Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

14/10/2024, 20:34

241014-zcvfnsygrr 6

14/10/2024, 18:30

241014-w5sk1azcmh 6

14/10/2024, 15:58

241014-tewtmaxcjp 6

14/10/2024, 14:34

241014-rxwkgatfrn 6

14/10/2024, 14:26

241014-rr7esatejq 6

14/10/2024, 13:27

241014-qp5bzasajl 6

14/10/2024, 13:17

241014-qjty2sxbra 6

14/10/2024, 13:00

241014-p8z1xswfqd 6

14/10/2024, 12:16

241014-pfqa1svdna 6

14/10/2024, 12:11

241014-pck7wsvdjc 6

Analysis

  • max time kernel
    1762s
  • max time network
    1731s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    14/10/2024, 12:16

General

  • Target

    Uthnarak, Nercrotic master.json

  • Size

    56KB

  • MD5

    9e309898a7fcbd956e7abe34d640e839

  • SHA1

    2078318c5a6bae82c40a9c605433df578527debb

  • SHA256

    001142778ad86798294c311a2e5d870a0606fe39a4e5474ef7fe47f37e90a27f

  • SHA512

    085334f98013047b320bf253c0d291c543723b8bd85272e4474e8ffefef549bb3b9740233b4f4617d43c3a7017583d3021ff4dd4bf8b1fbd84471a1d6cd147bb

  • SSDEEP

    1536:lfjoYIGqY6og/IaNa94he47GK9qQHwHdqFPv9ot:loXnsgRNa94he47GK9vw94Pvat

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 32 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c "C:\Users\Admin\AppData\Local\Temp\Uthnarak, Nercrotic master.json"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2664
    • C:\Windows\system32\rundll32.exe
      "C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Local\Temp\Uthnarak, Nercrotic master.json
      2⤵
      • Modifies registry class
      PID:2992
  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2532
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7b19758,0x7fef7b19768,0x7fef7b19778
      2⤵
        PID:2544
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1176 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:2
        2⤵
          PID:3008
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1496 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:8
          2⤵
            PID:2472
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:8
            2⤵
              PID:1924
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2128 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:1
              2⤵
                PID:1624
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2136 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:1
                2⤵
                  PID:1636
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1288 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:2
                  2⤵
                    PID:1536
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1176 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:1
                    2⤵
                      PID:1704
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3492 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:8
                      2⤵
                        PID:1920
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3480 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:8
                        2⤵
                          PID:2508
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3628 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:8
                          2⤵
                            PID:2964
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3696 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:1
                            2⤵
                              PID:2832
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3464 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:1
                              2⤵
                                PID:2876
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2432 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:8
                                2⤵
                                  PID:2524
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2224 --field-trial-handle=1224,i,16137113580514450354,11637482273939156772,131072 /prefetch:8
                                  2⤵
                                    PID:1952
                                • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                  "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                  1⤵
                                    PID:2936

                                  Network

                                  MITRE ATT&CK Enterprise v15

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

                                    Filesize

                                    342B

                                    MD5

                                    2bef1bce2851dcd834ff1802d877a307

                                    SHA1

                                    6b5bbe5c720506fd13af0eb41dfb14ebecac1a8f

                                    SHA256

                                    c6dd6a332cd986b49e5147d86287a5b34aedd4840dedb9091bc2ecb87588f545

                                    SHA512

                                    2092f149673b365cec14e1a54fa5af8d87518b52a63ad51335707b49d5a64de552dd08fde60a7ab0e6b150c2a809a1789a2fc71c32f92f1de6d293b89b72d4ce

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\000006.dbtmp

                                    Filesize

                                    16B

                                    MD5

                                    aefd77f47fb84fae5ea194496b44c67a

                                    SHA1

                                    dcfbb6a5b8d05662c4858664f81693bb7f803b82

                                    SHA256

                                    4166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611

                                    SHA512

                                    b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

                                    Filesize

                                    264KB

                                    MD5

                                    f50f89a0a91564d0b8a211f8921aa7de

                                    SHA1

                                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                                    SHA256

                                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                    SHA512

                                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    97015c7b39f83bfceaf7e9433902dacd

                                    SHA1

                                    3589cc3277fb8968d4f1e67d370d2d6becf44d08

                                    SHA256

                                    0acc4d4c2f632621bbbe1cb2d30cb662303152764614e42f7546f813c5d5f044

                                    SHA512

                                    e26c25eb06e369665083152a37f663238f4b07356e38f0bc0eed032de50ce5914164d366952d738ef54a1057d0ec8c0f1d6a6678a3b102f676861a58c0b656e9

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                    Filesize

                                    3KB

                                    MD5

                                    ca85920bec1fd8c14e4bf14774e01d36

                                    SHA1

                                    29011e7dc09cfa32f1b3ac242479ddd2b59d621d

                                    SHA256

                                    318cd59fbdd6aebfb394eeb5ed7d161c7e5fd9d6396c1e94a06482ecdf027de8

                                    SHA512

                                    e22f1754b73abe78f8bd07a555165974e7191616baaf9d6c22ad7adc3689b2f5c51106bac97f954a1d2362281a22f168778924f1096c178f7471820c142fddca

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                    Filesize

                                    363B

                                    MD5

                                    f59bb891d9fe255859f9e8a9329e7f82

                                    SHA1

                                    965705337ed3c829667e262b9fe55c0d3d4b93ca

                                    SHA256

                                    8997bff93bca7d1aad9cc46157920d69dfaa00f53b8cd5e3274f228f155a8f7c

                                    SHA512

                                    80694861f0693defefcd0a47ec300be3b255282601166e2a83a180b7ccb0d517effe6bd8135b59b9de80a65ef27d0b49e504de9799e42d07574cf9ec3c77c87b

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    5KB

                                    MD5

                                    6d80b040786e2d65d42de393b836b62b

                                    SHA1

                                    1b663fc1404d93d245b5c917156281cf7f8480dc

                                    SHA256

                                    c64d79b6b57645b4db8c3e2da373407e3a2e2cada9592fddddc01785f3dd3fe8

                                    SHA512

                                    6a40645b259695b18d479285628bac60e602d3e58c7f8399145b37d88100d9612f5a43dc971b6471bf9a9037e249571907c488990dc5299c29bc03747229d510

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                    Filesize

                                    6KB

                                    MD5

                                    5e9ffd54bfe0b68a5b09f201f80978ce

                                    SHA1

                                    00e9fa3d2237b37cb26191205880de4d56268a33

                                    SHA256

                                    0d1cd63cf00a3db84cacc7c44df80f2db3982bfa2e157a9ccb8652015c83bbd9

                                    SHA512

                                    9c55f665316fbb0200fc5446424b8212f53e4b09cf42cbfa32086256d690f33ef1ce2a95526ba3e7a150dd7bb03ad96f65e34f2cecce4fcf2b1ce851f973aa4c

                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

                                    Filesize

                                    16B

                                    MD5

                                    18e723571b00fb1694a3bad6c78e4054

                                    SHA1

                                    afcc0ef32d46fe59e0483f9a3c891d3034d12f32

                                    SHA256

                                    8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

                                    SHA512

                                    43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

                                  • C:\Users\Admin\AppData\Local\Temp\Cab90BD.tmp

                                    Filesize

                                    70KB

                                    MD5

                                    49aebf8cbd62d92ac215b2923fb1b9f5

                                    SHA1

                                    1723be06719828dda65ad804298d0431f6aff976

                                    SHA256

                                    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

                                    SHA512

                                    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

                                  • C:\Users\Admin\AppData\Local\Temp\Tar911E.tmp

                                    Filesize

                                    181KB

                                    MD5

                                    4ea6026cf93ec6338144661bf1202cd1

                                    SHA1

                                    a1dec9044f750ad887935a01430bf49322fbdcb7

                                    SHA256

                                    8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

                                    SHA512

                                    6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b