Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

31/07/2024, 14:32

240731-rwg1payall 6

31/07/2024, 12:47

240731-p1jnzaybmd 6

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240730-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
  • submitted
    31/07/2024, 14:32

General

  • Target

    https://drive.google.com/file/d/1CsXZEwXqUmd1cCH3lE1rIC1gEsgwkVcL/view?usp=sharing_eip_m&ts=66a96ab9

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Drops file in System32 directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1CsXZEwXqUmd1cCH3lE1rIC1gEsgwkVcL/view?usp=sharing_eip_m&ts=66a96ab9
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:632
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0x84,0x104,0x7ffc66cacc40,0x7ffc66cacc4c,0x7ffc66cacc58
      2⤵
        PID:960
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,13588015335231199159,3187094540840344064,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=1904 /prefetch:2
        2⤵
          PID:4824
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,13588015335231199159,3187094540840344064,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2208 /prefetch:3
          2⤵
            PID:4872
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2200,i,13588015335231199159,3187094540840344064,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=2368 /prefetch:8
            2⤵
              PID:5008
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,13588015335231199159,3187094540840344064,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3128 /prefetch:1
              2⤵
                PID:2140
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3116,i,13588015335231199159,3187094540840344064,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=3276 /prefetch:1
                2⤵
                  PID:4444
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4376,i,13588015335231199159,3187094540840344064,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=4420 /prefetch:1
                  2⤵
                    PID:1580
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5000,i,13588015335231199159,3187094540840344064,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=5008 /prefetch:8
                    2⤵
                      PID:3456
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4716,i,13588015335231199159,3187094540840344064,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=4660 /prefetch:1
                      2⤵
                        PID:1416
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=5032,i,13588015335231199159,3187094540840344064,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=5144 /prefetch:1
                        2⤵
                          PID:3948
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5028,i,13588015335231199159,3187094540840344064,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=5324 /prefetch:1
                          2⤵
                            PID:3964
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4872,i,13588015335231199159,3187094540840344064,262144 --variations-seed-version=20240729-180130.470000 --mojo-platform-channel-handle=732 /prefetch:8
                            2⤵
                            • Drops file in System32 directory
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4644
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                          1⤵
                            PID:5028
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:8

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              552B

                              MD5

                              809f26276cfe77cb172a2fa480e8b4d1

                              SHA1

                              83cae857da7b943a010e74eae80ae33f96eda44e

                              SHA256

                              6ae9118831d0baff3abe4876fc0a2a8ca563b6068b106046b56fe4e8f5a40b25

                              SHA512

                              971b9007ff28ceb97e522fbe5fd045dda75819c2f7da6cfb9f3bcc3cb3b836d01efb395366513d122e82f0a37fa3e132dd6631e302940b975b4bccaf31050f15

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              86c826aa8913096ab44d215fbc420e6f

                              SHA1

                              4d228d8f5b8e868ca01a046a170268db63c97bdd

                              SHA256

                              f0fee9793b4aafaa8af9eb35c13e58e1d5eb8dbee25745669ae0a528d12a1397

                              SHA512

                              7a865dd4e18fe87d04058a86235ff5626bcccc5a8747d462f9805df2e670440e1f2db2de7d52dd64aa600b2d100a4f36698ead04f8efc1782c721674f6aa491a

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              4KB

                              MD5

                              051890bb32c49292a888afc21118afd9

                              SHA1

                              b889c4291ca204313584427753df94ffdca3f2b0

                              SHA256

                              8668b5d58aa2206d1a786b0b2275a61cfec0ca2742c65407df5bee617b75d264

                              SHA512

                              51e9f7631effffcd5ca94b237ca44b8d724768590b00f7cb5707c88daeff4d1919cfeeb10cd6f4ef5a06d5a76a9ea7ba0e2fc65b7dbef281ea441af42d96ca4b

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              4KB

                              MD5

                              b86a8b97b76a4304d145cf2f719d369d

                              SHA1

                              535fcb2a1510566263f272b7674fead067f05b99

                              SHA256

                              894eb7b84b9b73f78f0b55d1157446571e8e811e98de323145a39cd9c037dca0

                              SHA512

                              b4d530f89a654bb8f1c69bf3ce3c23f1e1429dffa5de1947821c7e4bfb80312e682718db2f1226ed8a343e397e1046ce9d2896bea2221021071557029422dc99

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              4206ccb28a60c08b4610ebabdf458c01

                              SHA1

                              d07c3b204cc818eb657abf9d0ea6226ab9ac21af

                              SHA256

                              762ab5130c54f2836af88653c510d2a6c19eb48921ab16406f5d292405137fc6

                              SHA512

                              684f12ddd140fd1bb330b61318aaa07906dbc8b7060ae456b4dca670e58cf7752194c2e6d8418ed82853ecd056f6c2b1c2b96396010bf98d9b8cea247a7bdc1d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              1KB

                              MD5

                              0e8d45f7c3e1fefcc635bf2f222e8604

                              SHA1

                              bde28be6ca3354adb94d9223b3392492bf1e6ed1

                              SHA256

                              8c0916fb66dc6828db12e389698043f92aafffd08b83cd8a3b4fb4dbe76c53c4

                              SHA512

                              7d919cd208e1fe0be1f6190f990090075f1f61a603c7c4380fb83d260412bc835ccf0c3e3814451d520e870f34cc9cdbf8dec947f5406740be72b68b9fa7461a

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              8KB

                              MD5

                              45f2adce771722bcf3a19706c0cb1cc7

                              SHA1

                              a498a28369626360378b7dcb1e00bdc1677dccc6

                              SHA256

                              3e3bda4dff6ec0496d3a12f598002b371c6e3e1c9a71891445f2c3c5f5d2461c

                              SHA512

                              fd92aa073d7ecedfa2f941bcbddafaf34f6225f170ee5894c0e0131c684a92e7e1da6260d773fe36e5eec49c4dbe70b6f246c222beb445ca8af487f37c57da3f

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              bb4d7ea4db341f5532e841bd26e3cbc7

                              SHA1

                              dab208dbaafaba8708fd2fc52ac57d27368a304a

                              SHA256

                              7bd8ea28d96ca8257e79b357a49ee8657613efd4f18c53df8cf8b5c8c32e2c4f

                              SHA512

                              0c961769c3f089129f839412f36ede0b7b74abcb7296cda291f516d1dcd3f6ecfdd070751a8c597b1052b37af63e798f11a794e3fbf2839140dcd04f18241ec1

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              3d9e10dc384a8b0ac7fa48445445fe1c

                              SHA1

                              b660b345f401873008ddb2f3ff4ebafee017e74e

                              SHA256

                              9ecabfa65136bfe7b14b7b65b67f84a1dbd960a76c934bf6df1beb11b43268fd

                              SHA512

                              5fa2f6d378bf1ef07b261d670d74159937173e8c922761db10ba3d9628d845a2ad08ad66cc6374294592971e5f12ddfd9033bc3ed02189152bae254071267135

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              249cf11aa92075668f216df136451fd6

                              SHA1

                              6455893c550a25dde812c7cd3b0a00864a9acfd2

                              SHA256

                              acef30d0b7c3dc30dc0cbae801be806a2c103c64dffeced7e3de91a8f3ea6423

                              SHA512

                              ac43b7664c7ddd67b32d58b32b5bb45bf9390c639800d41c7301c8551a6e75f7d8c1b3dd1e35d884badfe9032fdcf8d65eee932a5aa04b4500b4862c62421656

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              749c56de43f4029ba5013dbea3a7622e

                              SHA1

                              fdd22d2cd45b5511afc11a94234dbc75295d4f1c

                              SHA256

                              0df550bfd97f71117c55069fa91d73391fe016b4f3b00991f6a674178d9a4e1e

                              SHA512

                              6481e27034268b59e8f102e0a4a7f231db2b7a3e5add51eb7c4ac06878313e6ed0d469a2aa2db9fb25d5b4babdd14164a3173e59654d32328553f573145917ae

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              30ab2cfe6c8a54b9401d99b25cc5aae6

                              SHA1

                              ba8c7775c05f563902ec95b3d36227da0e4f44b7

                              SHA256

                              1a3546964d39cdcee895da61c46f167f57fd681d96071d07ddb3a0de8842304c

                              SHA512

                              0ac4f4793a1a0667b15a154c84bdd7f282cdf98f7f0d3d3d76e1b971dd9b2454eb92ed9f9bb153343b1e2e39bd524062454462a16764507a26386760edc7f9ba

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              fe7ba4a0ecaa43653d150642bb06a80f

                              SHA1

                              1d93c40d480f767f3cb630f7efe8a9240533103b

                              SHA256

                              5615b5677843d7d36172de29d39db81463b3d2cae7fc0d7f6a2fc86d1e005955

                              SHA512

                              d04cfa8a87b7e77d9473dbaa6baa7358f125835a14503c92e18d4a25bbd00d2e8322ac7708c5ba8db9202116cb5be99642e10a4f55a7f861ef43db75a69ad6e6

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              b2c554a30e37b741b6f3e88d4ff56148

                              SHA1

                              dceb2c9290e3fd8e15a9e42d6593594c8f6829b2

                              SHA256

                              0d92d069b1c8433f0c8ffdf481d3c60c6190e9e46667579645a963ccaaf4619d

                              SHA512

                              df3df1f184644b5e683928816868a0309845178d009f0913972c057546c682910b2209cdb3a00e8892074b2cdcc0b2d5278168bcd2182aab7cf62580a2e458f5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              c061919cee3e7efa9070cd753ac1d5d6

                              SHA1

                              d84e1cb62aa1b0cb4e5f4d531137397260be65a1

                              SHA256

                              6d3e31917504bd049e457981dccc31131fff6f1036f43a092cb0c8cb0f5e81b9

                              SHA512

                              a306d941e5f0be433a48ad00c24050150862569ce69d038cc402f6455bd2da77be28d93e81203467159d0048162f13122df0286b1603807f2352b96646e350dc

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              100KB

                              MD5

                              726b36623261e67cd3aedb5ffbbc0364

                              SHA1

                              6b4af8c27925f003d7af2fc47729a2a3427bd66c

                              SHA256

                              df39710fc86f1cf10d36bbc76cd35869d365952519fb158594ec0b185b7236c6

                              SHA512

                              218101a418016681f843ef4ba0db5af4c1d57c2e04c24a4a893534b854092a37ad54f41270d0dede5dc2b6a51a2370d50391248df0c5f8f74d7e4ed5d70810e4

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              100KB

                              MD5

                              78c7d8494d5eadf57a21944168b2e4c8

                              SHA1

                              e04e9f80489758be5e1d13842f367184af4fb930

                              SHA256

                              0d1aa49b55651b99e9693c35d1ee44cc98fd7ed38781c610e7289b14981b419a

                              SHA512

                              0efb4e3b060117b7060d3a0f4a5c750cece616eb545da29594cc8f7d90329767f7b2fd3341e959a78f865a4b40b427c43f132f6fa3aabd0064ff978f9f8f0b54

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              100KB

                              MD5

                              ee944051f7d781b2600a1326dba95e2e

                              SHA1

                              880f0a69b84ac8bf26f9431589f3ef8710fbf38c

                              SHA256

                              90208b6f94f59b019658fc0b9238dad65362bace3c7734fc4fc2859a6b243287

                              SHA512

                              9661607c8531a8f217ed6b9537ee5fa067c71e2157d8aa01f48fac36879fc958a1cd587a8ffce231d880bb6bd749aa1b4ce6728bd7102f39f21a646744eb5c27