Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2024, 04:45

General

  • Target

    https://autooincomestatement.de/EEFT

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://autooincomestatement.de/EEFT
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4996
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad178cc40,0x7ffad178cc4c,0x7ffad178cc58
      2⤵
        PID:4072
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1908,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1904 /prefetch:2
        2⤵
          PID:728
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2144,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2164 /prefetch:3
          2⤵
            PID:1440
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2216,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2484 /prefetch:8
            2⤵
              PID:4960
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:1
              2⤵
                PID:4828
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3276 /prefetch:1
                2⤵
                  PID:3056
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4584,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4600 /prefetch:8
                  2⤵
                    PID:4164
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=5048,i,7956821497111196016,7165340987696066058,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5036 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1804
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:4444
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:4796

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                      Filesize

                      649B

                      MD5

                      0baa3a9e8a881854df872a74cbec8db8

                      SHA1

                      11acc4a0b43e93b5db9a264065684cb8df3e24bb

                      SHA256

                      a495e250f960568b0b98993b1a3d6878239470d7e4cf59d4b97b636b4b4f47cd

                      SHA512

                      bdf95376065d1c9edef702c08863343582c87796c733749b77ea0ed5aaaf21b7b7fcec5f2aa6643a63a6b63180e30902767ae4512a97b75422809b7c54444a65

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      120B

                      MD5

                      e502fbb1cf75a1ffad255cca1b6259eb

                      SHA1

                      bbdfb75bd1da319fc375461d3ce7843e5e5711ab

                      SHA256

                      5b7061ac485a516541212665da3682c17831d4175da23a74041ace614815f36b

                      SHA512

                      e0669223cdcd6ff263709c9bde2f8457a23d4bcb6a450d86aa940f0a3b71672713c1ef10081fbb44d4dd21397349f554b1bd5645194d4b4f076b53c230877b33

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      2KB

                      MD5

                      6c54df32c69d29a31ee867ce4e6d25a7

                      SHA1

                      30cfac5df9176d8aca86421feede421365798ade

                      SHA256

                      b58072ab47a0dca706d766e8c2d8b432a1fdca0bad6259a614354d8b21a6cedf

                      SHA512

                      49df0f33f73edcf6c9105dc02a99277a21ffa6ba1bb96b3a42de6bfc4cf0024e1b8e3de91b60040b2da5d5b8576916d93196ded3b74e788dca7a946fa242a01a

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      b9bf796a9faafc4d57c3835cae700b53

                      SHA1

                      6ef6a484a1f16e3ead54d35604b5d042f81b7e95

                      SHA256

                      a84f3d81ecd7b4d6ceb7b6da7ea1c61f23e5dd12955e9eec3ac9a4c040374b34

                      SHA512

                      f3012a8a299e335c558711473a0ea892277a9a963e1e72a96c7f034c0650329a09cca514436141f74f27467a4acf82d83d0a2017d596fcf69169a79e4610e11c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      f90d544cbd53c52522f7c96e7e99dfd6

                      SHA1

                      309e3e8d1f1f653ad35cea3fac6796a9bbe7e386

                      SHA256

                      6b0784d4373f47f7bdb9a7786d45df8acd43e8b0e9b65b97a9b6cd0cf256270a

                      SHA512

                      c030a8ccf997b6b8619ff4f98baff5ddd6b533a87f87a6cea448c3fef7acd7f0945456f70ecf4608e22e98ac0b8a72e6213d21e972ff9721cf1763c0a8157c69

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      327dd8497b2e2462b383897c9eaf4c23

                      SHA1

                      cb234a55d35038293ca5ea63213620bae2fb5859

                      SHA256

                      a63f754ec3fa1365be0d7727f04564d690ae7fd5f22a46e93a761edcf3cf3a3e

                      SHA512

                      e58443f18d503cb518ebac442bc3e5c508b2c659d9fbb829b6a4deabc78f552d3a62ed884a98db2213f023356747c173f810666742614926e038cd869a72248f

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      2eaeabf48192800024de3cf0361a2b4a

                      SHA1

                      4d763967342d3ef0d8c7ac4fab27fd49193bcdb8

                      SHA256

                      e7f9a2be3f5288ec75447d44803471f540496bcfe57b699dca26392b09795324

                      SHA512

                      8c489e6cfaf391fe8f305720a3dee269b8b0ef7e3bff07d8c792237d44bbcc96370b9b137a4cd15820cc40909d454d3e7d2c6bdde293e832960c1bf6ef3c8761

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      8087d6ee36385a932673967aa6ec30a8

                      SHA1

                      b0c3a21f499ad36e0838472a789af27b7c94ed1f

                      SHA256

                      6572632ba4e3f52626ebe910ac2c1b30f31c02a09e61a14ed09978a17779348c

                      SHA512

                      4f2c9a2d982a66cea4de6f3e994b630e5eadd4ee18ee509249db73c0ec2d4cb251edd6cc30526b3a817c181a7c34b29a655fded1e8f4e189f2038b26a8bd12d0

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      e9f27596183fe93313ca4ed07c4a46e0

                      SHA1

                      cb3bc9df6fdad4440841ba92867563c548faeec9

                      SHA256

                      77d74a6e6eb831402794860459a79340c8bb94d864ea0a58e3e202baf9057033

                      SHA512

                      69f76f2d1600d9ea259d00119852ecb32e9b17d60ac12f0ac478d63ae044976120b1bad260515ab7d3268fb3bd616558de1ecf73238d842140270cbbb0fd9799

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      7afabc30644fb8b8480c751688a89c6a

                      SHA1

                      02cde2cea6eb59f23431c65d9c393ffeadef3132

                      SHA256

                      5979d8a48e0ee940c0008e617789fb1ecf7d9c76fc3789ac306750400df92d97

                      SHA512

                      de28620b59505e559c2bb865289f3a97a4db6a2b30dc7a05b01ff9d4a17f9408f8a5f3ea4b7f1e3167b49caefdd172cdf1b46d48360372f82b0352559a09a0c2

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      a9a70d1da9290fb4980bcd40b72e76b0

                      SHA1

                      3cddff4d22543c810906d2dc509f5214ee844fa5

                      SHA256

                      2f230f09e6e2ac75b7c69489b11da393fd5a91cafee24241a80789dc0747d07e

                      SHA512

                      29394666915eed1fd56370a8b725daedb2c059eb95910947856c20d7bbb0205e5acbabf8e82fe2f1fb074fd2800fca0fbc0b55cb1df557d06ca20db38f650879

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      a7a754d40474cdfb47058b425d36c495

                      SHA1

                      2a71391452a4fe245d6fd320a63fe284f2086ffc

                      SHA256

                      41ed396993dddb92f2dd1c1f24b4d2e71ae4dec20463b46b08990972546cc206

                      SHA512

                      ad33d8edcdd866378f6457dc9bcc325e9b5324b54a70b3cdb0cec5b62b714753b49bfd9072b34786b13b98570bce33d3dd62451e2ef8165790074612e1f1fe9c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      5be2f0581fa379acb081003c326f6ae2

                      SHA1

                      4c5ad30844e68e2dd5ca49b451ea406cb218f8da

                      SHA256

                      0bc8943d1a2ce7d1e25a863beaab413da899c98c87201e0567705dc60d4b98a4

                      SHA512

                      1bc6bee43f22b9d14671ec6ae7023994728e8416771a82fa730daba0fd22c1c195a2d4369479a70ad041420516e978a35b8b32813b4fe7468fcfea4163b7bc27