Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    299s
  • max time network
    280s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/09/2024, 07:16

General

  • Target

    https://emp.eduyield.com/el?aid=28gedda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/innhanhanhsang.com.vn/.dev/cPXb8P9a/YW5hLmhpZGFsZ29Ac21pdGgtbmVwaGV3LmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://emp.eduyield.com/el?aid=28gedda0e6c-1865-11ef-80aa-0217a07992df&rid=33766156&pid=771868&cid=497&dest=google.com.////amp/s/innhanhanhsang.com.vn/.dev/cPXb8P9a/YW5hLmhpZGFsZ29Ac21pdGgtbmVwaGV3LmNvbQ==$%C3%A3%E2%82%AC%E2%80%9A
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffbb926cc40,0x7ffbb926cc4c,0x7ffbb926cc58
      2⤵
        PID:2372
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,12840341917753660157,14992897741907202162,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1904 /prefetch:2
        2⤵
          PID:464
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,12840341917753660157,14992897741907202162,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2160 /prefetch:3
          2⤵
            PID:2448
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2220,i,12840341917753660157,14992897741907202162,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2244 /prefetch:8
            2⤵
              PID:4308
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,12840341917753660157,14992897741907202162,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3144 /prefetch:1
              2⤵
                PID:1004
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,12840341917753660157,14992897741907202162,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3176 /prefetch:1
                2⤵
                  PID:2624
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4380,i,12840341917753660157,14992897741907202162,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4348 /prefetch:1
                  2⤵
                    PID:3972
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3404,i,12840341917753660157,14992897741907202162,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3380 /prefetch:8
                    2⤵
                      PID:116
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4868,i,12840341917753660157,14992897741907202162,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=208 /prefetch:8
                      2⤵
                      • Drops file in System32 directory
                      • Suspicious behavior: EnumeratesProcesses
                      PID:1932
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:4972
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:4324

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                        Filesize

                        649B

                        MD5

                        fb5f226829a935b7b6e1a53be34eb292

                        SHA1

                        556e3b36e602923fd8c90871f80f947a90f18ebe

                        SHA256

                        140fc3f0507077ebb32f22fde60ab130124682edbf2792b446a16002a3c051e7

                        SHA512

                        da9595b48284f9cc6ffc437f88911649960c6d85b615d3de201cd918687bfbc8ac466420408b03d6ba9e7d0adc1593dd209b71c66822f20ff2aeda8b240870a1

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                        Filesize

                        211KB

                        MD5

                        e7226392c938e4e604d2175eb9f43ca1

                        SHA1

                        2098293f39aa0bcdd62e718f9212d9062fa283ab

                        SHA256

                        d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

                        SHA512

                        63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        216B

                        MD5

                        1bedda0b939495fdf92440a256a34bb9

                        SHA1

                        74534a202c9e1f2509921dbc043b6199c0e14757

                        SHA256

                        843993efe7287ee7fb51e7abc7c08c2c9a20219a9a47aa3124adb2d3bfaed844

                        SHA512

                        d0dba5c78109a4085d2086f13b3031edec29d9b6e0a6604b68d07e9ff90670804c08f0973e899d77b1c97044d7b0358c9932d17ca77af3cf9c97b34493bcd005

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        5cb94e8c77a2fe731ce3c88c26bdcebd

                        SHA1

                        07423ecc51b99c4cd6aadfd8f4870a1bb0b203cf

                        SHA256

                        1da8829a53e74db2dc52cfe739c4d94d504f2e817bc3e1373fadee907a0f8fad

                        SHA512

                        a3a47c679b89c6861a5aca0c94c056c257cfddfefd7dae0858c4241458cf34054195960724494fc7bac1083051b8a3a54ec769366ecd9cb04dd1553077798ac7

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        5e870355468f3c9e818aa8afa7891b33

                        SHA1

                        d507061edb579172496941fc52b5ca5f52470b7c

                        SHA256

                        2570fa037b1ab0b565c6810981c99b4d18b7339d9530c62312ffe95494eef1a4

                        SHA512

                        63d6d0648ab3093f025811ba0170efb3cb63e40a47b398ebfc5bac68dea0fd19c0c05ace8b6f4d700572894eb2daff609d0f1ceb35a3304a91f33cfe245de1bb

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        b808b6dd0ef1fff4a0c7eae802b41b93

                        SHA1

                        c6e0de13df0c5df22f0c32f6e60cea27d743c5df

                        SHA256

                        f12e613d1fbed94884a104627c7391c0ad4d1007ecd36dad6115bbf0aefd19ee

                        SHA512

                        31b19f4f57cbcc72b5d23251444202468ccca107d2601d6564bce3f4e71884cc848164fe8ac04a07ec78cddcf35b0c908a38e1fc6407ad04c42f58ff560565ef

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        4694beec36dd85f012ef16cde864d432

                        SHA1

                        bdd89dff0cb16e35c24cf5526cd5cf0b09ed6971

                        SHA256

                        c59d9cd466af50e15c83e60a0119c23d7bbb1e0830bea70bef607a2fd514a4c9

                        SHA512

                        fe1602c112575e3ef3460e2e533140d7bf13c614c4ec0077c496d040d2f80f101955f4f853825a7246cfca53042c43d53af01c9e0128c8e9657e5e7b9ffc5607

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        f8f185e1c4f65619c9714eedf10c36f5

                        SHA1

                        2c05fabdf2bbb2932485eb8574c929b05dd85564

                        SHA256

                        a4034b794640bf2e1dcbf32789fb174704b7c9ae1f56f3b2812ed8d379cbcf9f

                        SHA512

                        7dc7698eccc70bc6fc466b17ddc18007f249a0ba679947d30a13ec3a4dc10bbb9fbcb7b7ed8c12e25cbd11df37f4b0b752322c4a99158ba0edf8674230a54a15

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        a2ef4b8b415e6247b4845c3dfd70096e

                        SHA1

                        19b9a215a569fe1c6875d9607ebdf75c47581fc2

                        SHA256

                        a885ddfdca0aac4eae36e3aff7b8ce96b52abef69d1c0bbf3cd5b6a547922540

                        SHA512

                        183c7c2b432e385230786b7f42dd0b72f181f3dce6eb1d716950d48e886f6c40bffd2214046eed84c541e87de91f753cb2832f96b3626b9c19b5d68d352330ab

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        9b40fca788fe00826a933a482ca12c47

                        SHA1

                        da7b94ffd1b06eb47b82965ed78a4bf6763bf85d

                        SHA256

                        b296562f445c6df29f935eda4496242c65c853e217f3cddf25745ddc597e4779

                        SHA512

                        077b5dc3310b2878a259cc3b2c1d72c3f8e39e064b8e4215927397f7ac0e238a7b6360ac4b27ba62db5864fcaa3d135cb7e506f669aaa86147261212b4c06ee9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        27e4d3ca7e74700cefdfcfefa5f77e38

                        SHA1

                        eec09c997f9352ac0dceb388d50bfef3067802d5

                        SHA256

                        ff4c90c90cc2b3b691883f352f1e78e05dd4ef880b0f2c79bcd1128ec20e5da1

                        SHA512

                        f59610536b15f3257fc8bef5433bc36d68c665735ba59c8669b6c1d8c1a0284796938096e141858f4f173cfaf1585f07e2835c1cf642d66261937aa381fb6f32

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        f5a86d13a39016c237abaed6656e9e86

                        SHA1

                        6554176bf7aaba42bc10d4dce2629b949c8b571e

                        SHA256

                        253ca3220f891ff06dcb7ddb07e7b0c4923df90e1546256c61421ada01bb1783

                        SHA512

                        2b91b5cf10dbbcca80cf16f1d436fd2cacbb75933f4697dedf9008c3d9a0714d9c62dc1dcf3a7aa9404cb4b352db15466892eeb9322b24bac078ab16c357e146

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        8cac9f6acaecf6fce5729d0c360d77f8

                        SHA1

                        12049a84cd570329c12d306af7a041daf3d1f588

                        SHA256

                        59c97cd9de167c700af90bc813f1e6cb1af094d55e8ae4aafdf806c8e7215cc8

                        SHA512

                        a9d1cc202bef18800551f8e1bce1f41b2f86dc29b2803f183384b63701b1d9515a1500e7f64e19fc885b9c8da7c68679a7ecb7998cbb26900d30ed0c493d3921

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        0440a6d4d9adb93203d36b5b2ba1b189

                        SHA1

                        a2a04e9a1cbf6389fae8786c873d37f7195f71f5

                        SHA256

                        a6102911c9364303b681360e2eb5b1f30f14a6126f1bc5e587c4d7d7fc1801a6

                        SHA512

                        6e1ded830c791a7947e58d6cbc75c4a06b4a4274505423a00f66855540a12dc2e26ef803cada479364b6515623f20b261de8fe249974f831a58acf0cbbd823b9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        2a5868f37a9759b9f8bd4f3dd68526fe

                        SHA1

                        d200b99d8dc89bab0542f7023e873968ec817833

                        SHA256

                        7c24317cfd2e0660f15c123ef9e356527d89369292213cff14afae7fa5a8dd83

                        SHA512

                        1054e7e3051b5dba645e501c7f064f1592c8b98bae538e89a09f867949c4ff948c59211bd7924bc9d162fdb154524a9db7ee14d4631969ee14826ba9f9555e43

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        e67ae4ae0fd53d1af4631ceeaf92a283

                        SHA1

                        56b3c42e961a8c1489468c569dfd8ee8377b8567

                        SHA256

                        6c3f4a92babe85f57adc92c4af4d4c7e9ad532a87491c7db61a3522b0e5d0ca8

                        SHA512

                        5df500bc66545af6a110b093ca44dad96ebca2312c2386324ef7252ceb6a9ce9d354821809ad00913a810630bf63f8002d0ed9c527ff912f9bd09f243e2b5f49

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\d8fdcf42-c52f-4b4d-ab32-3d2cde22694a.tmp

                        Filesize

                        9KB

                        MD5

                        fb12fb7f73c5892581840301e77e9069

                        SHA1

                        03c1ad5e8ae3298e4b485ccc66ecd2ed5df8fd2f

                        SHA256

                        395604ae757452e71e0cafb4f4c893ebe1af1b70264b34c863766c3d6ff8215e

                        SHA512

                        0b1c4efc47e624c3e6e6e7133f9904fb61820905b0f6e5875dbb17b8f191155b140a7f761946ff6a93f0a7131d3f15cb3c85a3f2b2b6c2691998cc9edb55de03

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        99KB

                        MD5

                        e7876d436ba79c7e04ef1ba65cd582af

                        SHA1

                        67ef06194d198e6a1814f5b37e01ee46026bea75

                        SHA256

                        36883b6dcc0970198541ee494b4971d731ce97ca7ea3184b39a3739f421f046c

                        SHA512

                        08b8ed0e4a75b89b1f1ce18f7d353cae82564b1cee17112ea5e1394571d58576e5c6932ffb501093b2cb923d2803afbe2435940b4581a89631e924efb5b0c0a5

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        99KB

                        MD5

                        a342bc60b030b82443bc12bdda44b87d

                        SHA1

                        d5027ddbecbf9e72861804b5cfa0e7ffae67d1b7

                        SHA256

                        451ecf5cb91b79872a928902ad232430ee480e08946cc4f8d45c04d87e53451f

                        SHA512

                        bdf44b955d5c4c33abadee8c7ba366b468451a27a8182f50751b43bc320decf320f366ce7cda082dfde91801b402da48f67e1a547688e2abe26fd1f6a2196dac