Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/08/2024, 17:46

General

  • Target

    http://menorex.com

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://menorex.com
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1468
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd4,0x108,0x7ffcafd9cc40,0x7ffcafd9cc4c,0x7ffcafd9cc58
      2⤵
        PID:1064
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1964,i,5141592873904469138,18346612479611111092,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1956 /prefetch:2
        2⤵
          PID:3620
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1924,i,5141592873904469138,18346612479611111092,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2116 /prefetch:3
          2⤵
            PID:2496
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2252,i,5141592873904469138,18346612479611111092,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2624 /prefetch:8
            2⤵
              PID:4440
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3044,i,5141592873904469138,18346612479611111092,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3080 /prefetch:1
              2⤵
                PID:2128
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3048,i,5141592873904469138,18346612479611111092,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3196 /prefetch:1
                2⤵
                  PID:2556
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4536,i,5141592873904469138,18346612479611111092,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4048 /prefetch:1
                  2⤵
                    PID:3548
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4784,i,5141592873904469138,18346612479611111092,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3064 /prefetch:8
                    2⤵
                      PID:3624
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4988,i,5141592873904469138,18346612479611111092,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4980 /prefetch:8
                      2⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:432
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:2020
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:1536

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                        Filesize

                        649B

                        MD5

                        8266c5a3343bf68b4d31e579e60916b5

                        SHA1

                        a93d5f6cef452032b2b83fad46b16d6483ad73ae

                        SHA256

                        38ea05b3f18d0f48944a78c58a2643fa8414f68f1a9a10061180fffbae8a4e3d

                        SHA512

                        90c1c22945fafbd26024e5d46611a60c22e030fe6e82ba4c4c2983ea3eb77fd40b5c4d4df21abd3cc2d6acb53162226ffe0dc720dfe11bb2e6d77e774c10d1b7

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        1KB

                        MD5

                        73d98dfce4c813545adcea41b43a6e13

                        SHA1

                        c6f5aad9ed43b977457c2edabb03d15a7ed73638

                        SHA256

                        6f95f52ae7eb0b3f48b4e2a8a2ea7e7359f8ea3b533f20b272e4e0edc6ded428

                        SHA512

                        bb9dfb8e26afad8a4bf70dd823678580da3230f4fa2a5cf113ab6c10c6de6026b963c9015f51c20ac7eacda3659270f6d4fbd4d94ebb8cbd8f90c03d6ed55fc6

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        07c0dde4821858e4d05a993cc37bee93

                        SHA1

                        652a0631486df1c464f044e907bea372ce32a03f

                        SHA256

                        2f9863b4a62486c258ef6a514e4dc2428446470fb182353270d0bdd9d85be178

                        SHA512

                        3d8cebaeed85949c01bc4afa87f76f9b68b83d5305fd8fcfa1b860f8e9f38bc80a2430b3efb705edda8e2d0e372c9825675b6313b0823d59e596a3fc89859fd8

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        e970a4b4b4e7139143f04073b9fcb5db

                        SHA1

                        5dc40f70e560faa43199157d912863128acfde53

                        SHA256

                        bbc992c1bae3cffa89fc2cb93224559bf385cd15ade15b7c0ef6e10b16fc0124

                        SHA512

                        f430926c71be7c6d10cafbe8806d63543a4640c9054c1aeb1702eb8f23a5d5eef456f57115537c7a73815c540d6779c8ff1c6ee1de00f28a3d30763678734dbf

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        297fad9ede0376f205841d8bb16eeff9

                        SHA1

                        288975cfc5705134dfabce6808ef727e08becdbc

                        SHA256

                        61f1b7c3ce231398a29ea6f2e2099f0412563acb4e061c9ed4ff5d81938d4da2

                        SHA512

                        8bf6e04f335008c0f019d662434d9bc966fabba8bb9cb46b2579c437f870fe72455268754224d22d7025c6dca0adc8088bb93338fcd6514550f53e68fe055a75

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        ed647d1c06845637b38d6e4865379a18

                        SHA1

                        c77f7165a70c25ac78405502712fe986d9269224

                        SHA256

                        e176f74f8aa8d516d628a361446352ca1ffda8e1e6e6c5a7a0a8c55040a49970

                        SHA512

                        35c56e5d5011ac0e7cb29aae49caebea221ee0f8a6b7c372468198641651912f02b9556eee907622d0bf084bfd713b865d1ae9ce113b0922f52fc56e9bb736d5

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        83c050adce18599c388f95661bd20925

                        SHA1

                        e368c81f87e6477eb8c78749819c7644025f7e32

                        SHA256

                        7c05e04b6c1da08a396e006b20761d5d4a36496af7fb6b2f5e49628910be7274

                        SHA512

                        a7e6b1f2134a45b48e5f3efd61f8476eb4d1230fd655a1def08e44bf56d409923582b124394adf44a22e1d4da438e68f4a790fbf090cba3029b439d6855ecae3

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        24822e6c65dccdd413c0e43f393719e2

                        SHA1

                        a9ae1e43347c65a036b5edef2b984e93f01edc12

                        SHA256

                        90b60da68dacc7a999202a4ff8a2e804725d67dc6c72d5dd397b073718c0adcb

                        SHA512

                        79d92775679928dbcfd5881ef17b1eb3129060b8f889fb812cdf1076e77cadbe8564e9eef23e1b8589c8be28c2bff771b8b50712366f19dbefaf12ef85ed5427

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        c8929ac8fed884ae76f4562468a99051

                        SHA1

                        0dd4823ec929d9150e073e49b2be3524b1215f0c

                        SHA256

                        3c7a355e3da84dba08554a65d60c53c80d6e37f9e4fbd7c45409b1d85571c037

                        SHA512

                        73bd89182cdc4c4b1d2fdf8e3f271918863ccbbe724910d09ef765a8bfde7c0375ea2d6ef5272e5335d4a120a373c63dddfef76b6d1a5ebe6a0e1ed51baa49a0

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        9ace7961a01cfd0fc1db01e64b13e349

                        SHA1

                        0f55d38eda4df4e6c686e8f98650c4f700c9fbb1

                        SHA256

                        8f780d927516ed49b4f0821aa4f50e0a43b9bd45c8d9ce2b9f328a0e9c14df13

                        SHA512

                        6c80d836b817b93dfe281e5805d67c566218c96ad549effd2e258452c578bcd773df08bc6926559445243a5d3492db47b313508c67718a25922ee1682dcac378

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        ddb38204943476e11a4cb32371141d34

                        SHA1

                        0eebea5d1adb77da26822a1d0d98bd57c197d6b1

                        SHA256

                        192d12eea59dcdb3dcc7db6dd040a870b6a226da6aaa5aeb565ad1755376991a

                        SHA512

                        2de29ace8e23d033e12f5fa1b7450432005fd9991025357dcfc9d852683f8489bb7c98cd162de15d941a94e512fc90d98c18e1d17ae1360dd5387b2d7959d4df

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        7db3a06d66a3ee3ef42f8d04fd0c1fbf

                        SHA1

                        1b6a747d8ddf023c1ac3b3855d85b22da0501341

                        SHA256

                        48ae4f7a40547cb27967154a03556e3991843342b4368caa706193c18dd81d74

                        SHA512

                        926d73cbff9a64425bc4559e677bc809c1c5a115ab2f695b74f84cb20b246bebddae868fb7dbdf0c5f29c203867e7300e0e553671ef9b3f2c36fbe5a8e6ea359

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        6211f42afa5c6675626d8294719f2b3f

                        SHA1

                        ee5c1a55fd5bde92180af8795058c38e843255a1

                        SHA256

                        31e81773118bc24ce7c3e62e0fd22090d45bf3519ffbc4ae7c38ff373e0b609a

                        SHA512

                        f6e473767110e492961e84d2a79aaa39b14223b3be681dd66cbadf720310ec0a9632573a4798d14464ff9f8bc36739288bdf53e64940925550752f11e2b076e7

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        99KB

                        MD5

                        47b7ecc52d62dbfa33419c425babfa8d

                        SHA1

                        55bc9648242574de5b89b2d0e2a1801c9df19758

                        SHA256

                        6ba884ee85269d739d05cca97618eca1762f2550e275e6e86696d6e7ac05e4c1

                        SHA512

                        5a9a894c49d67f1b9475bb18d0f530c44cb1f4c3fabb8ef2af23f07d5b3bfd1871672d3360110c38ad6495a0f2257b84e807abd13949f013961fa401ab9621e5

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        99KB

                        MD5

                        a5d9b098bebc1b7cdd842116c2ef557a

                        SHA1

                        bdabd15fc4930c01ca23ecd4e20b9dfafc0f89ea

                        SHA256

                        405a79751d6cc360b23ab6eebebf3a841fdc772f5dadc865fb13e4e777748929

                        SHA512

                        181f34d98cca8e660f061247d0557c0c8869cdd8a3c2779e68fe0aed0caf3780a3736871d47fc2461668f7cbbbea2ed56b659ef806deb64249a2e6bf3f5d8a1f

                      • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                        Filesize

                        2B

                        MD5

                        f3b25701fe362ec84616a93a45ce9998

                        SHA1

                        d62636d8caec13f04e28442a0a6fa1afeb024bbb

                        SHA256

                        b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                        SHA512

                        98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84