758,0x7ffa94cc9768,0x7ffa94cc9778
      2⤵
        PID:4536
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1824,i,16663963226361763569,6961297585477779166,131072 /prefetch:2
        2⤵
          PID:3692
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1868 --field-trial-handle=1824,i,16663963226361763569,6961297585477779166,131072 /prefetch:8
          2⤵
            PID:2992
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1824,i,16663963226361763569,6961297585477779166,131072 /prefetch:8
            2⤵
              PID:4548
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2712 --field-trial-handle=1824,i,16663963226361763569,6961297585477779166,131072 /prefetch:1
              2⤵
                PID:1808
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2836 --field-trial-handle=1824,i,16663963226361763569,6961297585477779166,131072 /prefetch:1
                2⤵
                  PID:3196
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4600 --field-trial-handle=1824,i,16663963226361763569,6961297585477779166,131072 /prefetch:1
                  2⤵
                    PID:4596
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1824,i,16663963226361763569,6961297585477779166,131072 /prefetch:8
                    2⤵
                      PID:3564
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4880 --field-trial-handle=1824,i,16663963226361763569,6961297585477779166,131072 /prefetch:8
                      2⤵
                        PID:4612
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1824,i,16663963226361763569,6961297585477779166,131072 /prefetch:8
                        2⤵
                          PID:1656
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4952 --field-trial-handle=1824,i,16663963226361763569,6961297585477779166,131072 /prefetch:8
                          2⤵
                            PID:1280
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 --field-trial-handle=1824,i,16663963226361763569,6961297585477779166,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:968
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:4416

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000c

                            Filesize

                            25KB

                            MD5

                            96bb4acd55b9b0dbdffeceff9b75c4c5

                            SHA1

                            fbd67a0f9ff72ffa15ae340115e9fb4a7d62d717

                            SHA256

                            a971bd9e399ce1c6ac72c4430f38138cccdaf641669d3e195edca96c2fd8a43b

                            SHA512

                            d23746e66f5ba49aa04a81ad774c71a39ee4d397635714999b8eaa24163e02f5992924558285d1631d8ee6374906d294030614658cd618248af53bdce5585999

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            432B

                            MD5

                            e4227792bd1e4cada04d3094c9f839c0

                            SHA1

                            403c6d9d92d584f6d747e03e9040474eb0a29745

                            SHA256

                            fba25693a9bbad99646b9f289151aa1a7fb223a79a8827991c759deee6f3dddf

                            SHA512

                            bbab8f5c3ad0804047c927526a76c97641343a2afee7ae4ddc4010cfc600a5b68fcc42b72ed60242f4d226e2cec0edddbf02549a79b2b32519769575261ff1c8

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            73c2b830930dedfcc11668f77d95b5cf

                            SHA1

                            136311c9a17efbffafb5be8f0ea833e8dce8baff

                            SHA256

                            7559143fa46fd29e0e6114641929f1aa2eeb1e4cba739f77a7663ed4fab2383e

                            SHA512

                            29d8b46e69ba7015d9f0cac1b074988c95b79990a8edd904975150e9af55cd5ec8856fb0d4c3593ab1c6e882a01c1a87473f091416b43c3678e2e7b397d106d1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            490f92fe1a02248ab5b376b06142361e

                            SHA1

                            fab7a2a746586c685c6adb13d92153d2d8f39542

                            SHA256

                            0611cb62d48f151fc3f7250769c918f55093877e17711e22d8abb2c972a6101e

                            SHA512

                            ffa1f51b424a19b254fb611ff5d106454857e68dc6ec76cfa8eb01195dddc691976e1014d7d550b1623c6ca10c477229d111b29f75dd5d65ca2fe68d5c1b2149

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            0e9a2fc738336870a9b63439d54f00d2

                            SHA1

                            cc0867b27e9947a8a7152b62a73f1725e3eac8e9

                            SHA256

                            9a5547daeb962b0aad5c57fade67e0e4113bcfb38065278b60218f3b34b50189

                            SHA512

                            b93feca13a632d628e4319dfd568e0c0f08404c259743230f63c48e91d1f5ce10c8e9f16f7001c25624f4f0f0721dce7450bba7afb2f2341444afdfb8546c6b2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            e4420da615cb6e8da321dbb2e8a6d010

                            SHA1

                            4994918739cdc8538fd6ef4f8da7527d3068a162

                            SHA256

                            33411104e3d94395546dda291141fc48f244263a74acf168504b45c4d3e43564

                            SHA512

                            a6035423213c76e49acbc4aa8deed8df6aacdd5d63f9a343c1ec435affcc8d8e8bdf9fa45bb379f40fa77c65dc23a52642f4a507d88d0a035b5bc30c1a2bc518

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            19bad48dd951b1394cb20af0b8b78e27

                            SHA1

                            f9a0c3451dffb213cb8d60cd007f891d107e27fe

                            SHA256

                            f829f90032d18503b75bd3bc91c21ab9c41e3f35adf201049a3e0693c3dd1273

                            SHA512

                            78005033368744798a9991349722a1eaf849118e0928ee165977b9e8b216eb7a062cb74c1ea697d3101aee147f1114babe75a8c38250350b3df2a61b51438eb2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            f56183fafa26278d7be6e8ea5ba71f99

                            SHA1

                            fd38db7cd28469d674b58398b58ea9a9ddba0310

                            SHA256

                            79531d5dd5f03a9cbe9ce32f93744f300ba5c5a5a673031049dbb276784ce5a1

                            SHA512

                            b356cc493677f0f4a609c3c63548c2ee0b39c05c5bc2edb35067537cc6ebf0a4612466b2fe68256d07fe3a756e020d25761d1df601ac20e02bfcc0c1f82777f7

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            540B

                            MD5

                            f3895d0bd323a6f8820b865ce6965ae5

                            SHA1

                            72b0d6db4c594c7484d4df34bbd683a029a1e862

                            SHA256

                            b42f4a1e4052324b0937bf1eb04a5ce94fbf0136e045e334ebb402fdc5df1783

                            SHA512

                            3b85f7f4cd96e7b3d71a5492e0418a8d3572866960609442b8c5628fd3d4355fab4d53ed9a0be8bf3cb7f579668304d6793c2ac6eb911f192d4acd36de0c119f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            0a287b4e95d82792bddf244c9f68a400

                            SHA1

                            e842745ab8237a5e8e0a8af319de569774dea6a6

                            SHA256

                            a3ba64da14d4aff7e329946497dc1b5af9ba650c2fb4652a399cbe85a91f204d

                            SHA512

                            10dac63a4e0df5ecd6174504d8066bb28615dae4d10072d93dda79bf81ad395ea18a4f8806c635ee36a32b10960b8f0b1bc05ac57c71a4060e3f617c36b6bfe4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            5b900ce490e98dbd4e4be33981ac2ead

                            SHA1

                            f650b5cbea303be83cf06316088ad4c0b37a4d8a

                            SHA256

                            01400e7eb46bf2dc015ec4d794e69ef00a8b5b1818d5afce93789b18bda11356

                            SHA512

                            c8c3e20b9459c71b97d6547f3a3a166895e66e54cbc0e234fb667d60fed11a525be787f6c735f2995f2f6b1e6e1052ebb8ecb725c6ba1654454b03ce6614b699

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            5KB

                            MD5

                            0c845e59caa0c4ec976d8dd568dfce78

                            SHA1

                            e0b53f11e7854b89076bbef59ede15fadf5659bc

                            SHA256

                            8cefbff0b75e6f7f1bfdf3fc8423356f44a754d3a5f080c80ca7fbff10aa7dd4

                            SHA512

                            0abc1fa2f1231510abe622d3d586c662a16d7e616d35c600e92a8da22366e083fd5ec0271ba00a2061380dd3e08ae3cb5d6e82cf0b0372a792be716a6281031a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            168KB

                            MD5

                            e1769a71485d0a7c2acd15a7dbde5213

                            SHA1

                            dd70bcbff0a0076f1b3ec00219302306f0ea1a42

                            SHA256

                            2b317ec5142fc47c8eea74f8601b20c26d4375969fa092ba6737e3b84f6c6f9f

                            SHA512

                            679a18d39da02c5683b1a7bde2207d0f1bf798fd0fcd1132ca0ac3159e182a5f9009505a50ee248ba95fa2f62e3d9dd4cf44422045f27cc4c4e166ed61b1ebe8

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            150KB

                            MD5

                            91082e8ec2e685c249b86aa5bafdbcc6

                            SHA1

                            5f4e1fe87b0fac6b0a0facb0fb00b03cd2ea2baf

                            SHA256

                            90178bf13af30e8aec7ce10e70600e6f6e973a019605f4e36993f4ec5ed19ed9

                            SHA512

                            4e9cc41cb6f33ead5c41f07dbbcc8d494e15ddd43477abd55952f8dee313c39be3b9b84e0de9724b706458b1ac822ca8a061d44cf110a7cadfa543645f01d6bf

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            150KB

                            MD5

                            d3e3ab4dd165cbb7096dd743b37e222c

                            SHA1

                            f9cbbf42e9cd23fb02bf7db546eb4421aa920a5c

                            SHA256

                            151886ff362ab94a8d9f87e28b5fd2dbc1eada935a14e9ff95788ec9d164f211

                            SHA512

                            49f15fd8fcb5b744003a81eddc1715a2df18e536741ebca2617bbb8531fade2f4a95a2511ad7273f285dada7e1381ef7dbb366cad1e978083c18f4619cb301c6

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            150KB

                            MD5

                            23dccdd9897c359f013a10a26b619fe5

                            SHA1

                            98fed2bb3973299fa5d2313fcad95361dfaff5aa

                            SHA256

                            20ac42c1a873d46f119ce13c13d1a800c23d8146f58eb10d1f363f61574a03ac

                            SHA512

                            ec8939224d025f7ec1676376f8f6aea465c776bba7b25dc54c5eb0b8b3ab018b97d7b7725a497dc5cba2665155e0dc8d06800ff4b757173fc4b42eaa99e5338c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            167KB

                            MD5

                            498261d5bdc3a39feef3eb28a256f840

                            SHA1

                            b978e0530453c38e07af56f85a3d9437b69e64cb

                            SHA256

                            3d8d2d01c84fb7195e79772d77b789f50e19fc84ca546d12d913c053943f24e5

                            SHA512

                            c2bf1490ac3032cb7074f0d04d96e14d43189bd7c9c2c96ae05ca57540a5c0c9253c80666f5aa4e87274278e37eba2048065a9522de0de7ad678cd60faae2de2

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd