Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

01/10/2024, 16:19

241001-tsz37syelm 7

01/10/2024, 16:18

241001-tr7rnaydrn 7

Analysis

  • max time kernel
    65s
  • max time network
    63s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/10/2024, 16:18

General

  • Target

    otp.exe

  • Size

    5.3MB

  • MD5

    c67810e7b3665bdb07065a6e9cfebc79

  • SHA1

    9896d44a9f00b0938f605a2f868d1863ac1b56a7

  • SHA256

    c20ca1fdbfa65887838ce07951d71f50009613bc0f1060346659c33909e132d4

  • SHA512

    a3364f5c21e0a664c97161ba275890d748f08db362157549f70273d093e4cb9f18a30bbd1af000981bb55f8cde8ba3bafd8abb5c8940f4320e706758d97a5cbc

  • SSDEEP

    98304:2S883epzb71QGQCPDbZfx8ayCb7BJ5mjwNwwMeZYobSr+zO5cFEJ:2StsdQmRJ8aycBIGpEou5cS

Score
7/10

Malware Config

Signatures

  • Loads dropped DLL 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\otp.exe
    "C:\Users\Admin\AppData\Local\Temp\otp.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5032
    • C:\Users\Admin\AppData\Local\Temp\otp.exe
      "C:\Users\Admin\AppData\Local\Temp\otp.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:4372
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c color 0A
        3⤵
          PID:2428
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe"
      1⤵
      • Enumerates system info in registry
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of WriteProcessMemory
      PID:4768
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdaedccc40,0x7ffdaedccc4c,0x7ffdaedccc58
        2⤵
          PID:312
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2100,i,16206602024719046787,45900713806544008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2096 /prefetch:2
          2⤵
            PID:4644
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1980,i,16206602024719046787,45900713806544008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2164 /prefetch:3
            2⤵
              PID:1284
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2332,i,16206602024719046787,45900713806544008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2500 /prefetch:8
              2⤵
                PID:5092
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3164,i,16206602024719046787,45900713806544008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3176 /prefetch:1
                2⤵
                  PID:1656
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3264,i,16206602024719046787,45900713806544008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3376 /prefetch:1
                  2⤵
                    PID:4360
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3708,i,16206602024719046787,45900713806544008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4572 /prefetch:1
                    2⤵
                      PID:4576
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3160,i,16206602024719046787,45900713806544008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4788 /prefetch:8
                      2⤵
                        PID:2972
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4828,i,16206602024719046787,45900713806544008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4816 /prefetch:8
                        2⤵
                          PID:672
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3832,i,16206602024719046787,45900713806544008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4408 /prefetch:1
                          2⤵
                            PID:4928
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3200,i,16206602024719046787,45900713806544008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5060 /prefetch:8
                            2⤵
                              PID:696
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=3356,i,16206602024719046787,45900713806544008,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3336 /prefetch:8
                              2⤵
                                PID:4740
                            • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                              "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                              1⤵
                                PID:3480
                              • C:\Windows\system32\svchost.exe
                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                                1⤵
                                  PID:2112

                                Network

                                MITRE ATT&CK Enterprise v15

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                                  Filesize

                                  649B

                                  MD5

                                  8f7a438e88ac1fa611945298acf96850

                                  SHA1

                                  e1144171f2a04fbdd5f6a549ac1a345184c3b434

                                  SHA256

                                  f2be026da38fd816b745ad069e9869df5ab70b53324c93502208fbd5fc4ce496

                                  SHA512

                                  8be3a7d16325ab292d5c0162440f5e82d2e61aa474fcbb0b4489fb8fe2d2bf86198c320dddfdc7390feb0e60e2a6878835b489ed5d80b268290cca0bc1b01842

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                  Filesize

                                  432B

                                  MD5

                                  525ac6c623f9c8baeea74f2565eee62b

                                  SHA1

                                  606b1bbaf01ddd4cb18c70731acd14bf7c3d9dfe

                                  SHA256

                                  78e2f93017cf90d83c724fc7634601948436c87ef8660f9fa917cf5e91ec0ec3

                                  SHA512

                                  36723a38d5ec1fef4fff506afcbf05a0a2ffa4bb5d2ca60f41c831c42ddeba084617525143e9d2c67705dcb032f76592d04cf68cf72aab566117f0196b8f4bd8

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\37bab443-874b-435c-8513-b7ee38804b10.tmp

                                  Filesize

                                  356B

                                  MD5

                                  490fad2829e80286fda7405423452973

                                  SHA1

                                  aec2a985c363004516b119d5f5fcba7fbeb2006e

                                  SHA256

                                  378fa13356c3eb402aa82f7a3be20325e1d32a9ad36dde77cb2ddaee70e8dbcf

                                  SHA512

                                  0c0818e351e8e00749ee69994e55da26c8568cc2c335c1ed7df36e23e48966828fedbd862a19499d3047acd284e1246bb1df707565da3258236a1ce2ff8779b2

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                                  Filesize

                                  2B

                                  MD5

                                  d751713988987e9331980363e24189ce

                                  SHA1

                                  97d170e1550eee4afc0af065b78cda302a97674c

                                  SHA256

                                  4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                  SHA512

                                  b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                  Filesize

                                  356B

                                  MD5

                                  d102759733af40dd11045871dc9ed492

                                  SHA1

                                  02b8e8005eefaaafa5916c1c51a266683866d86b

                                  SHA256

                                  ebfb58c28650a014447633ef8676a6c71ce04b64a81683fc58454fe2b2e42de7

                                  SHA512

                                  3efd3b7d10333b8ff12988604feeae1de0e0c0a6034d78417f3ca863949cf88ea2a1c7d98878722f8fe847a8be6bab578eb066db33b701defece6ae211744d83

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  9KB

                                  MD5

                                  c80ff4cb435a74e26dc8b41f0dcbac3d

                                  SHA1

                                  78da94fdfcca74b8d4b2d6eba3a032f2efde6c0b

                                  SHA256

                                  8186912fba3d567ae15cc482a1927b848086411f58bf971fbb4bd1507bdf8932

                                  SHA512

                                  006108489cd565434443812aea986bf9e4b4aee841f97868e9240af0da0843e3cd717cf6846053250960e87e9f60d7f570124abb4af9dbf15599820c7af5b7b2

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  9KB

                                  MD5

                                  749d323777cdbf03d3732adeaffa632c

                                  SHA1

                                  8fc0e19ec57762b42c6d2af0f6150f8a9ce44f5c

                                  SHA256

                                  efef64d454e70a951a2c21c43e1a04317b048861abae72ba5ab7a6a32c027394

                                  SHA512

                                  ad04ea1797a6d048cc8a378ec4374cd95f2097ed221dad6982dd2ff317185ab88a078efaacaaea47c450640a4b5b4de30a16b50edf296312e03c2a81b6f33efa

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  9KB

                                  MD5

                                  7dee21e3dd0e1045fcd28a797bb81c5b

                                  SHA1

                                  2837e7672556672a4b2aa84ce1553417c1e83a29

                                  SHA256

                                  5208b7869c3dd894a9669969a21752c0539a148d904538d6bd7949eb04085370

                                  SHA512

                                  63ca5e05e556540e13ddcd77b36c726ec739562eed731b9a36ebbd5f7fa3ba6c05adb5833390f8aa5739a50985750b79179b1e09712c2b0ae1424cb7ca16ff18

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                  Filesize

                                  15KB

                                  MD5

                                  4c9b7af18a8aa60dceadd844295450df

                                  SHA1

                                  d9f53fe2bd4ec2c579ac5bb394ef14a859a35e16

                                  SHA256

                                  195f04d45d1ded02dc026bfe2a576adf65326c5cbc1fe1506bd090afd53d5033

                                  SHA512

                                  d8158a16c886f68101450c1752d1b3b83becc0a48ee152c0214b42ae7717bcf98dfa070cf16eb2a7ed01c11b50124c0b5fe6b36f7a6ee7aaeec77031cd44f65b

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  210KB

                                  MD5

                                  9f54c10e925c6d56ddbd951f056938ed

                                  SHA1

                                  896c6cf2477ecac72b947d5b7f156d17430318b5

                                  SHA256

                                  de705a5ac4198e688695bb839d1b197798a2d29daf04c229bf319fdaf4805e11

                                  SHA512

                                  82993a1918bb759d10508a99c0b0c2152c4a5bd748af225f58276297faf22f1f6b8eb807c91bd9a040628a38393ee7bc952530fa0173ff1c4c6b91baf7ab3289

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  210KB

                                  MD5

                                  7fd58a812b74885ae47a1f3a6e927e0d

                                  SHA1

                                  3ce531e03379ac048a0ec473fbc1e89db4e3563b

                                  SHA256

                                  f2ac7856701dcaf102cc0079cd2bd4ece2846b4ae426e55cb8aeeea8e891d173

                                  SHA512

                                  f9f41b5822cf2b76c6489f0a31a675a134d3eec0f7e10049e63e47a1aa9b6f6cf0d4053ed185666873a843561ce67642fa40eec6d248c618a55f7755a1c4754a

                                • C:\Users\Admin\AppData\Local\Temp\_MEI50322\VCRUNTIME140.dll

                                  Filesize

                                  106KB

                                  MD5

                                  870fea4e961e2fbd00110d3783e529be

                                  SHA1

                                  a948e65c6f73d7da4ffde4e8533c098a00cc7311

                                  SHA256

                                  76fdb83fde238226b5bebaf3392ee562e2cb7ca8d3ef75983bf5f9d6c7119644

                                  SHA512

                                  0b636a3cdefa343eb4cb228b391bb657b5b4c20df62889cd1be44c7bee94ffad6ec82dc4db79949edef576bff57867e0d084e0a597bf7bf5c8e4ed1268477e88

                                • C:\Users\Admin\AppData\Local\Temp\_MEI50322\_ctypes.pyd

                                  Filesize

                                  119KB

                                  MD5

                                  ca4cef051737b0e4e56b7d597238df94

                                  SHA1

                                  583df3f7ecade0252fdff608eb969439956f5c4a

                                  SHA256

                                  e60a2b100c4fa50b0b144cf825fe3cde21a8b7b60b92bfc326cb39573ce96b2b

                                  SHA512

                                  17103d6b5fa84156055e60f9e5756ffc31584cdb6274c686a136291c58ba0be00238d501f8acc1f1ca7e1a1fadcb0c7fefddcb98cedb9dd04325314f7e905df3

                                • C:\Users\Admin\AppData\Local\Temp\_MEI50322\_socket.pyd

                                  Filesize

                                  75KB

                                  MD5

                                  0f5e64e33f4d328ef11357635707d154

                                  SHA1

                                  8b6dcb4b9952b362f739a3f16ae96c44bea94a0e

                                  SHA256

                                  8af6d70d44bb9398733f88bcfb6d2085dd1a193cd00e52120b96a651f6e35ebe

                                  SHA512

                                  4be9febb583364da75b6fb3a43a8b50ee29ca8fc1dda35b96c0fcc493342372f69b4f27f2604888bca099c8d00f38a16f4c9463c16eff098227d812c29563643

                                • C:\Users\Admin\AppData\Local\Temp\_MEI50322\base_library.zip

                                  Filesize

                                  812KB

                                  MD5

                                  524a85217dc9edc8c9efc73159ca955d

                                  SHA1

                                  a4238cbde50443262d00a843ffe814435fb0f4e2

                                  SHA256

                                  808549964adb09afafb410cdc030df4813c5c2a7276a94e7f116103af5de7621

                                  SHA512

                                  f5a929b35a63f073bdc7600155ba2f0f262e6f60cf67efb38fa44e8b3be085cf1d5741d66d25a1ecaaf3f94abfe9bbe97d135f8a47c11f2b811d2aac6876f46c

                                • C:\Users\Admin\AppData\Local\Temp\_MEI50322\libffi-7.dll

                                  Filesize

                                  32KB

                                  MD5

                                  eef7981412be8ea459064d3090f4b3aa

                                  SHA1

                                  c60da4830ce27afc234b3c3014c583f7f0a5a925

                                  SHA256

                                  f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081

                                  SHA512

                                  dc9ff4202f74a13ca9949a123dff4c0223da969f49e9348feaf93da4470f7be82cfa1d392566eaaa836d77dde7193fed15a8395509f72a0e9f97c66c0a096016

                                • C:\Users\Admin\AppData\Local\Temp\_MEI50322\python310.dll

                                  Filesize

                                  4.3MB

                                  MD5

                                  deaf0c0cc3369363b800d2e8e756a402

                                  SHA1

                                  3085778735dd8badad4e39df688139f4eed5f954

                                  SHA256

                                  156cf2b64dd0f4d9bdb346b654a11300d6e9e15a65ef69089923dafc1c71e33d

                                  SHA512

                                  5cac1d92af7ee18425b5ee8e7cd4e941a9ddffb4bc1c12bb8aeabeed09acec1ff0309abc41a2e0c8db101fee40724f8bfb27a78898128f8746c8fe01c1631989

                                • C:\Users\Admin\AppData\Local\Temp\_MEI50322\select.pyd

                                  Filesize

                                  28KB

                                  MD5

                                  c119811a40667dca93dfe6faa418f47a

                                  SHA1

                                  113e792b7dcec4366fc273e80b1fc404c309074c

                                  SHA256

                                  8f27cd8c5071cb740a2191b3c599e99595b121f461988166f07d9f841e7116b7

                                  SHA512

                                  107257dbd8cf2607e4a1c7bef928a6f61ebdfc21be1c4bdc3a649567e067e9bb7ea40c0ac8844d2cedd08682447b963148b52f85adb1837f243df57af94c04b3