Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/09/2024, 01:48

General

  • Target

    c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe

  • Size

    1.1MB

  • MD5

    55ad212ef14e1d3a99251ba84d4c3497

  • SHA1

    5f7127f6f859cae4b9d19f700196cb207a6ddd87

  • SHA256

    c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33

  • SHA512

    8199e1b9e83ea7f028c6f851b886d3cac829c533489c5e3292bc74b94df2900c7e4168dadec1f4ac0e12bff8a08679433586f79b719a240bb94cb816df5b5c76

  • SSDEEP

    24576:yqDEvCTbMWu7rQYlBQcBiT6rprG8arB2+b+HdiJUK:yTvC/MTQYxsWR7arB2+b+HoJU

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe
    "C:\Users\Admin\AppData\Local\Temp\c4ef6abb3459faf2b1c99b9ebdb68e27bda102f71df30c1e773bf737cc2d9f33.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:448
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --kiosk https://youtube.com/account?=https://accounts.google.com/v3/signin/challenge/pwd
      2⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:1804
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7fffd50dcc40,0x7fffd50dcc4c,0x7fffd50dcc58
        3⤵
          PID:3068
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1928,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1920 /prefetch:2
          3⤵
            PID:2028
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2068,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=2120 /prefetch:3
            3⤵
              PID:632
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=1772 /prefetch:8
              3⤵
                PID:1788
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3128,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3148 /prefetch:1
                3⤵
                  PID:2444
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3136,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=3172 /prefetch:1
                  3⤵
                    PID:4436
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4500,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4524 /prefetch:8
                    3⤵
                      PID:2740
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4456,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=4672 /prefetch:8
                      3⤵
                        PID:3536
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=728,i,1215246375798268292,16086301546359138616,262144 --variations-seed-version=20240802-050153.822000 --mojo-platform-channel-handle=5000 /prefetch:8
                        3⤵
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4520
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:4580
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:1980

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                        Filesize

                        649B

                        MD5

                        3df6e543100e45a087305ffe7bb71e67

                        SHA1

                        44867ed1cb70f750a1513384c9033ec46a79dcbe

                        SHA256

                        76248bf17eac5676ce452a92e69c42b996dd890ca281d8807e42bf0721b6dd62

                        SHA512

                        274401399659e8e1d5bbb780be0cf183766113416ff6f2cb6559f7ae2eeabb85984ab418ef7f7d42b0cbd7713ef66c51b465458c6709addbdfed6deac140d71d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        264B

                        MD5

                        55435a143b590d4300244cdcfd12e6de

                        SHA1

                        154c3bb916d2647d91a2fbe276b407679b77e25c

                        SHA256

                        bb1ace259e1a6df2bf65044eb460631725725e8eaa722dc86f7c2594e04de749

                        SHA512

                        6e89a7975db746a31261fe6710840db60110cfb77f9b909ebacf40c5b1b66fe2b1986a16456adee95b489ee20f945f3913059da069eae2ad0700c2fb41b372da

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        1fcce7f6b6bd5a53a84c33a43146dd8f

                        SHA1

                        9a5b934135e36ebb2bd5fa326605d23e1490f9db

                        SHA256

                        931ba44428de0370867d7311ca4f1715469fe2a634b81b20e10cfff0b73f0728

                        SHA512

                        52dacbb92b1bdb515e8644d2e0db52af67cd3f891eb95d082255fadcb568c021b293af989b5568cb4438fcf7c8e12b1279c7ce3bb4db6a2ffc03c253257fcc82

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        3a62cee8b2518bfec129ee6b13f0f0b0

                        SHA1

                        c97201e67cba3218dbdffd8c9572aaf180bf8cf8

                        SHA256

                        fba384a8830dee2c8a1d7bc49d794e3b3de2a4681f01b99b7d46093547087e3f

                        SHA512

                        ed03426b691dd06ead9200f7ec49092325892b6e71b1901394e57abb8cff811bd14da587f87d91866c6c386b4a22fd119ee02a5d62de65a3e72f4e1593ad068a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        857B

                        MD5

                        815dc00fb66e36e59d453217e7f1de81

                        SHA1

                        ffac3c1285506d5d97568243cea0d95bd8973634

                        SHA256

                        4eb0f81a81e0f8c073a421688f12b074a3e556a710212c0c1d0aea1979085e27

                        SHA512

                        af68d9c1429a802251fbeaf606377dc431c6c9bc9db8ec10ce58106d368b4be97f5fcb35add7117aee96811d58a18b04b79efafc01e5c45ca05c69c138bfb3fc

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        6176ec0d7f3ece137e71e3f063c38689

                        SHA1

                        94b8aac8db94a3da4c3ad09dd40269d778a9e0ab

                        SHA256

                        05eac3206ac2261860051649695d795060307b795c91878dd64bea4aba0d582c

                        SHA512

                        8dd6a4cc7626cf95c7a47b193b3ce13e61a004577d307c5d5221be06704d5a82f7194541a0c046df3d3c8e41ab9d7cbb105a40f397665eb90502874332f4eb6c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        10KB

                        MD5

                        36c21bdf134c8ca3152ec37df1ab3081

                        SHA1

                        41897f733800f75c446fdde794d0dfd0e22108a4

                        SHA256

                        8a0a208c7a8dba2a1bec9a40475141901c82745adbac7dfcebd0651483824fa7

                        SHA512

                        6c8dae2dc4024bc2283f98cfda80608cf85682d0643be9b4c8596580d23a03ee22a08e8fce7053cc3d36f5c76e0dbbd25db5c0184c64651ba685a0ffc4ec3f5d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        10KB

                        MD5

                        c62254dcec11a6638c9be34a852b2f8a

                        SHA1

                        8911328b92dacbd5c9ae12fc805a4b97db83c2a1

                        SHA256

                        90e53305fc991e1e30fbeb7abe11b16e14c4c7c6d7a31cf7619a16a9be38da3c

                        SHA512

                        758bc436184fc762b20d8745283eee659a62f81c6b4773323fe64aeb924050b9e678a67c63205b23a8fd4efd70f081b8e1d6a93e5ed7ebc0582d1e37454869d3

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        10KB

                        MD5

                        4c5e3dc09406ea052029970a07700a45

                        SHA1

                        033ebae169ba87a79b7b0ce9a932aea9f81ed942

                        SHA256

                        3054f66c9fdb91dd36d50f0d88737d045141299814ab7c999640b79a390227c7

                        SHA512

                        d50781fd2fbc5a4a7b1e548a1c8487bd01f4e4400ee749761111ebdcaba0117434640ce3f0541ae1ff1f4c442bc1c3760784f9ee3aa8e3a5c7f39ac022c02268

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        742eb2e674c5b75e3cf90caff8cd2d54

                        SHA1

                        755f0cbd04f46510fd03a1c5de19540d6d5ae7aa

                        SHA256

                        25c39623a3009f9c641053dcb91c898c06b8378c03854a5ccc071ac2a11a8cd2

                        SHA512

                        ac4ba61fc1cc53cac449fb15c7fde23615b092e1b65870c1ea9603b09510c8624fe587280ae824969fcc01721fe664d12c9ad46d7cfbeb3d2636ee66b6cf9294

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        0ad19c49afad32694faef1b9a8f4fc10

                        SHA1

                        6b55173309d205e8f8746d62229a8dc1248eaacd

                        SHA256

                        1753880ffde36dd0de982338c67837dabbf23e44611483c81c6fb611f0f03412

                        SHA512

                        27fb5981c068a9cbd9e94b5fbedb50c80fe1ab7f49d5042bafea31a36579d570a69f5600b466de50bfa37b49413420f6aea7c4d63c3f80f6138a2bb84bef129f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                        Filesize

                        15KB

                        MD5

                        c28a0b8faf86e9dfb2ac12c85017897b

                        SHA1

                        7aa7a2793796f81885c8adcebfab88d34648cde0

                        SHA256

                        1a130310abd3430159740dbf23a49438ea2a0005cb4e3bed6f883fcaab30f898

                        SHA512

                        56cb239f93c872f3571f4f16c93aeae2988ba432fd00d015de10c0bebd7be93564d5a060e1a640757b9ad5da49739bbccdaa050ea74838200d2b30baec1e3e3f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        212KB

                        MD5

                        83ea309e206de94121b3e257fe474ab4

                        SHA1

                        2d129cc5ad2d6c54bbae63aa1cfaba601ede6d3a

                        SHA256

                        ea4430946b5a2d7cb5ecd7aa7601f0466161e14a74f0796c8c3d0174fe56a52b

                        SHA512

                        a027f42d8c6674f7ef8232eb6945db78475ca74d7b4f8f4aec207b8eabb62edb0b53d7fdb785146ad39019e950887ef4f59700639d04a6d027f2bdf6fa13faf2

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        212KB

                        MD5

                        de26e2ec91cede1f11a771a1b5835be5

                        SHA1

                        1f23e6ba449a894e12ac6333dbff53be6b6159bf

                        SHA256

                        d75408e0e4fa310f20bf3a65f72a7c8649ea70048f083df475f6af06d2c20931

                        SHA512

                        fe0776b1a38fc425bf4aa6d39ed6036cf5108f34acb2bb05edd451b33c2b82c77562f84a7373417176f612f474514fb3d94619af46e596707f93fa5f728822c9