Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23/08/2024, 23:34

General

  • Target

    https://ww4.yts.nz/movies/shrek-2-2004

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ww4.yts.nz/movies/shrek-2-2004
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3232
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffe26cacc40,0x7ffe26cacc4c,0x7ffe26cacc58
      2⤵
        PID:4992
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1980,i,6753202950790067011,3338472320049141235,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1972 /prefetch:2
        2⤵
          PID:4636
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2040,i,6753202950790067011,3338472320049141235,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2116 /prefetch:3
          2⤵
            PID:448
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,6753202950790067011,3338472320049141235,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2588 /prefetch:8
            2⤵
              PID:3920
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,6753202950790067011,3338472320049141235,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3156 /prefetch:1
              2⤵
                PID:2060
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,6753202950790067011,3338472320049141235,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3208 /prefetch:1
                2⤵
                  PID:4280
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4676,i,6753202950790067011,3338472320049141235,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4076 /prefetch:8
                  2⤵
                    PID:1964
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4808,i,6753202950790067011,3338472320049141235,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=208 /prefetch:8
                    2⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2528
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:3404
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:1252

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\59a382ff-0e2c-4ecf-bcd2-b1805b10fc2b.tmp

                      Filesize

                      9KB

                      MD5

                      1abf47eb8d7feac882c65cf836d5db70

                      SHA1

                      ec63d96a040917dc261491d401edea55f6776ed8

                      SHA256

                      40f1373a2115ea3a8be0980a63fe9b9118750f06396e15c8b99cfe12a15943d7

                      SHA512

                      fe1f827e5b27bc664d59787f82f76c4a066bb97206e9a8520625a3f91c77f4cfa65eddd9e0670c17f1408b9418e076cf7a972d25a97c858caaee22a8b81df3c3

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                      Filesize

                      649B

                      MD5

                      bccbbe1c816b7c431c9f5c1c345ab1aa

                      SHA1

                      b43d68b19c1e72b7541b0aecd868c711232fa142

                      SHA256

                      43f3f149c76d3cfdea0515c7622bff5e0e8545933c023cd2c247dcbb26cb6421

                      SHA512

                      11d9b84dee869e32422cb0c948b685a6fd355020d23d24577fc37cd9f2d7451534024e9dc6c19619aaa14e8e534aee27766b0a167bdda0da70801a76728939ed

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      240B

                      MD5

                      7058026632ff12fadf2583aa66403aae

                      SHA1

                      07770a8022df404a6b9002c8dd556e31803e78c1

                      SHA256

                      3bf9f39f409be0ddd71fd811d103219daa2b72c339355afeb9b721749586f399

                      SHA512

                      656ef78bea52f6e088296888234d039ad4cec25677f9a73be6f2dd684f65dd58c910854be4f34f5759ce7aa517ac8161f04d6984dbf6c96000127e7d57ed923c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      2KB

                      MD5

                      425097568970dad7538561aab400f577

                      SHA1

                      6643274b404373038c09ff78ed9b7b5680fc582d

                      SHA256

                      285e33476d8a02bbeeab70567dc42cb60c7eeff6b74f7859a818e9a6b59119e6

                      SHA512

                      e9244505e6a29435534c8caa425cb518b3952779b2853321222ff82e4adad801f8aca43fa62aa6eec7e4c0b5985f20627a5aed96c2070e3da558e2415ffa559e

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      bb9bb861ceda868529e91ba6a21ac01d

                      SHA1

                      6850b928f8e3d36370b331dccfbf234ed41e3924

                      SHA256

                      53f2844359287a8f7c2e42d111958325e1debe0650972815788e3ec36acd73a0

                      SHA512

                      41f56b0a70477882882991c84c5fba3cd04118d3eaa6139aaacc5d1d1b5dad3927336f9474fefa3aad1db7d4f052fe7b32ed6f09880998c9553b2693688f8610

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      a3a4a8ab56288e2c44003de7214668a9

                      SHA1

                      c1c23e29ed3ee219ea26c5763427a960af01a9b7

                      SHA256

                      82626a63ce929b4b72e0ae6ff28ae52d852099ee784c71c824cae512bbb2c4c2

                      SHA512

                      c2832ecba4b27f679d47612a04f4c9e4de18b358c687e3194a91087a89bee857f89342ebfd32a10e9376ad9143bcf7f88905f7dd8ed709e7f307fdf93f79d60a

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      c0a70fc96e78b57667b79a66fcb1edee

                      SHA1

                      1665b33b8378d9985a0fc320f6a1916b77272314

                      SHA256

                      71ee912f9b053cf0a0a93842f634fd81f5d13af9580dbb40824b36ebd5ad8e51

                      SHA512

                      63a8308a2cf3a08ef531ba4a0f188857021f26112d6f653fce605dba53afc980bab7db658471537d342e619025fc13e921ef1cdfa2f733ba7cdb5d1576d89d0f

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      fad2f12ccefde6baf3aec655d0c40847

                      SHA1

                      9abbf2724728ea1a3aa15339701ea566493b9136

                      SHA256

                      54387696135b633108f7fe91947dc63fc5b260f362be84509e9a2db16f3f4c80

                      SHA512

                      0c69654221f7151319497876ec29e365b002a142e86b30cbe3ef14d0b86a5b004daaafa29fd05468b6577ded8899aea7d8222aded3538c2c7859b7fdef31328d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      30a69778272b08014062e782bbfd2608

                      SHA1

                      f129ea21397b0b3ffadd2f463bb2d30d95a0818b

                      SHA256

                      7ed299caacc76a50f80326f3e6d4fe3edb42a627ccabdd58d60d50db60fb28b5

                      SHA512

                      72963698dc7ed5cd66416946efe3424aeff066b79490a0209e11338a03071bbaae86d9ab49f8bf37e36e4077aca4a964b60f0cb8b13942631c62f57928e058be

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      06b50f904e2f6f0ed5046b70d18355de

                      SHA1

                      c3d26ee96a36aa6c1f1bf976c9d3bc7b1bf63ca4

                      SHA256

                      cec4de5c3c1f18e36a6a2632239d7912fd4be26693c089d5262730b02ba96d3b

                      SHA512

                      a07117af8547b0104fe5e9227a74c23d48816a9b7d876ad5a04e8925793cd8948d4c01520d36ffde5e50199326fe379d3dfb3488880ae1bb728038e46af90af5

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      8247833a61d3e175a8e31f7709efd0ae

                      SHA1

                      dddf820982e34361de043ffcc3f4ea09d3286672

                      SHA256

                      d5dc2f43ea72ccaf63501660adda0e9de6dab37504d3a2f3e226ec67e52d2bd8

                      SHA512

                      efd63dbd1e2b2ee5e7c603f4aecaf74b88d191f282c4dd31e6734eaeea22cfa235cafced8a48f38d8bb8a1e9a9318f28a17cffae59d14a53bf981e23f59cbf04

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      91694e3e58ba7c8023ce6f90e7c59cd2

                      SHA1

                      82b08fbe112849121fc6f09f5392ceed5806955a

                      SHA256

                      0b1f83cb732e841ce721444d70e456e256303b6d998f31f383b4b7f718e98dc8

                      SHA512

                      ba84ae6bc1aec765aba59a30f9ab0cae74f7bf75b95ab74841bc917ee9382029826cf25fe7c456b3603ccec0a914bff433695d9b84cdebdba8f6d8fa6cc9cc90

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      112a966401045e82658e87e20bb21358

                      SHA1

                      e6c9b82573df21694ee854848405d88e0408c6fc

                      SHA256

                      4b3ffe13a1571e32391a6d7dd40ed52f18c3423b729d0dcdce475ea86b4c58a6

                      SHA512

                      d6888d1b4d7da18ab275ae667c03c8342f0083435de8d8b821c69a9181d9dbf85e8370b432f9cb4726ed19c52da2fa174f9050de66920865fe712321fc04b90f

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      91303e4a680e81a153a90e951a031c3b

                      SHA1

                      1015ccf95644cc6db931f0dfcd0d43494386ec4c

                      SHA256

                      911e8eff1a3c270e4ec7be4e5e7ac61243c35c614f02ad42879c4d03e1069765

                      SHA512

                      f4241aea7f0083d791039877fefdb1c87542fd257930a2a351a1332dcb71dc03a70addb3e80a602bd8868cb4583a3929c41ffc3188aed2c23c369b269b9b8763

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      195KB

                      MD5

                      185bf11af26b07ddf07d99eb1255f322

                      SHA1

                      ebbd68fbf8f9ae494d840878dcc060d1087b6b2f

                      SHA256

                      4cd18b0b31d450f2992fee16cc6fea76cf814f450160e0ff2a613a54c17795b2

                      SHA512

                      24aad1540a46ac42eecda692c92a9fadfade870314a0c667983838917125115f491562eda48aa1b03aec54a42787622aa03bc958872981f173de00cd8515cbef

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      195KB

                      MD5

                      872f6fee05c5748f7e577b16d2530ef0

                      SHA1

                      13c8fcf2749c9ffae5f2967bbba7f9f702e70d7f

                      SHA256

                      28b2686f4a4f2a796595b7ab97ca64826c7e1af06e164f78223a2e72328543bc

                      SHA512

                      de7f5646acea2bd14d429c42156f693100170835803544416f8786e405d04701a05b1a11436f97fd9549d6a2f32ea5beb931518d0bab60433f9f733234efcaad