Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    48s
  • max time network
    50s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/09/2024, 02:39

General

  • Target

    Xeno-v1.045-x64.7z

  • Size

    3.2MB

  • MD5

    9118f6ebaabd7bbfe7e20ee28b6a3309

  • SHA1

    2b2a47367194e57e74350fd1d8bc1e918c88c26c

  • SHA256

    f6352b1557278cd6873d5541db4a12049646681ef67b38fa357c198724c5aaee

  • SHA512

    1e9fa7b42badf038c0440ebbeecf705ab382af047121f8390000fba04489c7d1d48b6592b5bbc458e8579f750a26d6c550a5c2668c91ef35326afd6b4b184a64

  • SSDEEP

    98304:2PZr3Uc+OMgvwRgJflKrptoaEQH6+Y59s25i:wZgc2Rol0ptoU6+a9sx

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\Xeno-v1.045-x64.7z
    1⤵
    • Modifies registry class
    PID:3012
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious use of SetWindowsHookEx
    PID:2332
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:660
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ff83da6cc40,0x7ff83da6cc4c,0x7ff83da6cc58
      2⤵
        PID:1624
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,10538567203059619207,3803574882129616535,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1924 /prefetch:2
        2⤵
          PID:812
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1852,i,10538567203059619207,3803574882129616535,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2216 /prefetch:3
          2⤵
            PID:1520
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2280,i,10538567203059619207,3803574882129616535,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2296 /prefetch:8
            2⤵
              PID:2524
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3180,i,10538567203059619207,3803574882129616535,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3192 /prefetch:1
              2⤵
                PID:4848
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3328,i,10538567203059619207,3803574882129616535,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3340 /prefetch:1
                2⤵
                  PID:3576
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3752,i,10538567203059619207,3803574882129616535,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4592 /prefetch:1
                  2⤵
                    PID:3316
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4776,i,10538567203059619207,3803574882129616535,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4764 /prefetch:1
                    2⤵
                      PID:4404
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5044,i,10538567203059619207,3803574882129616535,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3356 /prefetch:8
                      2⤵
                        PID:4152
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3476,i,10538567203059619207,3803574882129616535,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4452 /prefetch:8
                        2⤵
                          PID:3140
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                        1⤵
                          PID:2968
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:3324
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                            1⤵
                              PID:1780

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                              Filesize

                              649B

                              MD5

                              e23d39e1de9465875c3125427b028582

                              SHA1

                              821e5b2e744b4d4ebe8c23a95b76c3b5b4ed21ef

                              SHA256

                              59a86100c5d10f53d90e1330f80afde36c9480a6e3dd42590204958cee592cd7

                              SHA512

                              05dfe00f88dc5c83f39f6d775b7da2b8feb79f986292535894f34ddbe926b16ca7bcb163bf860df371fa500ac7114a3e1ed0bd151c42aed54fe2309ad08cdf51

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                              Filesize

                              212KB

                              MD5

                              08ec57068db9971e917b9046f90d0e49

                              SHA1

                              28b80d73a861f88735d89e301fa98f2ae502e94b

                              SHA256

                              7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

                              SHA512

                              b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              216B

                              MD5

                              f21e63d6069ff7be245addebf29b4e94

                              SHA1

                              d9f6a06fd62e143f7bc8a3d7bcf030c72674c83b

                              SHA256

                              e1df9bdecfd230eb622b9d94bd9e7f0d53ab84ba9c92663c9747f61722c1a41f

                              SHA512

                              ceac3ce3ac77b00bbdbec39a2e74b1974a63d0925166ad0259c23fa42fbb2ccc8b12ea1c17a0482ec91f2ff008cd341ad77b87af56a7115338901c836806e372

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              ddcf274fefa9a1a4cc5b671e29bd7438

                              SHA1

                              b03fb3cd4ff016c235282f83271d639a1da66e73

                              SHA256

                              bd931f0081e7a6fdee01c6c4ce43478b7c1cb003885f026ad123ba5e4aef26ae

                              SHA512

                              e190c11605938562742fdb2c0ffe15d739e21de5269a99f5b1d48735b2930c3c4023b294ff50acd251eebd45beda246edcc4eb8bed3d507516418c06486bfe5d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              356B

                              MD5

                              aba4afd1b0022e8307e8e16e16274ac9

                              SHA1

                              efcc4086fea4efa2c0df6e762ea06aa02b70fd59

                              SHA256

                              0eaa1a41223cfaaa7ff30e8b499b16bf97c34a7f24d3afad9eac3eb7f0342844

                              SHA512

                              ac9f9f15320d81aae06b6becad6c539ddcd3e9b43fd187195ecb17b5b10b5bdc072a17e483f0eb00cbb1d3ade5bb5ce4735627b9e8ddb6993a6b1bf9cb1b15be

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              f3dbd3ac92aa0837ab711ee13c31ee84

                              SHA1

                              f2cc56c75636d6dbe5879f07cfde1c75b8983ba0

                              SHA256

                              8c456c0447fc2f666502cde436fc21f3c2f39d37209e7d7eb6d6bbffe9b4fde3

                              SHA512

                              3837efe5e75e10edce81d6a59d709920fe25962b95b69ded8eb28def382696880699a3a2c5fc71feaf9ac86198b9d5ee5ea08533dfe92aabd7c3a018a4f56994

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              7044eca8c3923cd0c8c104743302b67a

                              SHA1

                              3d5403b6fffdced3ac15cc3f61dd32168c0e1a75

                              SHA256

                              19883ecdd549ebf086c95a0f50c3da727c55d9b8dede78ea2f103abec184a36e

                              SHA512

                              50e75485384675e625e9f9211c7ad96b031eb32f796b57d38f26d6175dd216ae4d4140eafb451bac9be6150b75bd4a8734f47754b7e4a70efd90f08d4da2e4c5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                              Filesize

                              15KB

                              MD5

                              44f1ccab6912ec9e47731ae8d3a918d3

                              SHA1

                              8ece49d5ec7ca849402cdb75a8fb0c942994e56c

                              SHA256

                              ae3547c2b01a8496d7c3926c847ead4d15eac90e5e6ee4a027f87ad76f956c48

                              SHA512

                              2b2c5477fd47706f6953a1a24a8c73c4b72976f79ef442993555d79f516e95ff2a4308294fdf0429aa2975c5c1b1ea0b4727f4743bf63c5371f374dd8f631b56

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              207KB

                              MD5

                              b8391e7998c52d44fe0fed559dd5e4ba

                              SHA1

                              a40498ea1a0c0ddc06452041022b00d4bf86038a

                              SHA256

                              6477bb8d8536fac24a4231673bc6d801ae5be9e2a016596ad671a5071b501007

                              SHA512

                              9d371102428af20889b1b74de225afcfbc09b08f987ae57b04a8e912d9463b89a79d5db580e04a98555e5839b2f5913a008b6fea28cd1ddfec149db7586b2f19

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              207KB

                              MD5

                              52299253c53d2d4ad6683765887f147b

                              SHA1

                              b1b6ef79f203dd34829cbd0ab31c6633590c6f64

                              SHA256

                              e2c9d23093dd11f150f1bb46823b622a39a9ee2196286c3abc08cc4679c856c0

                              SHA512

                              fc3e0c7c2174abd7966fd0da5c2c3cfb719976037f53d69a3058e30eda7e33f06620997d003177c24f6443467c04e94d6771f31404567e9a8c6f3c6dba2cd6c2

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58