Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    1799s
  • max time network
    1685s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05/08/2024, 07:31

General

  • Target

    https://dosya.co/p8jatebcu2vo/source_prepared.rar.html

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dosya.co/p8jatebcu2vo/source_prepared.rar.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4512
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9ce089758,0x7ff9ce089768,0x7ff9ce089778
      2⤵
        PID:3124
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1544 --field-trial-handle=1836,i,4594846928246830030,1195288200298859414,131072 /prefetch:2
        2⤵
          PID:4652
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 --field-trial-handle=1836,i,4594846928246830030,1195288200298859414,131072 /prefetch:8
          2⤵
            PID:4412
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2064 --field-trial-handle=1836,i,4594846928246830030,1195288200298859414,131072 /prefetch:8
            2⤵
              PID:4592
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1836,i,4594846928246830030,1195288200298859414,131072 /prefetch:1
              2⤵
                PID:4692
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1836,i,4594846928246830030,1195288200298859414,131072 /prefetch:1
                2⤵
                  PID:3340
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4528 --field-trial-handle=1836,i,4594846928246830030,1195288200298859414,131072 /prefetch:1
                  2⤵
                    PID:3688
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 --field-trial-handle=1836,i,4594846928246830030,1195288200298859414,131072 /prefetch:8
                    2⤵
                      PID:2128
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4336 --field-trial-handle=1836,i,4594846928246830030,1195288200298859414,131072 /prefetch:8
                      2⤵
                        PID:4552
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1836,i,4594846928246830030,1195288200298859414,131072 /prefetch:8
                        2⤵
                          PID:3336
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4928 --field-trial-handle=1836,i,4594846928246830030,1195288200298859414,131072 /prefetch:8
                          2⤵
                            PID:3956
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4760 --field-trial-handle=1836,i,4594846928246830030,1195288200298859414,131072 /prefetch:2
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:1068
                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                          1⤵
                            PID:3996

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            312B

                            MD5

                            eb5e60fc7170f99fdf5e8a3b28a4eb60

                            SHA1

                            5742cfa7bfb5da3b456ad5afd9ff1a984097b874

                            SHA256

                            b70bbb294b6bd6adc4f746225c619d054b59711091c027e81be8c65802adb73a

                            SHA512

                            a89b441dc3254a5b83ff75595e1a77d5d047bc1e737bea8bb379bb20247a31bd03c8e3f871177f3c2f3e3bd9039e64aa82f8c845ee57b381d74bc81820a63749

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            3KB

                            MD5

                            3e743c99f5cef7a204eff5a40ad26b4d

                            SHA1

                            bccdcd7c7c83de211688a40c795c9e19f23ee7ac

                            SHA256

                            06517ceb2ad30c94223a54d001157795e6235075446f651534c2da8336533937

                            SHA512

                            c7c694f4aac5b7aee34a7c832fa85a1b4c4c75d0ad0cf943e65df7b0ce9fb57534a7fa5c8d70eac6c1c1d19f214769848e575c2f917e25732edb6ed67bb2ed1c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            3KB

                            MD5

                            d2a2fadf6d592e2dc90b4a7b92b72c96

                            SHA1

                            e7b261c3507c5bb902bd4abc8a85647ee5bc71c5

                            SHA256

                            8c298832acd6b763bf93cd98d32c38cbd7a9fe2972fc6714978e5ab42eabaa25

                            SHA512

                            62ae8eb43b958be5d1ae48cf51f981d6659a93b35deb060ec38e4247d4c67d2d14f171b3c87e786a60fe44a233d51f23534590ee14acbbf495a1ea158cfb8a4d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            3KB

                            MD5

                            3a9050d3902a0fabbce7df5cf5b7bc0c

                            SHA1

                            5692432c877027c4b9d23a50d6e7ae1568d70cd7

                            SHA256

                            a638efd20232e4c00694e8ca91bf2fe142795a495ecb3cb625bdd87bda8b0cad

                            SHA512

                            da4cb9bd9ffa0c519fabe44a2ac0fb9e829d702e61d21b3f60d382b8a68ded0345475281089ef516dd3623e094d102cf69a60bf468f481f2b1e722b34c7a3c94

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            3KB

                            MD5

                            bb08c51d1e133ad586e65857640f0129

                            SHA1

                            8b55edec1cc1553ddef1a6cc9be374c1b8063623

                            SHA256

                            f3ab9a06c94053d54f2b2e19cbe1fa817883c96473d59ba6948bc06b346d5054

                            SHA512

                            36308be056ed064d249545220feeb7f9316997c69d45cf447f341922208d712d64946509600f09fc801ce80d309b62c661bf6954ab90c2650ea5fe1fc510a8fa

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1KB

                            MD5

                            62ab5a0fee3dd862ab860980237ca74a

                            SHA1

                            3dfc9c840d4e20b3106f3e7d2079f51d9a15c88c

                            SHA256

                            ce82ff6c0f2dc95d88e486c2f1a8b212000d050ca4f6489ccbfc4ad68deaaf4f

                            SHA512

                            a8a0ea9905452d4859a72b0236a0e7812e8cc10e2b09df733cffd90de9061586999e48f13760de8fb7197b19c49f59dab68a34e3d05b5b04793689b1c68a0366

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            6KB

                            MD5

                            04f82e809b02699da96340b533c78a26

                            SHA1

                            b478bbcc80b410b4bad066b6ebcc08dfb883b556

                            SHA256

                            c0eaeb60e164f9de13ba93b50bfb07dfd1f8b93e42629f797bdc772665619be1

                            SHA512

                            b7b0debe860ab514a6265cb445fb7bd3f1f33708d42c9f9a0dc90572ec8325640de48ed189d2e376725e317d0a4e804133190174122209c36c9c4bc8b76e924d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            138KB

                            MD5

                            d668200da2b80451e678b4fbb760bb85

                            SHA1

                            dd98a7ebcf62088b5d8c219aa307db97f061a584

                            SHA256

                            149178375198e9c7701699ea0d3c496d2c7e08b1cd0e9b96eb7e47f45f49dd48

                            SHA512

                            29e8d638e20bc59cccdd97826ebf2509b8bb3ec73295900be95cd0b1d036e5b4f204d0234b812bbf0db8e8e59caec082aab2ea067df466569cd9487f5978c98b

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            157KB

                            MD5

                            7809f5cb85b6868e5b21aad8ea8670b0

                            SHA1

                            080e117ec600759c0857449383e91d3beabafc2a

                            SHA256

                            b1a53c2a21b270fbc16db756f2a73a449dbfb5b1ee09b51d88d1405b91440f4c

                            SHA512

                            e1551f3a4012b8bbb0eeab31e83fa02510bfd3ce732c9f803f88f4ad90721d325be478327bf2c7e009bc790c37dfe7f6ca8d07343ea01e468edb4476e1844f15

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            138KB

                            MD5

                            4a5865236dcae1301218b5e7623faf4f

                            SHA1

                            ea2551fa1d9d95876080f6d9bcdd9b46d9f05ac9

                            SHA256

                            6e9191559bf0243ad41c105bdf057445fc0c77a45eb24bcd8903f44d5fce9707

                            SHA512

                            2ff3ecd4bf22f3fe3590f9cf6e52025e7af501627adf2f0f9db84be396c6e94bfe6fa3a6ff6be2438cf804f6df2914a82820e854e85d5bce2b92b6a7d20cc965

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            137KB

                            MD5

                            39727c2291c49d4460c7fd9d897e29dd

                            SHA1

                            1355652f54ec5841c076e91be593d56674650f78

                            SHA256

                            a7fe40f66c1867be8ca147bb6126f67ffa2224c9f92440af91d7d897e4c2f93e

                            SHA512

                            43b161db791bc9a9ef2d1f896f643c6586d33eccd269a63e594378ede60ba3f827a16bb140f0fdcca9091b2ffed43a1fbd53293419e0f9ed61c2432efdd41955

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                            Filesize

                            2B

                            MD5

                            99914b932bd37a50b983c5e7c90ae93b

                            SHA1

                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                            SHA256

                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                            SHA512

                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd