Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    137s
  • max time network
    95s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    14/09/2024, 08:45

General

  • Target

    MSMC-main.rar

  • Size

    12KB

  • MD5

    9c97825bfce16471a2bf04c0febf99e4

  • SHA1

    a696d3a6577376fc05a028e949c93f18513edabc

  • SHA256

    eb4382ee52deb3b42ddd166977c08d684cc70860bf9c8f770f5c0cb6265f7037

  • SHA512

    53b7cc9c811ddf4a32bb84c2cf23bd164ec77738f7111e492f2f7e2252582fb75ef99922a70d05538014fb6414596092d9b7cb5fd30ea3ba37c895648b983f95

  • SSDEEP

    384:QSkCyvpP6iBQqQZ0tnTIJDRVf7+wYP+H8SMLLgAWf:wJx6iBnZtILVf7+X7JHgd

Score
4/10

Malware Config

Signatures

  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of SetWindowsHookEx 7 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\MSMC-main.rar
    1⤵
    • Modifies registry class
    PID:3344
  • C:\Windows\system32\OpenWith.exe
    C:\Windows\system32\OpenWith.exe -Embedding
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    PID:1372
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2d7fcc40,0x7ffb2d7fcc4c,0x7ffb2d7fcc58
      2⤵
        PID:4752
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,3370607787355645540,18426259991009588538,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1820 /prefetch:2
        2⤵
          PID:2768
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2120,i,3370607787355645540,18426259991009588538,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2112 /prefetch:3
          2⤵
            PID:2744
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2208,i,3370607787355645540,18426259991009588538,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1760 /prefetch:8
            2⤵
              PID:5072
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,3370607787355645540,18426259991009588538,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3244 /prefetch:1
              2⤵
                PID:1300
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3160,i,3370607787355645540,18426259991009588538,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3268 /prefetch:1
                2⤵
                  PID:1980
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4368,i,3370607787355645540,18426259991009588538,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4376 /prefetch:1
                  2⤵
                    PID:1012
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4760,i,3370607787355645540,18426259991009588538,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4804 /prefetch:8
                    2⤵
                      PID:1392
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4944,i,3370607787355645540,18426259991009588538,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4952 /prefetch:8
                      2⤵
                        PID:2264
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3728,i,3370607787355645540,18426259991009588538,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4668 /prefetch:1
                        2⤵
                          PID:1444
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                        1⤵
                          PID:3144
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:3588
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                            1⤵
                              PID:4664

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\0a4e69b5-4505-4c6c-88d4-1671248f5f97.tmp

                              Filesize

                              9KB

                              MD5

                              84bceec233ef08190a4f0384d2a02ae6

                              SHA1

                              23ae67de8ee0c5047805079708d5b2239a3c0793

                              SHA256

                              0019ba71144b0168896f176263d6d9e20fece6c03e9d2ac6a720487424ff0a88

                              SHA512

                              b94f6bc2c1b607c3d5c694893e006cc47dfba546ab210619313c42238c1f00e75386c9eb2216e5848e9dbbfc8c662a3ba691a7ec720b1799dbf85b91d0a785f8

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                              Filesize

                              649B

                              MD5

                              9fc7fb16f0cbd13f9d6e0400399f6cb2

                              SHA1

                              93c04f4ea0d5f9962643074836b3072fe25d3cf3

                              SHA256

                              cdd419f8c130bc2b0fb4d7f05987738c599467427d206a9cf1deea53fa433a90

                              SHA512

                              f9a741b081e0ebe0bc5802357f773825eac64e03a6a6cb99916a4f50e86eadc75de28e16c4f2dc40b7d5bce83a87a3325f394f538f6d0c2b6b581c1ae37796ea

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000001

                              Filesize

                              212KB

                              MD5

                              08ec57068db9971e917b9046f90d0e49

                              SHA1

                              28b80d73a861f88735d89e301fa98f2ae502e94b

                              SHA256

                              7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

                              SHA512

                              b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              216B

                              MD5

                              d95ad5ec38b1feca7942798c587babd5

                              SHA1

                              baf5af86d5c89d430b015b71a7dd7e654850c9ef

                              SHA256

                              efa6afcdb4be5e303842516048ac5574ba10b12f5bc69c489a0facfada90540e

                              SHA512

                              a8fdf1d374efe722361590bc21de24df24aff8a0c85b6a882b895ed70382618f869cdd8ba9b6b1280c994b0441036b2d15c9f45f7782126ced27d247ea643fe4

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\1663a96b-7aa0-4674-a679-971bc4669486.tmp

                              Filesize

                              1KB

                              MD5

                              ed552c0756a3a537cc319248d3bdd715

                              SHA1

                              f00957b58a9565038b48d981553e0e6ec1bbdb78

                              SHA256

                              e55989e2a290dd263959c076a0bb1735524b864830414d1f5e252c2b9de7490e

                              SHA512

                              85eb9d41d8433208120f3509120ddfce0be48b4e35785a3845a460f27b6f35626f0a3553ce33c8a62a2a7e1cbc79da4feae9d204cec0c75c98db486678b9187c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                              Filesize

                              2B

                              MD5

                              d751713988987e9331980363e24189ce

                              SHA1

                              97d170e1550eee4afc0af065b78cda302a97674c

                              SHA256

                              4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                              SHA512

                              b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              356B

                              MD5

                              90452c6efcf5ad776f24e29a71bb04ef

                              SHA1

                              204633143c99e2ebbb28f7ddd0fb1815a4e322ca

                              SHA256

                              7c982d32be74562d609d0ec6119111970159c41783880b502cc0106725ec37f9

                              SHA512

                              6d2890497573e02111fb8008a7a394aa129a4a176ba5b15405fa4eab7eeccaf3e90d22578698bdc60c5f2027fe0b621ecc089af4c36eab9d89bb3294492d7ff0

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              9KB

                              MD5

                              e76f89a0ac3b554bb1d4f36f1c5886e6

                              SHA1

                              f05b5de6f6a3301424a7be666f2f59e41d298205

                              SHA256

                              b544c4d636b837166575b5163104f419f75239bde458b2cb3457a5b74e3d4e1c

                              SHA512

                              1c823ed42d1a351a94706a5394aac592dacadb36baf0a47bae88352284f1cd0bbeffbf730605f0d53866fed2ad932a4652e881b2aaddfb48df482285b4c2bdd9

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                              Filesize

                              15KB

                              MD5

                              df10829627f1bdc8f30360ffd40bdd6d

                              SHA1

                              eec1f019eedc119fe7b246ab28f8935411dfd9a4

                              SHA256

                              d3020e03b5d5c1ab120651dc3a6a11f43e297546a5fe4872cdc0725c00be9f44

                              SHA512

                              5f8b570521a7f0c944d54541e6036c6c7c2ce63b6eab8e7d0b17d18049ff21e4fa1c92db9849054f09490d9fd6842811909e2ad5a62ffcc93ae577daed71dd6d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              101KB

                              MD5

                              2ee334fadf132b54a15c45d5ff2a27c1

                              SHA1

                              99294e3219567434b2301424148af4a3a9c1200d

                              SHA256

                              234f5de32e96a6e66fd7ae400ae80eca0c9740ca129742e716798227b3d42f45

                              SHA512

                              a414d44192528e98c8d6ee5f08861f8a68fdb19a0f62473ac57dc6c60285f558d7e5882ed1ad66bedef795b43b95d7023384f26b51dfd971fe19450160f4b3a5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              210KB

                              MD5

                              23ac2314cccd0f35f710c7db2505b75f

                              SHA1

                              59e27af1d52e3dc8b1d553856f2fb3f5798f540f

                              SHA256

                              e7c0afcbe04f801f9f78f3bbc5b327dc48af69ff2c62d4109e2f8c11e3e72a4d

                              SHA512

                              4e61ce1d368859cb78d7059085ced8ba0eb3257e17fbc88e1536f5fc9e79175c4fd101f7efafefcd6719443d354d4a64f2388bddf58cb089ab6179db5f6d1346

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              210KB

                              MD5

                              5b046ceea44c53e279a31d8a437247e9

                              SHA1

                              8dec9fcb84549dd5172b4abb6feb470738fa9f5c

                              SHA256

                              f1c398ade21c3c76aea0a67cc6fb5983d670b7b51ad5f8e33c366b5a7203a90b

                              SHA512

                              23b2874c56f2acd721b1e141837274e42bf3e9f0f9f637bb885f252a887d9c04b6b446737c58385733afc44786807de3f7a272ace8815961f91db0b79d08281c

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                              Filesize

                              264KB

                              MD5

                              f50f89a0a91564d0b8a211f8921aa7de

                              SHA1

                              112403a17dd69d5b9018b8cede023cb3b54eab7d

                              SHA256

                              b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                              SHA512

                              bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58