Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

19/08/2024, 13:22

240819-qmnlfazcjj 4

19/08/2024, 13:19

240819-qkxfkawdjb 5

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19/08/2024, 13:19

General

  • Target

    http://www.bwlw.fhndhnedx.com/

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.bwlw.fhndhnedx.com/
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1616
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb6c0ecc40,0x7ffb6c0ecc4c,0x7ffb6c0ecc58
      2⤵
        PID:1572
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1872 /prefetch:2
        2⤵
          PID:3772
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2112,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2120 /prefetch:3
          2⤵
            PID:2040
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2196,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2160 /prefetch:8
            2⤵
              PID:2824
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3004,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3020 /prefetch:1
              2⤵
                PID:1076
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=2992,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:1
                2⤵
                  PID:1104
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4116,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2984 /prefetch:1
                  2⤵
                    PID:1816
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4292,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3208 /prefetch:1
                    2⤵
                      PID:4580
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4448,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2984 /prefetch:8
                      2⤵
                        PID:4912
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4708,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4440 /prefetch:1
                        2⤵
                          PID:4792
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3272,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3260 /prefetch:8
                          2⤵
                            PID:1604
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3312,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4484 /prefetch:8
                            2⤵
                              PID:568
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4812,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4560 /prefetch:1
                              2⤵
                                PID:1444
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=4828,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4680 /prefetch:1
                                2⤵
                                  PID:3136
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4984,i,8941549661121307291,8694458154797998431,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3240 /prefetch:8
                                  2⤵
                                  • Drops file in System32 directory
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:3084
                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                1⤵
                                  PID:1052
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                  1⤵
                                    PID:3204

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                                    Filesize

                                    64KB

                                    MD5

                                    b5ad5caaaee00cb8cf445427975ae66c

                                    SHA1

                                    dcde6527290a326e048f9c3a85280d3fa71e1e22

                                    SHA256

                                    b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                                    SHA512

                                    92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                                  • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                                    Filesize

                                    4B

                                    MD5

                                    f49655f856acb8884cc0ace29216f511

                                    SHA1

                                    cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                                    SHA256

                                    7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                                    SHA512

                                    599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                                  • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                                    Filesize

                                    1008B

                                    MD5

                                    d222b77a61527f2c177b0869e7babc24

                                    SHA1

                                    3f23acb984307a4aeba41ebbb70439c97ad1f268

                                    SHA256

                                    80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                                    SHA512

                                    d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                    Filesize

                                    649B

                                    MD5

                                    0c6224e4d71466be4447596328c49de5

                                    SHA1

                                    65955ec73572c18b9a29b76378f4d0b49a0d4a79

                                    SHA256

                                    972a54f4cc1d472bbed6686c5a23a3f9c5e90e6d865e81db8f0df47ce5254255

                                    SHA512

                                    5962a6ead115fd575a288043f151b4f5789683c2db05778de976bbb0a7903377da3ac51d0b777a1d1a4885b972b6b3c616e71f25354394e225d8a686e32e0a5f

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    446c1c2f412e73c7970ef12c07111a65

                                    SHA1

                                    8eee77ae6872682ababf0a9bb387952a5534e5dc

                                    SHA256

                                    413020c886f9af584952449ccb14e869bba21621af0a11baa3ff3bba999214b6

                                    SHA512

                                    897724552d55e66c350b65cfbbe6940e7f6d27aa399f2b6da6f0d04ded41308024e09ffe2164483c367bf84196849af0c0156eaf6d6f9fdad084bc165e59375a

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                    Filesize

                                    2B

                                    MD5

                                    d751713988987e9331980363e24189ce

                                    SHA1

                                    97d170e1550eee4afc0af065b78cda302a97674c

                                    SHA256

                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                    SHA512

                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    93aa45a9ef016e5cdfd76aea90471721

                                    SHA1

                                    6c3af2c9abe2fc9fa5cb2b6d32dc4f98a0678f76

                                    SHA256

                                    245a7b6a087c9b23b49f1e9ef0abc604ea2ded3ac13e6e79aec30701bf61296a

                                    SHA512

                                    82ed9fa57bb71a5457cb8b4569a3ef7da22b87a6a14b8e8dacaffa4796e3cc7990e757c2070290569fda26522cfd6ed058685db9f95284df6af2ee69b35c4461

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    0000e21587f7331c2c666a936d200624

                                    SHA1

                                    7f50337d51e655140afd82aebad2668e8a840095

                                    SHA256

                                    6d2fbbfd3160d5751674c57a80d1b5931334ad2473288d2cafc644278666c181

                                    SHA512

                                    6870cb9d9283717abc464f5e42a14050343ef455b9ef1902f4473768160b774eb4db1a9aa85caec7b6716d9e674b7a25a6ae0071dd566e2cb245e3898f07bc20

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    e8dfbec806ce18d32db204069c8b2537

                                    SHA1

                                    c527e332bf5e50a6770467bb9e0d64557e7edef4

                                    SHA256

                                    aca8ffc59b18031c240f1e1f291642844b3db595dd445273d9c51e2ffa70254e

                                    SHA512

                                    af05a1540b568f41683d8d5c72f7d8a4070bb46b34db4e5a6ba22099eee8f1ada97e298c9408a2d868b0e33b140ad6ba7237addcfce53a12c9729f9ce3eef09d

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    ab496447a2df4022dc4418856dd72838

                                    SHA1

                                    ea6ffb5cc1a90f1f99b48a67afbc3034929eaae5

                                    SHA256

                                    031969c83f02677c2747fabb301f7bdd989b1e6e044201ffa8d84e993ef864f6

                                    SHA512

                                    1f82883962db39e8d4de996133dfb7ee6ba6df15036377c8e78a842f832a656bdfb1215bcd537798c39f1f925cb7920565622281e7d6e695ec8376b2ab89bc33

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    3e3d7cb0065fcdd4d95a59e05af3c09c

                                    SHA1

                                    7df88a88cd7704a7bd38fda687a294548270b2c4

                                    SHA256

                                    9a9cc5e2498c1f68b89d799a75ea9f1bc4548c5bafd21215c18c38c642fd4e30

                                    SHA512

                                    e0fe6bf5e1b5326ec040f2d1b8591735ef492037c44f33fce47150adfe88f5e63f570316f4cf184e1776bd20cffb0067f62e952c2915193f49ebb9c1bc7e4d2d

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    cd834431ff40b93ae355b5d43d106908

                                    SHA1

                                    07ae185e6bc83791f8e62c07640697dbabbce9f2

                                    SHA256

                                    d0150f9ffe36eaf0ee918a697cbcfd6371c9abfd8077efe723d353122774042d

                                    SHA512

                                    3d4e8188f0e5ae08e427886c4f0ee5a448328de6ec6ffc19efbeeca35c09d1e67ea163266125b85e54f3d3b6238b7f3edfd597e455deadbf246a47872270d850

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    a5aec9d65c1f674bc2ae7fc60b5f4eeb

                                    SHA1

                                    3e3962672d2d671c6cdf88c3aab0fc388bfad399

                                    SHA256

                                    872e4933815684c1b76a0926963e5673b77dca695a45e0752aa0c9657e671549

                                    SHA512

                                    3d860fc0991c80d6ae1b79318a411d6b969137d09cf562629bd607bf6db919793a10ab0901e4bc2a44c9dbd01db1059ae1183c759bec09593f73b1cb24a767f6

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    d8ed281452623f608e52fd1bfd912997

                                    SHA1

                                    39e0c556366f0a3481e85361de8c766534f38268

                                    SHA256

                                    dca89dbd7bfc2eddf8a977838731b1961176c336650250d66e2aa65de996cc09

                                    SHA512

                                    8e6a87b477dab7d8ae61f816512646d3bf3f4686d890a059b2b8d08d37199ea02425bed73238a7c539e9019a2c9eb913d2a4857abad7b537f2ee8e946d86353e

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    101KB

                                    MD5

                                    9635afda298552efcf27134ef7803cdd

                                    SHA1

                                    9e775e443bf08c279bc2e5ada32ab5f87dd33eb2

                                    SHA256

                                    9d43864c636b3a27074bc1782eb417455c95c56343ea0d6d2474e67cbce96573

                                    SHA512

                                    3ceb929b2de0a8c6a346c6bbbc10ee37f93d2debd1b35ae6c0be069f79f3b9202bc06f21499157072670e0ca9e5523d400a0637488fd1eaaf1a7bb7c0d846af8

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    126KB

                                    MD5

                                    c93e8238d3176e5d8a1251a58df463a3

                                    SHA1

                                    30fed5520cf75df373932ccf01417bf499fc6404

                                    SHA256

                                    5d2380315da2cbdce1cbe322e5aea7145f30877edf21ce1a72b3ae5690ed1850

                                    SHA512

                                    11306f83997087f890d845a39847ff97a5c96fa878ef34c1e3c27f9d8ebd2bbdd2ab875aff38b5921119f31456c2ca035e4d1bfa959abf6c56b1cceead7a26f8

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    101KB

                                    MD5

                                    3e7e84ada7d813b1d41913d61cf29865

                                    SHA1

                                    b5222b8fd646f122fe760c2a53b52587365aa645

                                    SHA256

                                    844acd6705a04db04246af820730408f6c731f58984cd03cf32c31b2e657778f

                                    SHA512

                                    3fd3998ba13b6ac5de5f9e57f879c2489ffcb5a54bf434f00f52fa857c08237c4e1ed53f625bd8bdbd0bf237cf1faa0e24469de0f268f30efe13690aeaf16f1b

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    101KB

                                    MD5

                                    3f61239bbf9a0715bc8c7e0c305aad8b

                                    SHA1

                                    4806c0fec279e204ad02737873f3b59ba298810d

                                    SHA256

                                    d3951afd842ea0d132fb03c6022cbd8ea4cec668c74029f0a4ff286cff0df681

                                    SHA512

                                    b0489517814cfb266c26069699359073cb0c26725796aa0221ceddeffb94ee814cc23490d70103e98caa8f9d8785c0d8e44ac62c28f6b22fcf4edeb229bd6a5f

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    101KB

                                    MD5

                                    8352adf3ffabfc238d417fa2c7edf6bf

                                    SHA1

                                    1982e21dc0375635c28eb2a60940e163ae45267e

                                    SHA256

                                    94108e8e07dac9c6a0cc8430b72fd12738334989ca2d76128f8dcd29a654e8df

                                    SHA512

                                    4ecc6f26d5eb76b03e6a46f2ac023ecd7d741d1ef45cfab3b5f33dd206467628d3a3102ef60dabc93e1f0285da60478f44e37d48f12f66bd3f478f3913930fb2