Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/08/2024, 17:26

General

  • Target

    https://forms.office.com/Pages/AdminPhishingReviewPage.aspx?id=PqlLJW8f80iQ5uJ2ZmS0d1GTUwCW4rNOjieUa0UzqnBUMVIyU0IxVVc1MU4yTEVUUVo1RUQwNklIOS4u&source=UnifiedAlertPage

Malware Config

Signatures

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Detected potential entity reuse from brand microsoft.
  • Drops file in System32 directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://forms.office.com/Pages/AdminPhishingReviewPage.aspx?id=PqlLJW8f80iQ5uJ2ZmS0d1GTUwCW4rNOjieUa0UzqnBUMVIyU0IxVVc1MU4yTEVUUVo1RUQwNklIOS4u&source=UnifiedAlertPage
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffdbf0acc40,0x7ffdbf0acc4c,0x7ffdbf0acc58
      2⤵
        PID:4244
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1892,i,11985856224886796612,10939109751368920272,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1888 /prefetch:2
        2⤵
          PID:4436
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2040,i,11985856224886796612,10939109751368920272,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2104 /prefetch:3
          2⤵
            PID:4844
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,11985856224886796612,10939109751368920272,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2584 /prefetch:8
            2⤵
              PID:1564
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,11985856224886796612,10939109751368920272,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3144 /prefetch:1
              2⤵
                PID:4012
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,11985856224886796612,10939109751368920272,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3248 /prefetch:1
                2⤵
                  PID:4060
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4356,i,11985856224886796612,10939109751368920272,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4536 /prefetch:1
                  2⤵
                    PID:3544
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4456,i,11985856224886796612,10939109751368920272,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4644 /prefetch:1
                    2⤵
                      PID:772
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4528,i,11985856224886796612,10939109751368920272,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3164 /prefetch:1
                      2⤵
                        PID:3964
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4576,i,11985856224886796612,10939109751368920272,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4504 /prefetch:8
                        2⤵
                          PID:2248
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4608,i,11985856224886796612,10939109751368920272,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4776 /prefetch:8
                          2⤵
                          • Drops file in System32 directory
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1732
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                        1⤵
                          PID:4484
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:1944

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            432B

                            MD5

                            d699d60845de068fb17c72a74dc809d9

                            SHA1

                            4f28cb5bef836f804b38856cb88f9ceeace2eff4

                            SHA256

                            48b729b76b9f9b2e00bcd2386de403a910bd6fc05170670d8f9f99418c7d00d5

                            SHA512

                            f24827a1ae56611a26fbed46ea513410a24a5b8939573b76ad913a471a24f26841b8614ca3db0cd490c84d038692fc4a0cf7bbf61b3c8cb935994aed050c32a1

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            2KB

                            MD5

                            7d5f34003eea78157bf767e12946cb71

                            SHA1

                            bce389ab898d11e32fea7fd07c4ba8be23513297

                            SHA256

                            fc5789c507a9d9b263c024824b5cac931d9aaf814bb12e8a640463772adddb66

                            SHA512

                            a8d6824c0fcb3050fc18b1710921249006391ceb64158ce8b8b10b0d49d168693adb1a633e35cf4bf7652823177a107ffe376d64ab7817a186ba052031fa0acd

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            1018B

                            MD5

                            9edcb828c3102b35bbcfa5ffcaf3ab56

                            SHA1

                            3b81aad911b5c204918f5d9b70f1f799cca0f92f

                            SHA256

                            6b8f661692c4301c312972fd231ab63da27ebea230faf36ce8ba136bce18b912

                            SHA512

                            812edbca5981110659db712826d1e19c24bdb754ec9376cdeb90a6b5c089e27a0898017b4254dad6ab2057a8418755f47200baf19ec6efc56a73fa5450b4f74d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            8KB

                            MD5

                            32d01b531e2d3360aaf43396e510b2df

                            SHA1

                            289716a32a21b324efcb5d26175d92d64f5a3a11

                            SHA256

                            0c9046908e3f652e309b76fd2024d201371e5a1ab1e54d61c4c704bc361e36ea

                            SHA512

                            42b4e7b65c18f6301b46cf4999af226c074fdc40b661173b3bbd96dd4161fcb87636274934fe344b700fa76777e2623b1d8e27e98c5b80a65032173b4b1273f3

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            8KB

                            MD5

                            9e9219b38f093e1e73c0b6dbba70f149

                            SHA1

                            2850d31afed066db97929c4e69bb8a25125662b9

                            SHA256

                            15c95da3b461f9309d671b7bceacf5e47cc02db5fe082465b9dce0973f86b6e6

                            SHA512

                            b692812aa9be1a1f8789fd753c5da163ebd0e6dad1cbe96ade3fbbc82e4bb05d880210811f3dcbd687b9ea523ec3ffa7b2e1f926eb8704f806eb63741d517a06

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            8KB

                            MD5

                            8d0cb75d0d25f9e9f09aec86b2f43987

                            SHA1

                            b8172f57ba60baf0c1aaec9f71589f5a1ce111a2

                            SHA256

                            d231115d706f8a521cc6da46fa1f94b47196e98be8900f84310390b22a43b0eb

                            SHA512

                            44d8cdb7d4d7891495a9bc04bad840631524f5c5255f159b6516c94f8a0663a6b6a6083d5cfdd5f32b6b57c19635edb8b1be9934874857d95d5c536c0e460ccd

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            8KB

                            MD5

                            33d56533d27ceceadfad69779b406d1c

                            SHA1

                            7a2e86638fdf4a81fee817afd200b22275fbf825

                            SHA256

                            ca8cd253fd44a8f38230b085f6c8b4ae17f7b8d1a3d96febc8cc5cc2bce9d459

                            SHA512

                            5fffbbf674f1e9d642457fdc225a5e56ae05e6fa58ed211c58a1b0567f4655b7b6d1499f827d0e3553a614ca50d44b44051072423b636329f0fc0433c55cd66e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            5431755ffb2f595d3182e1e68401a4f9

                            SHA1

                            1ca8c0d6571f04df54285269609655fc402c8d5a

                            SHA256

                            c55872024473d5ba8010e0ba14c72617db4dcc277e3ccbd5de290329ba8847f6

                            SHA512

                            94c3a3f4ad33b6930103914fa69a5798f40d2d4a0466b58ab22a2a5c06a713533ba48ecab638cc0712362fb07d6144127dc8e298f516f720c31309b1693120b9

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            83ba1b6a7a9b9a5accae756f595dce61

                            SHA1

                            969ab7f9b1593d5acfa71e56d76e9a0352e8cfd8

                            SHA256

                            fb241ea27b77026a958f70ff9652369ccd012f35a4fe3198a3a2f85b56283f9f

                            SHA512

                            393a752dab9f72e6b0f465b1b827c37c8bdf1c1dad7a67a78d0124173cc3e0e3d57a2943f360daf2c96905591e7b96503404aa1b9399bd3b98fce287051be1fa

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            b21045ecab8b4877bbe4d68ed6137b3f

                            SHA1

                            988a88b395fc11f09144528640ecef97010a9636

                            SHA256

                            d3c883cf6f9aa740ce3dc836895b79a66af277ca1a5045c9b4810cc9eb3fc411

                            SHA512

                            bfed7f59b53259bd132148133f5b215a78832223a264653aec3b25f313892faa8909c469bc661cc1655b0a657da6641f3be8586b70a34dcc326d2521e645f086

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            aac4ad779bf5dffc1558456de38f26b6

                            SHA1

                            f7f438faa70e89a08b9c4e441c4c49b4c9ee0754

                            SHA256

                            d4e753d745fbde1623fb1c64c53a0e923c8b8a5d863c057254006fdbce3e2ec9

                            SHA512

                            3f67b06f4ceb985ccc9bed950f9b6e98c12a5b1daf330c1d2c2a42e82366ff15a97391c8906a41fbacc4a02f633bf6fb5837a14a168a57471d1c20d71bc67215

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            6ed389ff510cade043a9e397ad748ae4

                            SHA1

                            66344ed3bc4c03085acdbe0827a68ac0b9aeb4f3

                            SHA256

                            ac52b2d6d4e64d1ed18b8a2907fddd80d07acb3ff7dc99571b8ce250dd76fa69

                            SHA512

                            25e72ebadf465a59e3459a35957d6b8536802838038729fcd423964c8d5fe83a65fc9ffa7d6942f8093fe0aabc661ed8c66d1364590bfe5d71b5747407ca74bc

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            ac098ba1f9772830e0c1c21a8fbafffe

                            SHA1

                            d88978009b3f8192079453e30f0478be9a047b06

                            SHA256

                            69d07fdce54baefb4b031eacba48cc288dbc3b9c4e6bddabc2b517ea8ef65891

                            SHA512

                            31ce1d9fff23bfbf3317f64ef44adf99f31c42b214c6a587fad1436df7f4db71105aee0f381363f9329a866453fd6874aab33c6f96ee1630fdd659164af4635d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            99KB

                            MD5

                            67e61286bd17693dc4acb044445b50d1

                            SHA1

                            13014c370c4d2b16cc547f80be9468dc08ef0b45

                            SHA256

                            8efecf46b19a2fcec6b5c8f2b8275069a95fd7b75925cbf979388ad510fa7267

                            SHA512

                            a96e5f06700920cde0625ef2291d116aae7753a5cfc35dfba0f7398bc4fafe0231ce91988625f862293062b703b73b2b18d7489cd65d55dbd3526c1dd8bbcc7f

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            99KB

                            MD5

                            4044e0a08e5d429eb64ed397e2fe99ea

                            SHA1

                            7811ebb7451a857ffce96748b612c0ea83f7c3c2

                            SHA256

                            65b0370ffce19a08a280bca097d4317257a83dca86150eb16d72bd915e723481

                            SHA512

                            34ee8ce14a567d3d4d1acc499402d754e7f0ba450ccfd9ded363c676d1274a21553396dc8bce3d71c225c92e021f016347d8d70aca3c00b7758647c612ac1512