Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    158s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240709-en
  • resource tags

    arch:x64arch:x86image:win11-20240709-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    27/07/2024, 20:45

General

  • Target

    sample.js

  • Size

    80KB

  • MD5

    e00b16b73eb6d7e777f0f107b6accb42

  • SHA1

    ce909bf1d56cbcfe3acc5f9b91736ccf1fc36525

  • SHA256

    583acb3d504bd305601b9052c06f851d757e2e748163734b283ef80f432a6371

  • SHA512

    64da3659d6a55ae871cadb43b1c9dbc3624f07a02d6137b92fe42817f51a435f420441ace1923b1e65d33b17f2a7e957f7ae6d2a1575c247b69001713715531d

  • SSDEEP

    1536:c6QJFLCSwNieXvlQehNFZuSuWtWWxpRBXW/6ajepKjpcq3aEGk+NsAG6ZJsneffm:7QJFLxwTlXRBXW/6ajepKjpcq3aEGk+A

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 4 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Command and Scripting Interpreter: JavaScript 1 TTPs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\wscript.exe
    wscript.exe C:\Users\Admin\AppData\Local\Temp\sample.js
    1⤵
      PID:3640
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Drops file in Windows directory
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3760
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed8d1cc40,0x7ffed8d1cc4c,0x7ffed8d1cc58
        2⤵
          PID:3008
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,460016508473353649,3124798203124747304,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1896 /prefetch:2
          2⤵
            PID:2188
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1740,i,460016508473353649,3124798203124747304,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=1932 /prefetch:3
            2⤵
              PID:2212
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2180,i,460016508473353649,3124798203124747304,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=2208 /prefetch:8
              2⤵
                PID:3232
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3084,i,460016508473353649,3124798203124747304,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3252 /prefetch:1
                2⤵
                  PID:2040
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,460016508473353649,3124798203124747304,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=3292 /prefetch:1
                  2⤵
                    PID:4220
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4296,i,460016508473353649,3124798203124747304,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4264 /prefetch:1
                    2⤵
                      PID:4372
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4780,i,460016508473353649,3124798203124747304,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4792 /prefetch:8
                      2⤵
                        PID:4592
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4828,i,460016508473353649,3124798203124747304,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4844 /prefetch:8
                        2⤵
                          PID:4800
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe" --reenable-autoupdates --system-level
                          2⤵
                          • Drops file in Windows directory
                          PID:2796
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe" --type=crashpad-handler /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\SystemTemp\Crashpad --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0x244,0x248,0x24c,0x200,0x250,0x7ff71d074698,0x7ff71d0746a4,0x7ff71d0746b0
                            3⤵
                            • Drops file in Windows directory
                            PID:3300
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4812,i,460016508473353649,3124798203124747304,262144 --variations-seed-version=20240709-050124.519000 --mojo-platform-channel-handle=4824 /prefetch:1
                          2⤵
                            PID:4500
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                          1⤵
                            PID:1376
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:2688
                            • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
                              "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\ResizeCopy.doc" /o ""
                              1⤵
                              • Checks processor information in registry
                              • Enumerates system info in registry
                              • Suspicious behavior: AddClipboardFormatListener
                              • Suspicious use of SetWindowsHookEx
                              PID:1276

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                              Filesize

                              649B

                              MD5

                              194053ce0280037171a940ac459cf6b3

                              SHA1

                              33a34df899c43b6690953ab6d626e195167a84c8

                              SHA256

                              21038819fb581690611f931f30ca4a816c089af17f7eea1d2339ba8be7bdba8b

                              SHA512

                              5894aab5ed3c6d633017bd7c16dc6b142aa4a4c33df1c4d5e54eabe49e2df5ebf5e17def2d35e5546523b61d9243467099460f53f973ed98ed461016df3e5a69

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                              Filesize

                              210KB

                              MD5

                              5ac828ee8e3812a5b225161caf6c61da

                              SHA1

                              86e65f22356c55c21147ce97903f5dbdf363649f

                              SHA256

                              b70465f707e42b41529b4e6d592f136d9eb307c39d040d147ad3c42842b723e7

                              SHA512

                              87472912277ae0201c2a41edc228720809b8a94599c54b06a9c509ff3b4a616fcdd10484b679fa0d436e472a8fc062f4b9cf7f4fa274dde6d10f77d378c06aa6

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              192B

                              MD5

                              949e4885188e8efa451c56b8dc60081b

                              SHA1

                              40f76e3fec600bcb13d3fd91a534a3463a870fdb

                              SHA256

                              8ff5dc10becf743e3ba84dc6d8dbdcc5f0df2eb4e8e0998d0d18d39d4a8b696c

                              SHA512

                              2aba8fc2662de68e0b8a3dc1932c2181765de76096548c603f154da2f00716e6fa3015055179c268f15df36a5877c58e10abc46029765662ce7aca0195da9254

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              6bb71505ea3cdb033924893b045fb705

                              SHA1

                              374d2735d710d63b13e7a5989bb145c4e7d98264

                              SHA256

                              7f1be585fd1577a04c3d5f3ef9f9362a4fe5e97342b11a4c223710c377f1c5d4

                              SHA512

                              f5a6af04cd54f4a9a5a3f838b32523b77616891fcea705c7fe3b4c298f6a7c1366143e883b4156b40d3305e0bd9da30451665b3a80c3501a14c547cc0835f484

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              356B

                              MD5

                              70740f5408a98e9a46f4d5362d3c79da

                              SHA1

                              2ed3e00688d693de457400561a3de4ee05ce40c1

                              SHA256

                              e8ac4f4d068838b9a501637be470e10e5be7b0573c9b5004bee6415ed27bd7d2

                              SHA512

                              2e9b31692ece4b7a932a4b197901e5ed533ce1aee29a266d5045414f960da79e5c8c2578bc7719646c08cd17f71f0299d067b150ca02dc3b86cbc66478c6ec7c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              bbfd7f06074c6e10e4ca1707763c407c

                              SHA1

                              5ff372e8ffd70a9772485fbe2cffdbe6bd1f3cad

                              SHA256

                              31d66b2cd8fc30395b3c97db1b841d45c8fd0bfbc10b17f6ddfbe044c78b8c63

                              SHA512

                              ee7fae5ad1621ca5ca9533c5d28b7177bd89a7128d612e8882ff6f6774dd74008f36363f4869e9b0c160e3bbfa9020e54586bef5903d47489d76a6088b0bf235

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              2f88fc9903a45571a5e5b422bd326457

                              SHA1

                              bb712676b24cc83b655718f0a67fd836bdd38cd1

                              SHA256

                              3b51022fcf0bf842ab845ee2a8177958bf396b901157e65c7611f0a9c8a5d2ec

                              SHA512

                              6ab69dd1c1672cf9181ec2722ad71423d3d38446ac4294878b60e6a8f04ca9872319eba5849186346f0a099b90498b564cb8996fcb17023b5e4bdf59f10e4dc0

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                              Filesize

                              15KB

                              MD5

                              bc50324d6bdb583a9b3da58cb9d7e2b2

                              SHA1

                              8fc650183125620748187d6e4cf442c0cdae2f5c

                              SHA256

                              20b687dc3779647cfcfc3b38436cb4b0f80af869302fc93d3ae24390cde91409

                              SHA512

                              0c283cdcabf5062146093036b83bfe2a5bdeda33bb9948fb9d35ecbd9fd4f031613518371e7f0aa1de0f3e8431df083fbde11e85116c07e74446902f404e4da0

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              189KB

                              MD5

                              677367ca082597ad9d19168b87d5c59d

                              SHA1

                              e66bd02ca1d7bf1c494aafc2ebc6b339276cd1c9

                              SHA256

                              fe07b39f883ecfff3e48b897b57a300117b3709b5659858cb4ae9de2ab29f719

                              SHA512

                              08fef8d623edfb083c80611b3d729a201570e05055de7c54315eea2e3ff86b7aae0c48d3df5361c0a36b5cda52d806115c667e733faa2fd96edd78b136692f7d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              189KB

                              MD5

                              43776c7e49ca1e3ecbb39f02af8b2c7c

                              SHA1

                              d3f1f2937dc8b233e77af0134042cd1f24026f5c

                              SHA256

                              c50d77206cb5db41244f12aa132c7eec987bf970b5eff5ff0122fdaae0bc1485

                              SHA512

                              934c6c5822fda004aa35c4ef074ddd0ffe7661305bd5e6e5a3511e3cbcf81ad7a69f4be35d05da75044c55d327085592ccf82ef505168dcfadfdb0cd6bad067c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                            • memory/1276-187-0x00007FFEA8910000-0x00007FFEA8920000-memory.dmp

                              Filesize

                              64KB

                            • memory/1276-186-0x00007FFEA8910000-0x00007FFEA8920000-memory.dmp

                              Filesize

                              64KB

                            • memory/1276-188-0x00007FFEA8910000-0x00007FFEA8920000-memory.dmp

                              Filesize

                              64KB

                            • memory/1276-185-0x00007FFEA8910000-0x00007FFEA8920000-memory.dmp

                              Filesize

                              64KB

                            • memory/1276-184-0x00007FFEA8910000-0x00007FFEA8920000-memory.dmp

                              Filesize

                              64KB

                            • memory/1276-189-0x00007FFEA6070000-0x00007FFEA6080000-memory.dmp

                              Filesize

                              64KB

                            • memory/1276-190-0x00007FFEA6070000-0x00007FFEA6080000-memory.dmp

                              Filesize

                              64KB