Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    209s
  • max time network
    206s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2024, 23:04

General

  • Target

    sandbox.exe

  • Size

    26.6MB

  • MD5

    93a447a49536352bbf4b1a7c06465c97

  • SHA1

    57b6be51cea0066bf9340dae05839a05ca97ef3e

  • SHA256

    5f6b871fd55bcc194c357404e76937e5c86323e7aea7e54706c79bf9ee8fee58

  • SHA512

    869868a5c414c4be781aa9c9952bb206bc03c5c0b74f63ea31efd9ecace4737c3c122a70503402f4d08f518af270db29038e3242d476012b663a208caeb3cfb0

  • SSDEEP

    393216:CFlzlvbVSL5lMYjeo2OQTD8zL1DkdzZL9+eJT4MjMKRbp27vH7:CFlhvseYjeo2OeDhdzZL9RJT4M4KFp

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\sandbox.exe
    "C:\Users\Admin\AppData\Local\Temp\sandbox.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3948
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:4244
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:3468
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffb17eccc40,0x7ffb17eccc4c,0x7ffb17eccc58
        2⤵
          PID:1252
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,8138850300658480697,18039230565066252702,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1936 /prefetch:2
          2⤵
            PID:3720
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2112,i,8138850300658480697,18039230565066252702,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2092 /prefetch:3
            2⤵
              PID:4144
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2292,i,8138850300658480697,18039230565066252702,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2512 /prefetch:8
              2⤵
                PID:3128
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,8138850300658480697,18039230565066252702,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:1
                2⤵
                  PID:2492
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3436,i,8138850300658480697,18039230565066252702,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3444 /prefetch:1
                  2⤵
                    PID:2960
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4608,i,8138850300658480697,18039230565066252702,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4572 /prefetch:1
                    2⤵
                      PID:972
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4896,i,8138850300658480697,18039230565066252702,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4904 /prefetch:8
                      2⤵
                        PID:1744
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4732,i,8138850300658480697,18039230565066252702,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4992 /prefetch:8
                        2⤵
                          PID:5064
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4868,i,8138850300658480697,18039230565066252702,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5116 /prefetch:1
                          2⤵
                            PID:452
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3508,i,8138850300658480697,18039230565066252702,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3560 /prefetch:1
                            2⤵
                              PID:4060
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5316,i,8138850300658480697,18039230565066252702,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5260 /prefetch:1
                              2⤵
                                PID:4464
                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                              1⤵
                                PID:3896
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                1⤵
                                  PID:2444

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                                  Filesize

                                  210KB

                                  MD5

                                  48d2860dd3168b6f06a4f27c6791bcaa

                                  SHA1

                                  f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

                                  SHA256

                                  04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

                                  SHA512

                                  172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  216B

                                  MD5

                                  0ce8353c66466c0f6bb59a88a3dc1b1a

                                  SHA1

                                  66e7a6733234f5bf583baf2c981f8679eaa2681b

                                  SHA256

                                  23c10ef4f89a59b3bcaf3555adf3b1f0dc09b30f9abe38182f1d2918bb93118a

                                  SHA512

                                  f336956d3bec62e63e1cf8f15f118669ae152ee58da537f5c4941f83dfd2bb797168dbb619b42533354c9df6eb149ba60a0e0ff6273c776979acdb64c79d3bcc

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  648B

                                  MD5

                                  51a23813ce98731671cb8a5a5e3ffdaf

                                  SHA1

                                  71fc8b2a9e856bcea18fecf6e2ded23299fb6933

                                  SHA256

                                  e91fce6446996540cc3b9e1b7579995cccc2590a60182ee8700e744acf44245b

                                  SHA512

                                  664332adc9c2d9f6cc91bb88c4916d17919c11a9a8b9ea006ad28b357d6644ca9f78aee920914f88fe7000102f24bc69935d485c092ed69b260f2c0530741f7b

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                  Filesize

                                  2KB

                                  MD5

                                  7daaed46b277d682c7fd4bf105b98bba

                                  SHA1

                                  eebb8c7df33c741c0357e474559f412610f1fe68

                                  SHA256

                                  4c93f63004149580c3c4ffc41c008234941cc8085ba2dc079633b8226b101671

                                  SHA512

                                  bf888c38bacadf2a9812f5a104e39940d47c01de4f71afb6d46453cf78556f3917ba19004a9aee4edbeb89596b6ab3398a12302d5f19c7d8d0697881517b4476

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                  Filesize

                                  2B

                                  MD5

                                  d751713988987e9331980363e24189ce

                                  SHA1

                                  97d170e1550eee4afc0af065b78cda302a97674c

                                  SHA256

                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                  SHA512

                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  356B

                                  MD5

                                  4c10f31b665b6f75a11044bffc2201c9

                                  SHA1

                                  ad58341d12e5848fbb70386e3e846bb391f76757

                                  SHA256

                                  507965e6b587c52bdb4ee44270a0b9e411c6ddbbb4de5b83c0e03c0c0a40ce24

                                  SHA512

                                  53c85548d618cc8fa5237b7f26f1669c13d30c0a26dc6a57743bcd9e1cb41235e50a3cebcc3b4486918f07c73fae8dbead07674bb7c4582b5eed14b352f33c73

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  356B

                                  MD5

                                  3be09ad9b95705613985875c79f6e55d

                                  SHA1

                                  a1e20b5f797ec0bff3a57de699684c8c57d98d43

                                  SHA256

                                  5affd96951035c9593f8b41044a36c3d3ec49bd5308f4bc8de893a255a0c3dd8

                                  SHA512

                                  f68a08d47128fcf857113e604ad6bfca5d6c13d75d5c6edc6767b4b87e9b5651336c28c216d1e95190f5c64de92c073cb584ed0384b4ffd05b507bcfcae9f842

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  691B

                                  MD5

                                  af6ab1bed0a55094a5600a3d0bd2bf41

                                  SHA1

                                  9be94fce8064b512fcfc740cd6076ef3ca63c27b

                                  SHA256

                                  a992ca6a99b446a7ef8c77a58679d95ae06f88105a92916050a6ebc435f0d018

                                  SHA512

                                  f50d75bee50a8a66b6f9c5b7f5181f4e3c4116050fbf54e8c8467b02b8765e0ae907e7b7dd2b2963641faa683311909e97ac58a005a911bdbc52a6d779e76ee5

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  1KB

                                  MD5

                                  2c3ec5e01171810c30a568bea6982e08

                                  SHA1

                                  c98b7092debfe788c69009a1ffba00bb326ab449

                                  SHA256

                                  e676b847e07f1cc3d6be20aa3464b140e474e7a95ee94491bf419ad0aeabdf3b

                                  SHA512

                                  7102a79cb75ad27b6e393501bb3d0c6c0f9d2b540d592580c1dea224c3e132d947872650fc0b74913e734bc6c93ea0820fd83149d6b1fd167907ebecabe6ecd6

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  8KB

                                  MD5

                                  d0fa468d9a590796b56c252a2b9d2021

                                  SHA1

                                  9b89c4bf96f2bc4fa2e307112c6af2b492058073

                                  SHA256

                                  c38d319d17f591247a8ed2fa35066471f267dcf51288a8cc8bf99bbadcfbec5e

                                  SHA512

                                  e2fd218d2b555b7f64cb8bcc7ed265f417cb2b9516f08f0a9102f8cffe9e755ddcc27348e03853cfa8c645634a266cfde1ce6c647d57ef725496d7781747f355

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  9KB

                                  MD5

                                  765b791933b8cc26a619b04c3066c438

                                  SHA1

                                  5561fe4537b19361c407285638273c20be901665

                                  SHA256

                                  c5c76deeda5bfe181db57d2c0c613a6c63d9c9d4cdddb662594b33932118a063

                                  SHA512

                                  126531641290c83dbb4fb86dc77d2ef95cd4dbcd0db68b9c0a4da71027dec4a2ae9ce6837ded0402565eeaaa66d2c1d2821d14159647624385765a5b6322cacc

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  9KB

                                  MD5

                                  19ff6e2f33d7cdccabee42a2df61cba0

                                  SHA1

                                  bb397fb64be3d9d28a70a617921a547679723732

                                  SHA256

                                  00eb336b6f6322ff4caa2a9f2102b5a36015b16ff5980cfa699a967bcc5afc6b

                                  SHA512

                                  5e4702d33c28a6546d297e88df93c2a58034e231e28872af51d55f98e41298ff736da13f2a2a198ef8f6adad6c44d0f2837a340be6368a65ea84009b6b2be2cf

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  10KB

                                  MD5

                                  28ad25112c5aac0eef0f4baa3babee37

                                  SHA1

                                  871964ac56c4e35e87f9ff974dbee2c0ba63f86f

                                  SHA256

                                  bd89578f76624a366f12b7abdb4d28ffabaf43010f0b27e92192a6a75c257e92

                                  SHA512

                                  5ad94135fc85108c25af17656ade952546573c49b3e00763e35b466b2ed8d46bfbb659c80686ae10049832dd636bf645abeb83f0b1c9ce07372b009cc3220121

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  8KB

                                  MD5

                                  f788eabebcc6a3408a88b79a5019637a

                                  SHA1

                                  74b94308aa98e15b8c192db2f5678a90160f938f

                                  SHA256

                                  baf963840d6dbb3550c7b817d8edb48ac41a543ed7b5ec552a007c409782992c

                                  SHA512

                                  8cf6512433b73eb2966609911e44505da56c3724e814af8cd477fbc8262a4cc571943e36d41c032ebd9df0ce51142333141d67e07b431e273c3c752d0abe6180

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  9KB

                                  MD5

                                  85ef40c58900048665b879f3cbc893ee

                                  SHA1

                                  93c8a79df5c33b7e18a02c5f67ac4b4fca21cf2f

                                  SHA256

                                  f2f1374316bfc9a4b40e4b60d314eaadb2770783cf9092d7989befd6c83a58ee

                                  SHA512

                                  df051358d50c0425aaddadd231c81869d3f4d889c7111d03552f8fd3d88eaa7350801e7d317c70ca7722a597a99770b89759caa760780426bc955493949c7d4e

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  10KB

                                  MD5

                                  1d5c6e0870df35576f9635933294805e

                                  SHA1

                                  d4c2a262fab3189daa91cd2cf19464f68cdb9812

                                  SHA256

                                  7a22c9a8932db47efed7bdf16ff9f2f0d1a92d00664cca83439142d17e7613e8

                                  SHA512

                                  55a49663fbd8df3baf12bfbe468491596048fb737607bdc91a5b93a8c27ed65c509dbbf7c7947776b8cacf6d0b90b341a47b5cf89104be752143270da6690900

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                  Filesize

                                  15KB

                                  MD5

                                  bd39146d8c5130e5ae2553fe902bde78

                                  SHA1

                                  e28046308f2ff5ddc9dec5e15d9f2cb4d2198cdd

                                  SHA256

                                  10f5ea6cef93d418df8308e8afc5a42fc0cdbbfec6a1c02ee78d5a69a20ca7a1

                                  SHA512

                                  f505c41ee2d33e1eeb5c51f3842aa4502e2a0347d3aa293fcac949c9b595aa32ba5b579c75d16b89e09faa615219a8c2d302f29aef3edc67bd06d4e5987812ef

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  194KB

                                  MD5

                                  42d0b912599710e898221cdbdebed2b7

                                  SHA1

                                  ba7ca54c2cef0853e0dab3dc3b9ee9ac3b22d611

                                  SHA256

                                  99d6e0affa1de40ad95df5c0ff6707e84da3ba67cd40bb520b9318d6f1b752d9

                                  SHA512

                                  d369a8d0860925d95d236b559720d0f99efc54b258389f35674eeaaea8a7557a6eeac85005ec24eba1d2fa8ab36b59837f5f101f7cdd04e891337ba247f309c4

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  193KB

                                  MD5

                                  11910d69e834ec1c5bbe50aa9dfdd600

                                  SHA1

                                  a5f4fde141c8e22383fddafe9eecb1217976e86d

                                  SHA256

                                  b5aca3b2d849cd562933ae1f189b462305a986044f36cb70b6b49dcaf54ef091

                                  SHA512

                                  e5256d3ce9dad8dc0bb25e54eadcd6660ed73ee3c415b1f7cc6b1f30b7f6351727679dae205a48614a235214f91113e8a4bfed7b9f272eb675c1e79d82e4e87e