Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    104s
  • max time network
    101s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/10/2024, 11:04

General

  • Target

    https://drive.google.com/file/d/1XzSFs7GGBe-OY7sRd5k-MZThWfQAi6lY/view?usp=drive_link

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/file/d/1XzSFs7GGBe-OY7sRd5k-MZThWfQAi6lY/view?usp=drive_link
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff9c8bfcc40,0x7ff9c8bfcc4c,0x7ff9c8bfcc58
      2⤵
        PID:3452
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,13447907295907068870,2278864586824722528,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1876 /prefetch:2
        2⤵
          PID:4988
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1944,i,13447907295907068870,2278864586824722528,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2192 /prefetch:3
          2⤵
            PID:64
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2276,i,13447907295907068870,2278864586824722528,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2480 /prefetch:8
            2⤵
              PID:4120
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3136,i,13447907295907068870,2278864586824722528,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3144 /prefetch:1
              2⤵
                PID:2600
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,13447907295907068870,2278864586824722528,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3200 /prefetch:1
                2⤵
                  PID:2156
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4448,i,13447907295907068870,2278864586824722528,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4472 /prefetch:1
                  2⤵
                    PID:1528
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --field-trial-handle=4608,i,13447907295907068870,2278864586824722528,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4616 /prefetch:8
                    2⤵
                      PID:3016
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4176,i,13447907295907068870,2278864586824722528,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4124 /prefetch:8
                      2⤵
                      • Modifies registry class
                      PID:2728
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5260,i,13447907295907068870,2278864586824722528,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5268 /prefetch:8
                      2⤵
                        PID:3056
                    • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                      1⤵
                        PID:3656
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:2100

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                          Filesize

                          649B

                          MD5

                          596a1dbdf59e9b6812820d5f7b8666f1

                          SHA1

                          148d102ed431d280d921b3a9fb982e46222fcfcc

                          SHA256

                          7fd89a8de78ee27b1f99bbbe8d8e08d2a3449b6ec272c0420fa60d57e322b769

                          SHA512

                          b32f5aea8a5d7fe7fcc7934ae2c6f1cacb49a232606bda1cb8648a1d1f4ce225dfb7ea5f4ed7794608866bdb975a47bb8fe9607ce0f6483916e10f6ea8daf591

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          888B

                          MD5

                          eb1b73600e555fec87a9ae93c1fca767

                          SHA1

                          15fdd682fb88c1da3e8bba2279869757cc3183ac

                          SHA256

                          1f4c24e5539b3180f0d69f9e789d26c461366efc1086032f11351645704d9478

                          SHA512

                          8217b980c2a276b2bef203a9ee2a06871dfcfde44421d82c3c4018237facc1e62f4d6ae68a60c2582a3430a4906efc1f295c02f809952925387714ca6a0d4501

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\4d0a6c3e-6db3-4f4c-9376-50bff2ee92e2.tmp

                          Filesize

                          356B

                          MD5

                          513e58a982f808190a46756548d5a78d

                          SHA1

                          39cba630d92313ee30d2b100bc8b2393b443c869

                          SHA256

                          ed4fd1a77b192ae613090240f2463619406e627037669a68bfb6d7020cb982aa

                          SHA512

                          95326b72013830321544684f4c54fc8513de6fb0c90bc19ca51be02daf07d4971f666153fe804f8f2e8add0fd2a161c717afecf12adc88e19d0f1541dec69341

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9bb183c1-c2d4-4707-bdd3-5e55050ef36c.tmp

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          2KB

                          MD5

                          429707e13aa8df23e64b5dfe9c0c03e0

                          SHA1

                          b2aed0650e5381c8779c30915834e6fdd05ac19c

                          SHA256

                          ea9632c8592d7d44d847e0df6a829b60fe9cfea3ec2e7ba690ae70156ca5dc41

                          SHA512

                          914012d3b59d6a2ce2a4108853d43b249dbebb46e63450923a06ab54bc479ca6d79bc4d1c0389f5cb7093ee37d2291cbe2d31a0bbee36b7b9e9906b7e08968ca

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          1KB

                          MD5

                          d9818d156a749256fcc3ebd17c1aeb30

                          SHA1

                          a6826936ad5023b210ac3cabf6fd57cb610bec3b

                          SHA256

                          cdc0b40b204339466273bc6f0a41558195188ccf8ba34912b8f0e756aacb0631

                          SHA512

                          31ca704084b0dce443560135b75c605a1e0a642f21439d65d192848e90107d5818c8ed2fbdb7731d9595bf47d70eacf0006ecf9299d8b4ed1a80f309e387bbef

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          356B

                          MD5

                          f47dd466aeb2237a42005021f420cf42

                          SHA1

                          018aea8bcffb7b639dc0e534667c5da9e80c5eea

                          SHA256

                          a1396c5756cf1a130bee72626a034b18acfad28edad5c9d773ec0cd4c54e22d4

                          SHA512

                          686ba6730a8949596a3eb272ecc4187cdb17c806f58b2948ae17ae20c1fca2e413f50b9c232109d7b802886c5729dc915a1cb3b310700f21ab006a5f4572b304

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          350B

                          MD5

                          aa77c8975379e6aa3cdfa0f55a6841ae

                          SHA1

                          ca4b4b0ffbf58894b7ad469bad765e4950a04511

                          SHA256

                          04145a291cfb6609cb4396acd3265cd1306b3dac301194c57c5e2fd4d6f14fe0

                          SHA512

                          47dd44076a8b948301b15acc9a8ebfba900af638c99226efeaebb0f484d0a9d4fb8d1468174e2ce4f0ab56644829557cd72d6d0274c46444a22591acb4987b32

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          356B

                          MD5

                          4af2ca7952f48ca650b06b389362fa8d

                          SHA1

                          8e96f169dab35ebefdb714623dcbae5760afe179

                          SHA256

                          42ee5c1a2b607936b5a2cae0f455ed0b1329529f2e74fc987f47a6f3afd757fc

                          SHA512

                          9b4b5e8ab07f4156f8fd3bec8eb503a70d198c0a216a444cd8ebde95905ba8d475c626af6e9428bc86e766b77bdea9a9b44b85d367fe1dba8c5a00a860c7c61a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          356B

                          MD5

                          043093f8704562e2843120a50de7a76d

                          SHA1

                          dd369672e7639264f4362af2a5d72c310c5aa03f

                          SHA256

                          162c3a2315496b066ff5f057db93078fa9f3a163b1dcee609f82867623caf72c

                          SHA512

                          3113207fa2d549f524a58ea35b93dfdc79a6f45ba6fd086f4c723394392915bfd767208a172ec9d8ab0891d19c3a29419c3d566e89f09aa2c406de4a640ea51b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          b72969c2f3e4eb896288fe53856a0e93

                          SHA1

                          9e60a4b65a991c06a763222163b990dc4ea4a94a

                          SHA256

                          fa7e87940e1c23c38a6127482403868684444ec5eaba2d8c6552a7aaa5b8d171

                          SHA512

                          3eb4a1874745c74134ae0f13b2f9c064846cf0ccc38442066d373b53c06828f51d0c0296e85cb5c297f60cc832ff8b31e63c4b7a3293f7ecda93c04e07e2c8e9

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          9bd2ce39767d2b9f02371780f6b62b4b

                          SHA1

                          f9d406a3734f22554ba0df6a5d4699bd6b2a75c0

                          SHA256

                          816d1604fd8ac2966c2a5fe45e48070ae128a1cceed70242becd3dd2491f2d43

                          SHA512

                          da2de4d2518e322f4f0b723735f9d31054454c67d47dafd8e68d0c8fcf243f044f3693dc99d71f87c9edebe1d57ea5b1f89c7e9b6e9cef0497c5930435870305

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          bb4b6b22ec41a87817e6c5311dd2416a

                          SHA1

                          5624317ddc182dbf140da8e971c7f2c9d5dedaa8

                          SHA256

                          79b93a2c03af90b25693e7e8324ab44326ac492e3697c47c7f08af9e15360777

                          SHA512

                          2e5eac9663271dd268274f043f52a82fdc6e94f45e171cd4170cc90b893e09175cd8640ea015851657dc0ff0a377649256aed1b4850140f486e5b453771d198a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          f3765e005de8460087634d25d571574c

                          SHA1

                          21c6d3f1863aadcb91305f2728ea38b0e0d74548

                          SHA256

                          c3f51400b23cebf91f6e7bf6ea3e1e0fb2affff77f21f126bcbab7a7abfbcfc8

                          SHA512

                          2b6c0710a38e8e177b37bf75e8ae079595a1a80756fc2bb0c5114b208888d83e4ec102a5ad49c712c24573da5999dd09fd0608c24be32705274d973d9a384aaa

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          7ce95824761b0176aa5ca4da5b3301b6

                          SHA1

                          00f408fcf8a78a944e342dd794cd83bd604854fa

                          SHA256

                          7031fa9e166b2d97b4e568a7e9a7450e9d41ddb0974a48212d207f9b765176bd

                          SHA512

                          64e4cdb737a5ac110d12aaafac7418ed13bb49c59f23e5615539fd57a00fdce2d06d03636a4b5f67c1e9de204f53d4c452af7333d0f7693e673e116f43f56749

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          cfd74ebc3885e91038e3ab4348047a7e

                          SHA1

                          a935c3b00834b00492ee889e555026270fb67c07

                          SHA256

                          6066a13bfcffbf0e08c2016aa5e2e9f69daec49670cf4e0592b3022976fd598d

                          SHA512

                          538c4da9b8c81ab3ef718bde81a219bf3b13cdd9758be787d77467e2ff540c869a8b473137939b9668ef1430ba7249d00cd352524fe5647529ab1530d1f3e23d

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          dd2714c92493b17dfc9b68c6174532ce

                          SHA1

                          aef05d85cbf9aaacaf52621489926ec0c59c217e

                          SHA256

                          5b4d4ccf86baaf9dba0fdc4ee0b6914a99a99e1381a8774f9d6ac7f90ce834aa

                          SHA512

                          410230ef26842d3827c7b9a8a1031040a64c8dc3d9a48cfcbe37230a508523a7ef34fdd61166965657eb068a1643627bdd203febaa559f6dcb2b25e8546fcbd1

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          99KB

                          MD5

                          d68aa12714ab839af46096b7c4022036

                          SHA1

                          5ed4f6dc2ccc649648361ed3ef83b68751c1adc7

                          SHA256

                          cf0663bbc90d8a8dcfb034149aff978f2d07829aa2c6660b6d38c7f90061cafa

                          SHA512

                          0b18b2f9169d16a8e679187478ab041bba5fdd9626be07d2a86d2de88f08c6392f2661284b1992f66ffb730a3ac19b3521d3604cbc52d52cd8ea9395e572d9fb

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          99KB

                          MD5

                          72a50afd09ceb0d32d0e63d4710645f0

                          SHA1

                          d9649f54e19372cea84cf0c121518da191705a2b

                          SHA256

                          09c94d1b6e751ed898984ba0288f14e94b9c0f047534b3dd9dce79ab463db2ab

                          SHA512

                          bc54f146cbea7fdbfe26b420ed70f146c21e43b74508378d94c58912bea8a905b141ab7db5752a538a28ef509da6efce951fdbcc8b85119f3356e0cfb47f5bc4