Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

21/09/2024, 02:12

240921-cmvg4azhkq 3

20/09/2024, 22:10

240920-13hega1dnp 3

Analysis

  • max time kernel
    40s
  • max time network
    42s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-de
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-delocale:de-deos:windows10-2004-x64systemwindows
  • submitted
    20/09/2024, 22:10

General

  • Target

    sample.html

  • Size

    549KB

  • MD5

    1fa8a9e376d736ef0af07027460884b5

  • SHA1

    c41a15984551509f11a8c6cc8d9dcf10fbbfee0b

  • SHA256

    5d08cc4e26e02a997152d1926ab916133a08c6f331cebe1835578261653966b7

  • SHA512

    3a9fbfb7d3194623c40e2d5eac7f6f59f14a36d224c40f97409f253109916e5e3f73d46b18a8d16193d3733b72876b73ea9ef3ab6ff80dd8c417a9095fd1e3a9

  • SSDEEP

    1536:VqsK64sZIQZoQI4o+I/eI4phImPojHfhjDlI4KkIJwrI4MaIz3I4ysIB0I40CIre:VKjHfhjDlijeLEmL1k3

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 27 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff88ebdcc40,0x7ff88ebdcc4c,0x7ff88ebdcc58
      2⤵
        PID:3316
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1900 /prefetch:2
        2⤵
          PID:3892
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2152,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2164 /prefetch:3
          2⤵
            PID:1496
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2400 /prefetch:8
            2⤵
              PID:4768
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3120,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3148 /prefetch:1
              2⤵
                PID:1036
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3112,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3184 /prefetch:1
                2⤵
                  PID:1208
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4496,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4480 /prefetch:1
                  2⤵
                    PID:3248
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4008,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4004 /prefetch:1
                    2⤵
                      PID:1324
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4092,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:8
                      2⤵
                        PID:5104
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3392,i,17275131441687013382,15664606295236101058,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3376 /prefetch:1
                        2⤵
                          PID:4520
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                        1⤵
                          PID:2204
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:2956

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                            Filesize

                            649B

                            MD5

                            46db77753823f9e0d8e08b455f2aafcf

                            SHA1

                            82c94d66714b9bfbd6c222f082ed268de10912c5

                            SHA256

                            e792fd81663bdb20b62283564e7836ab3ddd1da3ed926f3536245b4132859a21

                            SHA512

                            7ca5f8b1f4495438812bcc5650ec75cb22db5a52dc6f7035c79755a47ae9cbb3c0e6d85d000753d74ab57a8d0bc6314366d8fff07352c036e12da44343df9efb

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                            Filesize

                            1KB

                            MD5

                            ef8e029489a8a17b4dece70e82a37581

                            SHA1

                            d7a9129f59b840d8844f6df8467c00cc85164f54

                            SHA256

                            2f78ce0a14c5786c252bed5ee11cf0fe6e1b4bbb0c76e4965bedb64ac31df45e

                            SHA512

                            27b3cc00f35f1966971b0008905f8356dc532d5ee8d69618ca152155fd4d23d2cbd3372a951ab2cef3fc48f934696cb74b026321f694d495c74b7571a99c06bb

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            981afaa9f17671e29b806fd494440f39

                            SHA1

                            9679b5f990ebb62745512db13239bdaf54af5266

                            SHA256

                            c4358a9d0f8faa5f1bf94f795137b895fa874ccd4b3b8e7c83bf6649208fc4c8

                            SHA512

                            90e1fa0e162e5a9ea0f6291aece2f1541caa177ce3e393f60c11ccb2dc52ab99edb19dd600cc031014056398de4dd2485a2568f19b16131b3f94a28ec09c9824

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            abcdb107b71f2a3d1af2775fb809b259

                            SHA1

                            0a7af2e23e224f2042e00a7b32b64b72336749a6

                            SHA256

                            f2d5df9179ed022173b2143440def7a01e45294239b2f76714f111b56486366d

                            SHA512

                            dcb75bd6c4844c383096b5e3601c1c5575b207e91d08847036a7928fc1ebd2fc2a06ac68ad40d82ce95dab700dbbab52e57522ddec8d2c6f4708746a0bf3faca

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            10KB

                            MD5

                            4e3ee2137077e0092ea361b7f0b2cc26

                            SHA1

                            621916e474137152e6e30b9e8ee36be6f3cf2860

                            SHA256

                            b210a7c7f308e1dee7c2fb11cb7d548942b38b855992a3af7106a1a6ba9a5a06

                            SHA512

                            43b12a3adf81d903b45c20b2f752e24d7c36cdde4716d0f2e2d5e81e7b7806399f7add683eacc88d091ee24bf7fee66e59cb768126a0befc2bde546abb1d14bf

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            99KB

                            MD5

                            458e89a44a5ac2f6215f5035bdbb2594

                            SHA1

                            ee05ae1c519dd9ed7a3afe2377a5c81440d9deaa

                            SHA256

                            52e950303703306c6e60f1d5003c59e4901536a7c054e0615da7db0f8b0792f2

                            SHA512

                            e32c08c4216dfaceef366038519d006e91a12ee1b117dd8a335062eeff811de578c1ae81178ee0a52d0dd73dc147c029560959794880e06ec7305fddf555547c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            99KB

                            MD5

                            d58fb5de273f7f378fdba0099b9d5e0b

                            SHA1

                            c98c5668a6a8505be4664cd4c0199b49eb492463

                            SHA256

                            862e20d62aca42a029322a82d68d18f0d2d068d6b7658a50c8d08a9f55ac493f

                            SHA512

                            de8ed2ed30c7907547cc75807bbf08e77041d168dc024f3370c3553e88aaae98f6b894fda1d8aeb34800d6a2f32726f13fb8c23ce0118b8e753e8676d04e1306

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

                            Filesize

                            264KB

                            MD5

                            54284ff051fe8c4b6f4e24258ff81675

                            SHA1

                            ee1e20d0136ca3f6c6e8740b3cf77a05d90257c7

                            SHA256

                            0ba90723af0cf1055545acd0873aa3f63f5d283a3320bc9d0229668f8c8bc4a0

                            SHA512

                            a4ef897edbdbf88d40097b3e555986b8e30c9dafff5dff527acea71c514e6ed47878e37e12fafeb28f571d10011e55ff3a7b18941aa1a95ad6dbb4aa892a0bd6