Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    51s
  • max time network
    54s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/07/2024, 20:24

General

  • Target

    https://drive.google.com/file/d/1QNEtpMH4_-Ua9FLoiz5tf6Sd1ntGFARE/view?usp=sharing_eil_m&ts=66a920ae

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1QNEtpMH4_-Ua9FLoiz5tf6Sd1ntGFARE/view?usp=sharing_eil_m&ts=66a920ae
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:228
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0x74,0x104,0x7ffb1801cc40,0x7ffb1801cc4c,0x7ffb1801cc58
      2⤵
        PID:3396
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2088,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2084 /prefetch:2
        2⤵
          PID:2232
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1704,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2120 /prefetch:3
          2⤵
            PID:1484
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2260,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2276 /prefetch:8
            2⤵
              PID:2076
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3156 /prefetch:1
              2⤵
                PID:684
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3180 /prefetch:1
                2⤵
                  PID:4604
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4484,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=4472 /prefetch:1
                  2⤵
                    PID:1636
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4772,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=4684 /prefetch:8
                    2⤵
                      PID:3112
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4916,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=4352 /prefetch:1
                      2⤵
                        PID:1776
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5004,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=5112 /prefetch:1
                        2⤵
                          PID:528
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5280,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=5160 /prefetch:1
                          2⤵
                            PID:2420
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4560,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=5132 /prefetch:1
                            2⤵
                              PID:4916
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5156,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=5312 /prefetch:1
                              2⤵
                                PID:4188
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5048,i,18385985567280246521,15091294576606603430,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=4928 /prefetch:1
                                2⤵
                                  PID:2908
                              • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                                1⤵
                                  PID:2172
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                  1⤵
                                    PID:2508

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    336B

                                    MD5

                                    d46b3b92eeac3aaf0e5b8b48e844ed03

                                    SHA1

                                    a7b8be1485bea326a3744a125ea1ae1413d5d1d1

                                    SHA256

                                    e995d8d95f6445786f2a6d532f7a3cfb853aae610fd9abb89fce17d105c12f62

                                    SHA512

                                    73cf9ba25084af0997d1079d67428dd83b0b3454ae465e80e56bd83a9c18fa01775743c5e865a60ccfe6116d7a764e91781917dda95980d9a9c01989c5dbaf03

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                    Filesize

                                    2B

                                    MD5

                                    d751713988987e9331980363e24189ce

                                    SHA1

                                    97d170e1550eee4afc0af065b78cda302a97674c

                                    SHA256

                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                    SHA512

                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    7484b0f8ba9e6982f3cfd36309219f76

                                    SHA1

                                    9c494f166d656ed1ee1224044e76f3f588e4b064

                                    SHA256

                                    69b069cc17ab42189f9e3ba6b7882957b82aef1289b8d6643b6cdb8e21e03b6d

                                    SHA512

                                    6f664f02be27bb56b200646e3fb9df8b2068cbba007226eb1c19793c65b8aaf735a1a8c5eefd59ffaacbaf2573ce08fff1cf7b018e8f30a8afde2ab3f6fd6a19

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    2c8c23ce13ac6bf648de6ee450d5b41f

                                    SHA1

                                    94cd84ef8a13b117e3b264ca09ded1aa36a71470

                                    SHA256

                                    65688787d1a1c6cd00dc86f6e9a85be37b7112fe54cbc1006c8e2534947cecda

                                    SHA512

                                    c20a890c40256ae19ad9fe80b3e76fc2e1d8102097d9de208a3fad3850cca694894321bd71cb8ba5c20769ac5a7c349635b7bf8e41d06193cd980d6c65d8dd87

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    1KB

                                    MD5

                                    30df1d2dcfacb5bb71a9f8d8925e46e7

                                    SHA1

                                    bd8fcd6c506a4fdea5c6221353f5bff1f53dc963

                                    SHA256

                                    d63d9fb8b78a3823d8b0aba6b4c004de9de87043c704810c0a2f0edd08333a27

                                    SHA512

                                    f5a0edbadb77987dbf8d00eb5a45704ffe4d76d7b45a4dd3a542584a5048682795b5e00e2b9986ac508db45210959e3bc85fb3d9f6c2b15e29d3f834cb334344

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    45f18887204537046a4292eb125f03ba

                                    SHA1

                                    17856c897095994e101b0f1896c1e8d52d76c9a1

                                    SHA256

                                    c2744923067e34c676df45031b4f6f351a4066c9ff810dccf0f68a060697af8d

                                    SHA512

                                    6f6b45479b860b291310cb7911b1372d201ca9d9ad3b95bceba9d9cc254183191a7362da0e744840c5a709defceab99a42f9ec2051005e1ef621f5f7dec06e4c

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    8KB

                                    MD5

                                    a3a6af236360841c84cd38d93164e79a

                                    SHA1

                                    76fcec8f9595690ef6dcd011dc92a9574bbf4697

                                    SHA256

                                    56b6447ac173ded56cf47b22d795d8f4717c51332135ea398ffb157d167070e9

                                    SHA512

                                    28d145c356abdbdce14a484a6102be0a3e238797ebbb958d1053a778130eab3ac54cf902ee2a758d50c6602a6eb7d4be0634e560375609ef954c4e04ce112578

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    896e788c3d9daa21f8b63187d11ba817

                                    SHA1

                                    76e9103f65b2ac1a9cdadfdbf7e78da579531033

                                    SHA256

                                    75b0bd2278fc26b8a277c50decd6a8d42238d78c05f79edb97962ae882315b65

                                    SHA512

                                    65179b8ad4eba1c6ab4adf69c80f789f61f0b5b9288611f8b11c52972f76d66d53507047411b462cf0a1108999893a1174c1d61c4b670870e81be320f36cc4a5

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ff663ae7-670d-4d49-afc6-565acdb4daf1.tmp

                                    Filesize

                                    9KB

                                    MD5

                                    0c5279f8489cec92cbe1554cc1f516bb

                                    SHA1

                                    cb656a801cc83f1a0e1cd5432584b767055bff9e

                                    SHA256

                                    3057f5cb808854ab93dda3d69b9eb284cfe39f9b84e7059723bf52e81873176a

                                    SHA512

                                    deb448971549ce5abe2d2e615ace5943782a2007b4e927c3a698f6751464eba9e741fb643fd652c1b796770a83b8f18e8ef8e190b916f5690b0c3f120b35ce73

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    100KB

                                    MD5

                                    bc1a68205998faf2a52a19b928b8bd3c

                                    SHA1

                                    1f2afd1d35950581ca8acae096b64e76c55c56b0

                                    SHA256

                                    3a843c783562c0ed8dcf206020ed670bbe03f98c1d87038a06f7ed28829f741d

                                    SHA512

                                    02254e7dfe149b116ee4dc1ba365697b1558820c1a782892e136f4a05a9e8c6843175e96e0ef60d9b67c44e39e5392a622d3567918e69bca816933cb659958f3

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    100KB

                                    MD5

                                    c6c4c3030a0b034e5e9394f592276c95

                                    SHA1

                                    7fcce421030e4c8538c75dad344729c348fb07a2

                                    SHA256

                                    a1003783906cc9d387dde33d6337f8defe093555a3b6e6c5059805a421f4add6

                                    SHA512

                                    96fb82c63bc0bd67829d80f6e4dbe5afcbc5a3644b99fbdd48bffab79d5cb91909ef10cdc9d4ad01f755ee8e2d25a6ede1b3a753df401b4b876b68da1160ecb4

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    100KB

                                    MD5

                                    6b02c6bac66b1d4038057335e90b6d52

                                    SHA1

                                    bfaf230a3c74abd0e04750715db6f301b06610a6

                                    SHA256

                                    ec1a64816ee12f8b82e690c497f89c3e511a74e46837a58532a8fcc32147590e

                                    SHA512

                                    036be10fba32793f8946491e26ab52f21b0624925b872f85181c983ed4f41dd8e7dce7f658d1dfff99682644ce13c89176007c0d7fc3410e306f64d99456d6ca

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    100KB

                                    MD5

                                    8eff86e44b2a61225dd8832d982ef01b

                                    SHA1

                                    59d6f90785c6c96f5bf1fd49b1d597d633e4c88c

                                    SHA256

                                    528f2aa5d60a74c4d86a6a8a693712a7d6bd0fc6c77f2b873be2b91638e5b693

                                    SHA512

                                    1698578eeecc2c6c789e304e9c7f5df152dc9fbc032fce7c022e2bd474d3dbfe0639691d8002b9a12196b3a57fc511bad8baf6e57840dbe4ef78063f8d52a2aa