Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/09/2024, 12:01

General

  • Target

    http://BYAPR15MB219910986BBF136538A89FA3B5992@BYAPR15MB2199.namprd15.prod.outlook.com> References: <-131240387.2014374.1706455876299@cdc2vpc5lpr22

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://BYAPR15MB219910986BBF136538A89FA3B5992@BYAPR15MB2199.namprd15.prod.outlook.com> References: <-131240387.2014374.1706455876299@cdc2vpc5lpr22
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff8a8d2cc40,0x7ff8a8d2cc4c,0x7ff8a8d2cc58
      2⤵
        PID:5028
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1832,i,8053644154229786053,1417346969946709439,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1824 /prefetch:2
        2⤵
          PID:3880
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,8053644154229786053,1417346969946709439,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2200 /prefetch:3
          2⤵
            PID:1452
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,8053644154229786053,1417346969946709439,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2212 /prefetch:8
            2⤵
              PID:3144
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3064,i,8053644154229786053,1417346969946709439,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3084 /prefetch:1
              2⤵
                PID:2924
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3068,i,8053644154229786053,1417346969946709439,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3276 /prefetch:1
                2⤵
                  PID:2408
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4448,i,8053644154229786053,1417346969946709439,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4344 /prefetch:1
                  2⤵
                    PID:3600
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4452,i,8053644154229786053,1417346969946709439,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3384 /prefetch:1
                    2⤵
                      PID:4512
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4844,i,8053644154229786053,1417346969946709439,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4856 /prefetch:8
                      2⤵
                        PID:3180
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4932,i,8053644154229786053,1417346969946709439,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4532 /prefetch:1
                        2⤵
                          PID:5108
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=3108,i,8053644154229786053,1417346969946709439,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4696 /prefetch:1
                          2⤵
                            PID:908
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=5020,i,8053644154229786053,1417346969946709439,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=724 /prefetch:1
                            2⤵
                              PID:5016
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4984,i,8053644154229786053,1417346969946709439,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3536 /prefetch:8
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:6068
                          • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                            1⤵
                              PID:5880
                            • C:\Windows\system32\svchost.exe
                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                              1⤵
                                PID:4560

                              Network

                              MITRE ATT&CK Enterprise v15

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                Filesize

                                649B

                                MD5

                                f71e9cc11a5ee9a115c4ab4a5b345b8e

                                SHA1

                                0614a26571db44a4a80ecdf5724eb1301f87620d

                                SHA256

                                ef51880769b311999e91e27e77dd84af6f2c15b108f5c7cee14d974ad02f6e34

                                SHA512

                                a8a1e15698ea25451cc7436c5fa0af63faf0abf939e6e4d9212a2a0ad50f157fe4820f022ac9e19bbb9f9c21ee77de68f859132e9156e5b7e660940f71d05ac1

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                Filesize

                                962B

                                MD5

                                ba4f8c9a36b04af1f32d739c782290d2

                                SHA1

                                36bd40cd31dbe9406d4b63f3c3b23c241d3f79ff

                                SHA256

                                b46f832ad95a2f768b09e996f742e8b59189beda8ac8623ef6e877d3ad0394a2

                                SHA512

                                86baf7aa15d1adaec45de47766b4504eddabc24e812c6baa7f172f476bb516031921e7e94b6cd5db827308be859003b4e54067f4dc9aa0d21734d063762d423d

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                Filesize

                                2B

                                MD5

                                d751713988987e9331980363e24189ce

                                SHA1

                                97d170e1550eee4afc0af065b78cda302a97674c

                                SHA256

                                4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                SHA512

                                b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                b1635c436d0ca532afb86bc56aa2331b

                                SHA1

                                88b816988eeffe5fe9d3a82d51b0070a4a46a528

                                SHA256

                                78ab0a987735a07971cfdcd177c6ca28a6a613fcedbca97f18cce85e03ab3c9c

                                SHA512

                                7022e3368466576e769b9d08c6a2e9af5b8eee2e87d155b161d1cf92a972ead912652fa62254ddd4a205e624477532e5a0191487ea69edcf6ed718bf05a7b5fa

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                266d37be48165a2d8108ad8cd323a525

                                SHA1

                                ed71aaf2ab8e28dea1d59f198ef640114ab35fcb

                                SHA256

                                ae6993b792daf1478727c9d253979915fa34fe18eb44a897b40b0f7112b1d8a8

                                SHA512

                                e9c3db4c7e92bbc46d9a9daef02a6bb4ad77f450730b47bac612ca353721ed5a877004d8f5fa697ba3f527f11d053eb61b644cf1c1f723f20cd1c63f790a37db

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                123c92e7ffe2afe623dd588ebdcce555

                                SHA1

                                fa8ee32398988371cf21481adffa2ce089290f37

                                SHA256

                                325c15739ce2b89f87970a08e67a41a39fb97c71c2f8b55c3a588919d3c4a798

                                SHA512

                                bc61c9d3cfacb72d638fc0f6635269de10b06388abe14ef7a2a37684f01ac3ad25fab55c6b2796b72fce6d2a5bb7789f8d860997b28af2b2e8279df45c9ff4ae

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                09447b2033f2f88636f16fe8712a9ec5

                                SHA1

                                1ed5287df930383521970bc9810c28fc05350b1f

                                SHA256

                                218a85a468fc5a6ddf10962d90e38d056b5c2b435f6b0636c3a937478ee0cb35

                                SHA512

                                b7b71267a4e13b79741ff638651b802b3a213664ff7f3572a8db136e2beea86a1949d2b45b05c05857aa573d965c22c3ef33187636df35becc0b78e4114b100c

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                866b29293f720bca50796895f7b8227a

                                SHA1

                                e32fcb8a29d6600295a9295be5c3e5e41dbc3dcf

                                SHA256

                                40b799ce627e9f15121cf2e2c78fc69bffb43dd6b3ef480fbb53cba03755f562

                                SHA512

                                9a827832d6ea457a5175f689d7109885a2bbc287f76e812e7d0c5ca84218333e11218a0e09e6b9252f1e63685f26885ae73cee0999bd6a6932540aeb2a402168

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                7a231a7c2e1cc50422fe5b8d99a0c316

                                SHA1

                                77e78684cd5a7d70202fdf37683f0e05fbc66786

                                SHA256

                                8b4223260db497a58ddccf64eba736da28fba9886c4892e0e03c140bf3feb101

                                SHA512

                                a0994f0e9a7f3571afb0c12fcb9cb17868fe0a8f3fcdf602081af8af1bed2f75a7f0eff9fb9800cc255108f6392a3138ca446eb9c0f167f2f74d43b3ecbc0016

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                Filesize

                                9KB

                                MD5

                                bb7e022c60fae94700fa560ac83adfb8

                                SHA1

                                5b7b307ae34ab903d4b19a1bdbba2cff7f806bd9

                                SHA256

                                39563dc8908ff1786d09e2cd31495cd0f7c2a4a6c0eea043a6e1be8873385722

                                SHA512

                                8da9cf3ad10872ecf17220bdcaaf78fe7866270121edb00d5a6c198b6546e6e181550af088253efa90152145ff72a84b5bcc4f2bce75cbf953eb34d8f1d9915d

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                99KB

                                MD5

                                c840a3efaf2fe56168168687f48ab4dc

                                SHA1

                                a06ce7e747ae8950dbd04610ba3a0b0dc0ff1ccf

                                SHA256

                                3a19a5338991a6116d58ddb06fa3595c9ad5fdb09249b64a5ca9fdd5419c78c1

                                SHA512

                                19140647d15d388c9a5bfb9ee54604f7cfc89ed13374c557d68858923ed32264e949910e85b8df4b6d5781a0f203a5c09a5c1b6a15e15cc4b57064703c3326d4

                              • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                Filesize

                                99KB

                                MD5

                                7eea8833e6c9db8f0b5d589464f0247f

                                SHA1

                                008a6513e4d2a483102b1a80bc5b77ba97f38359

                                SHA256

                                3d6301630aabdd646ab54c47ff4c9fd1a74695ff8ec1b956beb70cb0e08ce378

                                SHA512

                                ea698774eb035b1a16c717794f59e418f2023b06fef1a45780ab52fc9e59061ecee44668f92244b89f986263da724623da309457b47c6d12dbf8d92622238df3