Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/08/2024, 07:25

General

  • Target

    http://img.backend.terramiotesoro.it

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://img.backend.terramiotesoro.it
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2164
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffd99e7cc40,0x7ffd99e7cc4c,0x7ffd99e7cc58
      2⤵
        PID:1192
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,7357843627831981056,11650424058890854209,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1936 /prefetch:2
        2⤵
          PID:3076
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2052,i,7357843627831981056,11650424058890854209,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2204 /prefetch:3
          2⤵
            PID:2652
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2284,i,7357843627831981056,11650424058890854209,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2496 /prefetch:8
            2⤵
              PID:1816
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,7357843627831981056,11650424058890854209,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3112 /prefetch:1
              2⤵
                PID:1048
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,7357843627831981056,11650424058890854209,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3140 /prefetch:1
                2⤵
                  PID:512
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3896,i,7357843627831981056,11650424058890854209,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4052 /prefetch:1
                  2⤵
                    PID:2600
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3248,i,7357843627831981056,11650424058890854209,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3140 /prefetch:1
                    2⤵
                      PID:4188
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3700,i,7357843627831981056,11650424058890854209,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3332 /prefetch:1
                      2⤵
                        PID:2808
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4616,i,7357843627831981056,11650424058890854209,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4904 /prefetch:8
                        2⤵
                          PID:3956
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5052,i,7357843627831981056,11650424058890854209,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=724 /prefetch:8
                          2⤵
                          • Drops file in System32 directory
                          • Suspicious behavior: EnumeratesProcesses
                          PID:4744
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                        1⤵
                          PID:5004
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:5008

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                            Filesize

                            649B

                            MD5

                            4633409f5bc4672ad71c46b307605463

                            SHA1

                            42920fc7fb785eebb6818cdb965f9aa9cc060227

                            SHA256

                            740c9c17a0e7278717ca63327ab2d66ef421c247bfef41bb34349c90e50fe659

                            SHA512

                            ff62d6461196f6af0a31087e5651b1051e01cb01f52a119c9d3658e906ac795780e800992fe1a457b9590bc74eb2d00d9ac5969e07f2e485cb2904d3e7633619

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000002

                            Filesize

                            210KB

                            MD5

                            48d2860dd3168b6f06a4f27c6791bcaa

                            SHA1

                            f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

                            SHA256

                            04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

                            SHA512

                            172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

                            Filesize

                            216B

                            MD5

                            d5774bc9126d076e2b18ab3f23b483ee

                            SHA1

                            f9eb9de27492c37cdc468af68d6f85e437be6671

                            SHA256

                            4cc213c355e6d57fac12f5ebb7f29615aec9fd9596428efabbcb32435fd2a640

                            SHA512

                            d477be6f1b8b75346d29d166e23dd8c92c5424725ca5c0d4f88167e12d48b23445834d68c29ebb341e907830d8201cc5ff686822161230bcb9a62865f4f618d8

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            3KB

                            MD5

                            d87e874e2ab8ba2273ea27bcd4621852

                            SHA1

                            30d66e6353d0c051832c153e0461194314fbc0b3

                            SHA256

                            909abc3efa88de03245e55b0dfc99b23ba364139376b2e5f0c1aaba8e8863923

                            SHA512

                            5d98fa42c6a14b6a55d5053362d87616faf1671b2e73ab9fe1db74135f3805ecc2bafd616b83b64351ac199e29361e5509306ebf3ac3e28eef2c1e1cac6eac06

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            660cd48e2d738ac10ba66fe3b326dfa6

                            SHA1

                            b6b9ab7f6fb6ad8af095b80547ea0cef1bf67e3c

                            SHA256

                            76a00bbe40e76c3aa04fd627541dc50d32329b1b166e6e48323ef2b676106017

                            SHA512

                            e894e908ff4f2692ded9013480bb183eba16f5aff7fdf61b9d4dd88bd2a60aa48cab5886e7d341c988baf37c46efc85c09e0813fd6de3eec90758c758348c8b3

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            12510b1f1e938df1340b487dad20b50c

                            SHA1

                            57e56fefd820a6a8271c75016f175adf52dd5d9a

                            SHA256

                            705719d6e37e50bb7f02263866387312e0500ed259b6d4690536817a1113fba4

                            SHA512

                            55e7188d5c5149bee7c95a1bb844d8b4c72aea5c3ed9d484cce9c8ca366f749bb9c5094c7b2ca2e4e38b8e417bbff95df591786cfe68761d8d8b97617962ae55

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            b5d313d49c143f29051fec6f36a3fd03

                            SHA1

                            020846570056f3c76bada4082dc750258f10ecea

                            SHA256

                            eca8060ce58fdf226fd1fa4d09d4f6604a769677c55ae12f33f0ea7d89fff80f

                            SHA512

                            a0144d7621ddf7cbdfc605768cd12ffc45096245f79260d71939239c8aa62dd037c64d262935559e1a38d6b8be86524fee20b6758eaf2678e7dde97070635bd3

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            e99833364dc037e9f7463585333eb2cf

                            SHA1

                            8df80d40d0a427bfbfb874be43ffbfb4e5e95a05

                            SHA256

                            bca8ed41a1ba285446461bca8f572beecaf4b34fc9dd6f99c918dfbcb7bfce40

                            SHA512

                            1ea54c8cb297d60ac93811c94dfc882a446821725112a83f85496adf7b25a84994110823cbb9dd0418e728dceed5c204e72188b6892c19549d0835fd6c3de292

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            0ee4d9268c4cb66d721fcc97d81a3dbf

                            SHA1

                            12a48fd45ffa63986affc6fbffacbc9aef0fc221

                            SHA256

                            3941eb2867d01c87793a204de92ccc8748f8fd0e727342e76d73349044199103

                            SHA512

                            fd53a44e1f9550a646ff80680296a954abff0fa89849d9808baf7d315ee820cf352603f0e01da10b4991491d23f620cea64eebcd0be11fff8af3c5a0d87d1106

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            7acbc7f918d84dcbcf0a09438e4b3fc2

                            SHA1

                            611daf6b63a195e90dc9d388a87566a0a1c4205a

                            SHA256

                            6dcac630c3a2dce9dd7bf00f618fa0c1615bbb445ee521ee341d494104b38f1f

                            SHA512

                            a3f615e8db5a883aa4fcaf4c0d6fc6fbf778cd0a20264f41159fff9801711b4d0115d91325f31d7498cd357060513037105000eb51f848d4b244b20c1326618e

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            9b916843c59ce6f91157e2aeecb9661a

                            SHA1

                            f3e9711ed52ca48131ab3b02ae9ba159d9b27126

                            SHA256

                            4a7a841665ce1105120ec6a07d5026f6e8249aa3f4e3fe6e12bb729badf8a582

                            SHA512

                            53e793eaee282b0c4911d38dd8cd0a011cc7ba61161456e2434282aa4803fc7621b68a5171b4738f903fb7b2bf05394bf280dadd5f6234c131165e25c3a48993

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            89f09dcf49dff821014aeef1c305a8f8

                            SHA1

                            b7575ead401678bae9418601d2fb1d9e2be5e7b2

                            SHA256

                            1bd13cd741919b3291e1ee39f7b3f1b4b3ea537f5bbde095c13c9573d96a04ca

                            SHA512

                            a077641f71202792f89f2f64d35db42d7a59223097eae22cda70b3efc5776b1d1eaad801e2b46adad0b49ab21f53a6c59b0a47658d59e32027502e8b12601390

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d27c3952-e091-4bd2-8c29-f92f605ce99e.tmp

                            Filesize

                            9KB

                            MD5

                            08aacd7723183595b63bce56b201d569

                            SHA1

                            1ac068e90c4775ad789c1fc31fa759e00124e065

                            SHA256

                            570ad8d773cc6a7dccdb52eadde45a249bc5df2e5cd99c8cf9ad96d6e534effe

                            SHA512

                            544f5ade8618924f730281f7bd8a545b3ba1c7b9664c88af1e3753454f64c88d7cd424d9c5942159736dce3da5c3e52e67d1e5d65c49972ef2f6848c8b9f2ad7

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            99KB

                            MD5

                            5957afabbf726dc9188c6eaff8d5b594

                            SHA1

                            2fa137db0e1cf354144d6af4aa9ae762657dd6a4

                            SHA256

                            c0ccf46d0da6f7c0d6f883537443d1af4d303065d536b77d1d78c181e56a2b1f

                            SHA512

                            907ca76c5b803621bf8e35fd32644fbc6e110a9c40d68abde1934c02dfbc915bc8dd1465bc054622c7ad8a6feada64a5453f4940b111ef61ec3724b451fcec05

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            99KB

                            MD5

                            40007d3b70af51a875b28b61cc100929

                            SHA1

                            e36789462c6f42abea7a36ab65e7d613a0002e58

                            SHA256

                            0cb5d19ac86f20154094f686545fdca7a0934d8f8e48892ae8e2e6ea1838802d

                            SHA512

                            c645be9245c3f56974f9e7bf37729017a7df2c96933dbc8dc87b3a1b863a4dc6427cc7f12cc91aa83c04e160ca4d19a0e5693047cb03b0b592f151d8c54c823d