Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

06/08/2024, 00:45

240806-a3893sxflg 4

06/08/2024, 00:42

240806-a2cjqaxeqf 5

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/08/2024, 00:45

General

  • Target

    setup.zip

  • Size

    36B

  • MD5

    a1ca4bebcd03fafbe2b06a46a694e29a

  • SHA1

    ffc88125007c23ff6711147a12f9bba9c3d197ed

  • SHA256

    c3fa59901d56ce8a95a303b22fd119cb94abf4f43c4f6d60a81fd78b7d00fa65

  • SHA512

    6fe1730bf2a6bba058c5e1ef309a69079a6acca45c0dbca4e7d79c877257ac08e460af741459d1e335197cf4de209f2a2997816f2a2a3868b2c8d086ef789b0e

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\Explorer.exe
    C:\Windows\Explorer.exe /idlist,,C:\Users\Admin\AppData\Local\Temp\setup.zip
    1⤵
      PID:1976
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
      1⤵
      • Suspicious use of SetWindowsHookEx
      PID:4176
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5092
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        1⤵
        • Drops file in Windows directory
        • Enumerates system info in registry
        • Modifies data under HKEY_USERS
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of WriteProcessMemory
        PID:1952
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffbda74cc40,0x7ffbda74cc4c,0x7ffbda74cc58
          2⤵
            PID:1592
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1792,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1788 /prefetch:2
            2⤵
              PID:4968
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1952,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1940 /prefetch:3
              2⤵
                PID:396
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2156,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2212 /prefetch:8
                2⤵
                  PID:4576
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3088,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3120 /prefetch:1
                  2⤵
                    PID:2568
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3164,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3388 /prefetch:1
                    2⤵
                      PID:2136
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4452,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4480 /prefetch:1
                      2⤵
                        PID:1400
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4672,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4620 /prefetch:8
                        2⤵
                          PID:3432
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4816,i,7882618685101963618,6922196728994393344,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4808 /prefetch:8
                          2⤵
                            PID:712
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                          1⤵
                            PID:648
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:4712

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              352B

                              MD5

                              4a6a413757db7c905980f55543eaf8ca

                              SHA1

                              9d5b4c90335d146545c7e6e70ecb9c735e297fda

                              SHA256

                              0eb967ddfe701d0ab9f017df857bfd81f12d9f29daccdf3d0a70c706cea02773

                              SHA512

                              5685b7957672be7dacfb49826e184dc6f9dc976b868973c2b14947073ea060b94f964201f0a2fe1a9d4afaea01cea19e137a75ad8812a169ec8cc552f25dd521

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              8KB

                              MD5

                              2974a50ff694b9c2abdef2f03aefc807

                              SHA1

                              3cc068ff707f83e5bca8c81226b731224c7a9936

                              SHA256

                              601a80ee696c81db263d5ce85ea52479fff4b10fd24fde8cbefeed5379ec1ebf

                              SHA512

                              42fdbb1dfef4a0554cb48d4d4eda238d88f542f565604d2e51bc4bf6e13e26591770affe3dc05d6ffb6dfddd52805bb01aa6cad13b9bb8f78418b11572c52c65

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              8KB

                              MD5

                              6c167f3c5befc0998347ddd707724fe0

                              SHA1

                              120a4588ba5dbe7724e975e76ba77767eb753731

                              SHA256

                              5d91758ef60341fa4bb3409d9ead6ae65ed9ec567860ffa4ae914c7265f3f591

                              SHA512

                              f2760ce8a69c5ee7a735f4eebf593f525198a8cc7674c2dbaf99cce734ab31c2d2adbb21f77acacf121ef596a3b1ac976b33adfee1d9f693fcf2072057c3cb67

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              8KB

                              MD5

                              91081ec356aad805473ffaac20da6f39

                              SHA1

                              77f916c38575c211871a051eb40c20b52bae76df

                              SHA256

                              491ec0f45d539c9893379f11c298cf456c2c08f8d9018e85675003833970816d

                              SHA512

                              57a0580ed837fa0dee9cdf86213dcb2bb668c3999c71410edec97b213407345f5e97d9a8e0a9c3045ce87194d05f8cd3e95236f5e7c7dd69a17234f88f2a429c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                              Filesize

                              15KB

                              MD5

                              74e35ed577817ef38a7c2019c1a1bdaf

                              SHA1

                              f8b5fdd1bae940afb57f9f2f860b870d3c14f63a

                              SHA256

                              3237a5a13ee18d82baac99565435aba73ca1b8d25a488235728cd1c8c0acb264

                              SHA512

                              3962b968205b17e0cfc13ad51c67be2a0168e93f8b542441bf3d6d63b20d1ecda28d5cf9954c635dd46959b568ffa0f0e42bca4aa8efff6032783856d64a0c1c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              195KB

                              MD5

                              c1724a3b31e906fb613181ba43fa1317

                              SHA1

                              04263dbcf16ddcb2c8b48d29f095a3815ddbea67

                              SHA256

                              4331ff2fcd67cfb7ea46fc83219885e87181d5dae0ef6b4a098b820f8f8b9beb

                              SHA512

                              652653723eebeac4276698585d9e0ed05797d37675b2adb990810b820365033b32a1f24de27cc4401952ab433274597ef24e1adc58fd82f2aaaf6de45b92d0f8

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              195KB

                              MD5

                              b674a035693621bf4e58e8d7feb23698

                              SHA1

                              a8bcb10be4e68e4b5a49a94b9f6b757425032790

                              SHA256

                              d26a34cd7a760079f98cfe10df4c4d4c05e0d93f2cf5f794366a86af37c1c897

                              SHA512

                              71e0e3eee0fe16717a49546e042f0bd5a0b7d5651b601cff4addf8c9017cf469945072c356d2dffbb4822692d40b0743b73c7de5d4dceafc81b8bbda32cc479f