Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/09/2024, 10:22

General

  • Target

    now.html

  • Size

    249KB

  • MD5

    9c7576ee4bfd5275d469023267a47686

  • SHA1

    7c7b89053e363757f3940cd1dbfc29dc654c3711

  • SHA256

    dc0516d0bf70f2400d7488ffaac501c781e2ba31865cd3338ec48016404aa22b

  • SHA512

    43c6a0f56e44a27ddb07c6fb40ee7235ef1c0a51d03773bb1c40f6aa7d53e2f71335080ace6c57962832360ac4a16a7bddbd45bf683832ce5fcb50fc28526d16

  • SSDEEP

    3072:BatkFro/Wp2bbuYKNqV0gnMPOCScLjJ7PuBxCxNtNe2:BatkFro/Wp2bbuYKNqV0gnMBScLjJaUX

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\now.html
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3372
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb269ccc40,0x7ffb269ccc4c,0x7ffb269ccc58
      2⤵
        PID:4548
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1824,i,10545606504590569106,4385586404109326701,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1820 /prefetch:2
        2⤵
          PID:4380
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2056,i,10545606504590569106,4385586404109326701,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2104 /prefetch:3
          2⤵
            PID:4736
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2144,i,10545606504590569106,4385586404109326701,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2180 /prefetch:8
            2⤵
              PID:4600
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3052,i,10545606504590569106,4385586404109326701,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3076 /prefetch:1
              2⤵
                PID:1056
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3060,i,10545606504590569106,4385586404109326701,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3112 /prefetch:1
                2⤵
                  PID:4208
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4528,i,10545606504590569106,4385586404109326701,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4552 /prefetch:8
                  2⤵
                    PID:840
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4680,i,10545606504590569106,4385586404109326701,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4576 /prefetch:8
                    2⤵
                    • Drops file in System32 directory
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1152
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:4244
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:4184

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                      Filesize

                      64KB

                      MD5

                      b5ad5caaaee00cb8cf445427975ae66c

                      SHA1

                      dcde6527290a326e048f9c3a85280d3fa71e1e22

                      SHA256

                      b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                      SHA512

                      92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                    • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                      Filesize

                      4B

                      MD5

                      f49655f856acb8884cc0ace29216f511

                      SHA1

                      cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                      SHA256

                      7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                      SHA512

                      599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                    • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                      Filesize

                      1008B

                      MD5

                      d222b77a61527f2c177b0869e7babc24

                      SHA1

                      3f23acb984307a4aeba41ebbb70439c97ad1f268

                      SHA256

                      80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                      SHA512

                      d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                      Filesize

                      649B

                      MD5

                      af79edc81d38b45fbd3972b728481756

                      SHA1

                      d5c1dce8373aaff511a4cb61c49c16fbf0ae02ed

                      SHA256

                      53cb48700619943a5da6eec97873b4c4850c2ee69d38d15fce4db607c0ead02a

                      SHA512

                      4f64eb547e540fde36e748f8cfe3aa17b6add1e626925c2a49f08c39e558c3d1774eafd09521ae87367bb16ba3f698e05f3b143fb3a424cf486803394fa38f3c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      1KB

                      MD5

                      af845726ac0f7e99158c06464dcc453f

                      SHA1

                      4bd71d7e05db53bccd8944eaadd4f40c051cd92d

                      SHA256

                      30a512093e0a730bf699d634bad8b74b9d31904e90507c9234a54d13cd02e5a5

                      SHA512

                      b3164953791072220fd0b8b78e50b0f06e2ed716c3287af4ab09e06e64ce3baf6e8b10ed1fdc9f6a2d62edda87bd45ca56c598c79ee425e9eb7b70f39d81de1e

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      523B

                      MD5

                      4aa22e4a58f9e237ad6482986e2a230d

                      SHA1

                      ece17cd77dc99070a114fd6549d7628b47bacc59

                      SHA256

                      b7de99a07a0cd0b1a947dd2f49ea3d5cecdbf8f99b667623bc4531922d57a0b2

                      SHA512

                      ad9d4ef61847313da812c2e115d9adaad4dd74a588ed253f9750f307c3a50045b309ea4af3156e96fb27757593295e3922bdf0fcc1e5cb85145fe7b6d91aff0b

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      c4d9bb630f36f3e7d5978fba2ed1c369

                      SHA1

                      f98cc3c269f2395094da4c4ba382c5769f42bd21

                      SHA256

                      f35e5cca8b22d49fa07fa08d4caddcfec4d56ce817c48605832c395319ef1259

                      SHA512

                      6ae072c8bc690e78ab1b923cc7ea04847eb2c6c7e84b1c5e9ef73ed4b318ac78fa25b3df743a573f81fe0315e94249e2f6c1e59613bf411ac1b051fcd7e0c7dc

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      859dd4bdcdaede6bf86aa6143f341188

                      SHA1

                      517314e161da27252cb38ef985c4e28eb52225fd

                      SHA256

                      421fe11077d81873c98cc3ffcd2c6cece0f46fe7ce2a5f890d39a25fc54d3687

                      SHA512

                      7cfa4330a5f54f684194562cc919e439f926d2cbc67dabcb9534ecfa4659b15844bfa24896713e8c6860c14f1697e0af0b83d4bcbd3049b9bd9a0788a64673a2

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      f9586092da151d4bf7cb1405acac4aaa

                      SHA1

                      a4acbfb8bc2a52f8c79498d7233accf85d55f6e6

                      SHA256

                      e1e7bb6beff810afba16932ceec185802deffe19b123bb7812b98f9cfbf4f9ed

                      SHA512

                      78fe5ba7c5466003a725f42aa877b332a923e985905073b2d33dee80b2dfdce6f1881812d004a9eebf620b471440817efdc5eda5a4cbeb6a29f53b9c98a47a0c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      6f7852b67bc8746e6ef7b18e4e709184

                      SHA1

                      6f5e50df1787c02f3878b38e3d13765fa07bacaa

                      SHA256

                      dc7f8814da50b37931e6a5d5b8c1d3f5890cbac701598aa7640b8496e7840b06

                      SHA512

                      c536dc65d5c84f93472e9906c6daa7a532671fc4fb55d67fd28d35760d035d37090618c516bc5fd750c6f2aa88a683d130737749fa2113b9fab7e37a5ae920c9

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      03345c99b52882c74e097bb4831fea28

                      SHA1

                      cf1fd71ffb7ed5d3a32be6fde82b2b8bca35911d

                      SHA256

                      c3b77baaee1e11154c52d1bcd02e7722f71f9cafabd05eeb03bedf93b32d876f

                      SHA512

                      c5bc65e56e3f17f3a3d9ca2f84f683143b83a82c724cb5f85f090b4064a91f236f6d4539c69455a60459ca4937cb5b457f350a2034f6b6666549bf0796058978

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      1add35c851c320fd74b69195528ce9b6

                      SHA1

                      7ec028c77d832f14c24415e3e920e11318e74407

                      SHA256

                      b7429877f8f248af9ee4354f1fead374573f701e400ff303e8e63290cfb9dc59

                      SHA512

                      0146019a2c4d54b2604693156ef63e2e3f32b628047a0115e548f97005e371398a6721e58d80029148970bbc3527ce1d0305a345fa1dd137a9a928d0a724671e

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      99KB

                      MD5

                      e0ed3a0f64960432de9f91a866ad403c

                      SHA1

                      c5783afe24757052b1eddb76926ea0d0ef1c68d7

                      SHA256

                      90c733d74f17a6ec9e43c824106d569763f3223cb027a9051ee0c379ed7cfd33

                      SHA512

                      5d013328feabba0c4f4fa707f8d4fb1bea788039ad9bfe787914a03b8feb8b9b2ba1f0fbb61e8172116a67712aff930a5c2c81c1ce49da0c7f183fc31afc07d4

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      99KB

                      MD5

                      7dfba327d2e6f4545d2d1168f81287a3

                      SHA1

                      42e404d81e3421e1f5a2d82d05f5bc33a89a0232

                      SHA256

                      6c6d2a0b9ec8f58922506063bf1b6947c173930efa36bad741e29cebc7c80da4

                      SHA512

                      fc42f4901b1407d710315d74688fe5e6a89cc003c6726a9f8b71cc696b961892d7d50a61d497a743461a21bdc67b9054c1396c21539ffaec8c25a5910d682094