Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    140s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 11:07

General

  • Target

    http://t.msp.clap40.com/r/?id=h3ad8ba7e,2575a7d6,18e05

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://t.msp.clap40.com/r/?id=h3ad8ba7e,2575a7d6,18e05
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2548
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff85f52cc40,0x7ff85f52cc4c,0x7ff85f52cc58
      2⤵
        PID:1556
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1912,i,17548675986159736306,1298666096268637706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1908 /prefetch:2
        2⤵
          PID:4480
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,17548675986159736306,1298666096268637706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2160 /prefetch:3
          2⤵
            PID:3452
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2224,i,17548675986159736306,1298666096268637706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2424 /prefetch:8
            2⤵
              PID:728
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3012,i,17548675986159736306,1298666096268637706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3028 /prefetch:1
              2⤵
                PID:1964
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3040,i,17548675986159736306,1298666096268637706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3152 /prefetch:1
                2⤵
                  PID:800
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3680,i,17548675986159736306,1298666096268637706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3624 /prefetch:1
                  2⤵
                    PID:3144
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3144,i,17548675986159736306,1298666096268637706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4588 /prefetch:8
                    2⤵
                      PID:4356
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4848,i,17548675986159736306,1298666096268637706,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4624 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:4660
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:2084
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:2364

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                        Filesize

                        649B

                        MD5

                        fa9363b1ab1f275cd5479e2305d5d03a

                        SHA1

                        352c0a8de710158e1744c724999aa332a127d617

                        SHA256

                        79015e0038c5c1a08df15b1d2a06ce6f0e3d9e7787db5fdfd9a1aa6064cddfc9

                        SHA512

                        3dbecfe26df4a1ee23bd12cac6ef203ea557452258668873af804a7c9c0f8bcac052bd6b12d778427356e02f9e715624671b042fdae7bdd67bd13d471587bb61

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        312B

                        MD5

                        435386fda0e699383ff6aef0ac4d3430

                        SHA1

                        5481f189b19e21ac80e62255c7f5f1d6917035fb

                        SHA256

                        57b37828e3f475afa311c92771ffec8e227ff4ba7ae5315510f0a5d123af84c9

                        SHA512

                        e7db6bf98df7488edc2fcd3e9435ca267d9368c8c207582d7b0d766b3c1eb0bb8c297e5b810c5c38df4abdfff1aaad55cce14a234e7fa1e0c7d5ea310ad919c0

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        971481c397dc7e2b3c1cfd7be3ac8671

                        SHA1

                        20d89fb0e94222f76d48f745ca9380fe0715bbd7

                        SHA256

                        bd5537e453d24561e04be81dfdf981759396e16c4a008f4c9dd87818ef9a4f50

                        SHA512

                        39c9595cf48473f61fac568072ec601432ed5399c53bb6728c4c0c9eabdf77b0713d43d5c1929487d18f1b1e2a0f5142ac34b80d9f8cd8bcc32196e4f7e14c3e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1017B

                        MD5

                        5688b0720e6034d572708baf8f40b5d9

                        SHA1

                        b8da0e1aef3e7850fd32228be383ec0cddfdf6bf

                        SHA256

                        5c57446e0b5fd79c5b2a17bec27216444aee7584eb06bca5c92981ad16d613c1

                        SHA512

                        82e9a867b0a9bea6da1f961dc1090b170fc762b2e5732892f1aa8273348a766d2339748ed93b81037eb1182a05b0dac185f3202043fc6ecc7ef717c74e51d7df

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        76e8ab19af8c7f88b46cca6fb4406c64

                        SHA1

                        eeb51e06c9ea768431a0cbb0a4a2315391b27955

                        SHA256

                        bf59bdacd030fddcda6b4641bfaf20e712d9be2f91ad88737fa06d14668ff07f

                        SHA512

                        a6a34ea59f787d914ba534c59d889361ed5360fbd1e29244c9e80c094b55ae9afea01cfc6b250ec8e6e8d14f0cfef452b44e3971e750ecf49f78f5575eee1d8e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        bb90fe1b55606884c34904da462803bb

                        SHA1

                        0c5a442af904399c05ba46d1c357c261913bf391

                        SHA256

                        1ddae890d35613601cdee6fdcd2291b9df10b5003ba096f5ebfd656156d39986

                        SHA512

                        b3eb69534e2d37f78eb6234e2242163b34432971df669185b0ceff537d0cf62106c70a30391f378042ff022b883fae2d9c5cc6e3be23b1558fd12505f60b0a37

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        e4bc762f150dc88cb4cacaf74411124e

                        SHA1

                        a9c8db183f4588d932005504a730bc0d278f0aaa

                        SHA256

                        3f1abd5d6d042d2c0aebfaaecc04aa9f78df19cd7b7fc2b453101d10e40da42d

                        SHA512

                        8415b875a2607da2b3c9c039980558fb6fe544d95456c77c4a808b10f55078a6c55edbeb2d2856dd885257579bf6f034ea37e6af487524200e4d01472f6fb681

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        50a0939be0cdf4464617dcfb9b19f9ad

                        SHA1

                        bfe9fc97a9248523eb193289b61e6985d3e595a5

                        SHA256

                        9990c9877795e10eecfe55612a1d581f1adeb7dc8f5bdf6f9a4db339b7d8f6d0

                        SHA512

                        443b438ea537af12d8f62c7a58f20adf0798ca187e27a37c892372cc8b6dc3561394cb6c7cf2760dac6a04c53499d30fa13b68926fb74cb44ad1383253f6a578

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        19913f73527279fb106a4624ae7f44e3

                        SHA1

                        468c9b236160ac11797ccd36cc6bbdf9954988f0

                        SHA256

                        8d49489d75bfaf31c2e81d50ea90f58aca8ac6c4937240ce35eedfdaba3eee8a

                        SHA512

                        eb5bd4c60bc1f812b4a681b004baf6d0d9ed81db33299cdde9bdd159cf9b24b55178ef1e092ac9224d5037ae7a6d0e62ba0e75c715667d0ec0563dfa86844ba9

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        359a3effd3773c1b45fb368c4d8e787e

                        SHA1

                        6207544af4cfcf687c3388e5043ebd7d1f382b6b

                        SHA256

                        fc5c7aabd52c96c4a209198aa2706e4a49667db0ac3159a81d0c4c61bf823e5c

                        SHA512

                        b7c879258b0403305af785d1e9d988b671934d25d7ca61e56fc144ecdcb9fc1609c0e0e8f93fbb226519a1283b31042f720c229a3627fbd245776372e2154b83

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        1e46e7efd02c46bfe4878ba5dfee8108

                        SHA1

                        910b9075aa26553227014cf4fa9495f3ed518c8c

                        SHA256

                        88bb1c1990769b9de849d91781ae227ab7638976fd33ce2f863944dfb807d28b

                        SHA512

                        7c28434124dd03c69d28f52999c938c0def5625a3156287ad110b7688ab8d3ba23f2f2f9c6ef1e52d75c61abe1ea7cd56a62e657dbbddc0489489ecfbe01f13e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        cce62a6676bf4213f50d3643a9de4fd2

                        SHA1

                        a3a87adeb91becc6ac57f6a8d0a425ea4290a530

                        SHA256

                        f5787345ab8c9a2cde71ddf3887fa737ec95aa715c56071c64ee420cf8805017

                        SHA512

                        348edd2e622ea8cafce09ef973f3fee8dc454f9dadf613c7f48f68d629919dd26f9c109b0a8d82960bd095b6b3340445a366483d22186a5699d3a03610efb4c2

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        1a56fb9841568fc0acdbd01266ca080e

                        SHA1

                        f500e7cf6b33976fda92d08aaaf7da064adec84d

                        SHA256

                        a47968b9781c3f1c26a1dbe81a5392535a637c51b80312fa1fa60d21db7b0764

                        SHA512

                        1cabb93f8d27dcaeff0029536462fee0b25dd2599e2f768bb2af8eb7fd52313a43a11898a79fbf533258224761e48464d07975b93d0e74216fb31a601a53fd12

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        8602a3093c5160c3438ee0663f0a30f1

                        SHA1

                        99b5ff10aca0b73df60aafe6693c15389fc88876

                        SHA256

                        8532f9c2048428fd355578b2029f6001c0a5f3dbefd83fcf721b77e7b858313e

                        SHA512

                        9f75049ddd67dee4ea7c288bbd167c2457d0642d10131c876defb9bb9ef4a131cb0fc347b9dcd65c18216a6e28321131d4d487a5d192df52d87fb4f51dbeadb5

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        99KB

                        MD5

                        e969fb9e306046c45e34724bfe63a344

                        SHA1

                        8de86b512e23d13f6d6ace39c4265deca3d8181e

                        SHA256

                        0a7b4e7f80a6fd554f08c01c053b17500de40f1caf51cb545a78bc4e20f28062

                        SHA512

                        978e3800e3270706866dcbb3e948064d56119218c6e73c1cd6ed27b119f1ee1694dee7aecb85429d4437e2c89b2124ec7c830c2f7ccdb9e5c09dff401ed02f76

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        99KB

                        MD5

                        93a7f326d1bed8dc8f9e2202748679fb

                        SHA1

                        0e1a68c7e04c52192f6c893afe721bd72bacd270

                        SHA256

                        6c5bcf8263fc7a7529571de6ebe1b5eec49c9679beadec79854142f6109b0ddc

                        SHA512

                        7c3ee541309bf5db1a763b19fdcfdb97c1f90d9cff7ba8501859152d793bfe911c49938a08af66e0e169e7f490934d1bfcd7918a2090ead746224cf001645217