Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    71s
  • max time network
    70s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2024, 15:56

General

  • Target

    http://app.connect.awspls.com/e/er?s=893759278&lid=128682&elqTrackId=087DDC36BD9977592BF38AE4B33DCF02&elqcontid=51536129&elq=c138ee6717da4735a47a3e16264a5460&elqaid=196706&elqat=1&utm_campaign=27075.009_CTO_30.09&utm_medium=email&utm_source=internalemail&MAC=&elqContactId=51536129&disc=&elqCampId=175423&utm_content=27075.009_CTO_30.09&elqak=8AF51C5AFE17E06C9349CEA84C3E3B2369B322FCB6D4BB5DB731A643D66D75899246

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://app.connect.awspls.com/e/er?s=893759278&lid=128682&elqTrackId=087DDC36BD9977592BF38AE4B33DCF02&elqcontid=51536129&elq=c138ee6717da4735a47a3e16264a5460&elqaid=196706&elqat=1&utm_campaign=27075.009_CTO_30.09&utm_medium=email&utm_source=internalemail&MAC=&elqContactId=51536129&disc=&elqCampId=175423&utm_content=27075.009_CTO_30.09&elqak=8AF51C5AFE17E06C9349CEA84C3E3B2369B322FCB6D4BB5DB731A643D66D75899246
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4632
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb973fcc40,0x7ffb973fcc4c,0x7ffb973fcc58
      2⤵
        PID:1844
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1808,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1804 /prefetch:2
        2⤵
          PID:1472
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2132,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2172 /prefetch:3
          2⤵
            PID:2404
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2352 /prefetch:8
            2⤵
              PID:4388
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3044,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3060 /prefetch:1
              2⤵
                PID:4752
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3056,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3292 /prefetch:1
                2⤵
                  PID:3612
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4000,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4004 /prefetch:1
                  2⤵
                    PID:1680
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3452,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3456 /prefetch:8
                    2⤵
                      PID:3912
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4792,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4992 /prefetch:1
                      2⤵
                        PID:3140
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4656,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5088 /prefetch:1
                        2⤵
                          PID:1688
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=4920,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4668 /prefetch:1
                          2⤵
                            PID:3040
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=4944,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3840 /prefetch:1
                            2⤵
                              PID:3120
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=5716,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5032 /prefetch:2
                              2⤵
                                PID:872
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --field-trial-handle=5124,i,18244591178522834574,9241422027811647765,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5064 /prefetch:1
                                2⤵
                                  PID:1396
                              • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                1⤵
                                  PID:3976
                                • C:\Windows\system32\svchost.exe
                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                  1⤵
                                    PID:3508

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                    Filesize

                                    649B

                                    MD5

                                    68214ca582d5b351c9cd1cedf22bc0fb

                                    SHA1

                                    32b4757a2f0544fc9216eeec1d0b1483c6dd7d14

                                    SHA256

                                    ed3b6a2942bdc5f8314c3d9263b8f321d0ef29dbf1a51a68b9e50b1e688c772b

                                    SHA512

                                    bca67430f1ad04c2d2cd3dd3d1abf6bd20260c51cd425e6f253ebbcdb5ca2cb1bc8c11d6779588dadde8ad28177bdaa15de0b9ffd6ddf69bd8cdce5598b25847

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000016

                                    Filesize

                                    213KB

                                    MD5

                                    f942900ff0a10f251d338c612c456948

                                    SHA1

                                    4a283d3c8f3dc491e43c430d97c3489ee7a3d320

                                    SHA256

                                    38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

                                    SHA512

                                    9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                    Filesize

                                    864B

                                    MD5

                                    c87a3feca12e74b1bf2e6c82eb0f0d84

                                    SHA1

                                    00d3ab7cb27b107819e4f2cd4b66710f19d1e71c

                                    SHA256

                                    0fc9a7478c67b33f5c49ad4e03bd54931f5a9f30f2ce7329ce889f9fe44a9f2c

                                    SHA512

                                    d31e32a5b1ed9cfffecc948ec40fe5f4637cd73efd3493b2efa9a1a6f999f7493b8b81f53cdb9f1511d4296c6c68d20832067375a6d9e3ba08ae103597174c4a

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    1KB

                                    MD5

                                    985ea13519e344470b0f4739d7c53929

                                    SHA1

                                    9050570ef41ec65f5dee93b328bee0b010b55002

                                    SHA256

                                    c4299d5eca993a58ff3c54fe364b990cc105603c674e7d83ddc6d9760fe0f391

                                    SHA512

                                    da0e367c1292b1c1e2be2a9d056901d2b7f675bd7679ed86b82aed3b825a6203a34657f0fe654e6033404da17349b22d0718e383654124f2922107e763d02b83

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                    Filesize

                                    2B

                                    MD5

                                    d751713988987e9331980363e24189ce

                                    SHA1

                                    97d170e1550eee4afc0af065b78cda302a97674c

                                    SHA256

                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                    SHA512

                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    2KB

                                    MD5

                                    b203c911926b21f325093502e0e16217

                                    SHA1

                                    fce6cb5e0506214b74ba9ba3b01370e4f9e1c94b

                                    SHA256

                                    a6cc272b59e47db3e050e1baae8ed5cb2f75221f0ec1524001453b8259ac8e16

                                    SHA512

                                    df73a4797b90fe4794ee30cc29ea3d9b63b9d7bcdfe41959811fdbcffe5e3955b7b3d30a198e8d50b9fb6e526181d64ebfc40adf4e11825eb516fc5214001f29

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    523B

                                    MD5

                                    dba605073a2520297bb71eb4c58b7760

                                    SHA1

                                    aa05ec504fe8e0f0719d15ac4cacafa6dd2a93c4

                                    SHA256

                                    e45587b4544cb9dcfdd795f3f399b9390119df40e61f96cf1a8e6fd2b5472050

                                    SHA512

                                    ce0e9cc77e71432636d1da7f6b6523913c9c9c45a402c048e981c08271ff4437679503c42d1558f26fc9c405c7feb2c1ecc3dd612e1cd5b8b3862e0ad98f7d02

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    2KB

                                    MD5

                                    a14bf5e2ba59587ffe5aa166973d5197

                                    SHA1

                                    60a557e41cd6c01d5150f57c4bc1bc6e90dd0475

                                    SHA256

                                    90d56e91eb87e5b9e977beaf22ba3d2286279edb5ddf69d19acb2edf78f7f0a1

                                    SHA512

                                    3614a17b8483a5e2b757da97eead02eeb45f405209a8219d1394120297f1db97b40f6a54bb4ac222598dd7c38192ef6ff0e5025f824139e1350eddd6cd3cdfa2

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    88ea25759820379e5c30d2096447fc84

                                    SHA1

                                    b1522da2eed9db21475ae5ce06eb6498333c6f99

                                    SHA256

                                    f67b4cb02375a4b4470ff821300219a1abeaba143a468082877febb3a9a3bacf

                                    SHA512

                                    14fc9588399ca27ac4df3f944dc4637e6d5331603eb0f31286c8d67c5f5bf00e65d2fb8e113992917445fe48944a1d23493001c26895e26324ef2a12e9a8f699

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    61c404e3f8bf94875019811f42294b1f

                                    SHA1

                                    37703c04f0e98a0538685382a2339905f85fb25b

                                    SHA256

                                    b37e734d88c534fd244d7e01c96e106770ad182a1963364117f997da0ce04b0c

                                    SHA512

                                    47c0116f584332086c76b4b7aa0504dd87dc8a8fff1525c63667ac87b18d1eb113c3a25a330677ce160fed19ca73cb40f9056123359998d739f5995847465f74

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    77d73bd527f4f81d91e993804be9e11a

                                    SHA1

                                    f11715aa07c8dd20bdab27de6481beeeee3e3f84

                                    SHA256

                                    c1b4e54443a597319f1cfa808d4b4496e4b4016af5beeec42079aa81cd840570

                                    SHA512

                                    0588e7c1cbd7977342accd8a4be6dd09527180569baec9811927d05d833a1e013d89a357a906f1a7fc210d0f895336477ad87d3f036365062c52b350f7ac6129

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    5d13ca951b9208a75dd143ee615b5695

                                    SHA1

                                    103f2c3966400bd34cd7d89e39fa2c8c8beb7add

                                    SHA256

                                    84ad6f233598496d9c07c09c74c066ed3073a3a095e3fe43cf5b4fef7ad42794

                                    SHA512

                                    ee1be948f98161461e8361c13e7d7c424ce6885b617fb3d7f794d081391a3f4381b7351ae93646d41873c2c22ed7ecbf46eff56078f34d1c63748df36bdeca27

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    9KB

                                    MD5

                                    bb852247737d88b19901b0c7aff5d86c

                                    SHA1

                                    106928713fd075282b0f5ee52ee866f99b6a2f51

                                    SHA256

                                    3667512715782733cf004044c01b47d99334f57ccf8a7d2d0525a0504a394f37

                                    SHA512

                                    64031a1ddd1745ba3f575093770d4ed27a6d7a76f6556a08c5b07bcfd6dbc10aa1f6b2ce8dc30c980ce3228bdb8d88d088c28292e6844d60da00a927778adc0e

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    99KB

                                    MD5

                                    a4106e4caf76d134fa209cdbde641934

                                    SHA1

                                    262b4fed07e333365905ab8e0dbf266d4fdbba97

                                    SHA256

                                    1d999ca06b3d7945b2ca1dedb7be984b2084cec80171d8bd2e20b69139806c3a

                                    SHA512

                                    b4bf4da2a0307fb299933828fd97abf895301ec86e815113b12045d516bd9dda4cd69b578cb914c7267ce9419e341df960ec7535905a44c4df9df783284f2d97

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    99KB

                                    MD5

                                    1bd6e02104bf6668b23e412f72a3ab81

                                    SHA1

                                    e0534509383ab67b8ad36b5ab1e359feba1633c1

                                    SHA256

                                    7f6951c308f7904250f34e99306eb6e686390160baf436fdb1ec4e0d8523cb6a

                                    SHA512

                                    14348cdb3b870478a7d4f77597c68ae1f192ad7998fafd2a0fe9aa67f8aec79ca8799c23afb4f676f89f79000313cfb0af72dd410d58ba39efdc26e7bbec7899

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                    Filesize

                                    99KB

                                    MD5

                                    1f5d483fbc682a338fea76e11ce0da71

                                    SHA1

                                    52aeae56ef51a1cb9e697e6335086d8be3dcbcd0

                                    SHA256

                                    9ae4dfcbf58f4cb0efa6c7a4c64defa9fbb66e38ed48545c5987594b78dc29b5

                                    SHA512

                                    492d96b672c234ff22d9158fd4b296392c188c82e46837afc17835df77b510a1c5435d83f81b57e5fafe1f560ffb03e4916f6ea7a25ab746abc7c77af7d90158