Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/12/2024, 18:09

General

  • Target

    http://steamcommuntity.com/activation=Tvc2Fh8mw1

Score
7/10

Malware Config

Signatures

  • A potential corporate email address has been identified in the URL: [email protected]
  • A potential corporate email address has been identified in the URL: [email protected]
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://steamcommuntity.com/activation=Tvc2Fh8mw1
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3896
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaf219cc40,0x7ffaf219cc4c,0x7ffaf219cc58
      2⤵
        PID:3824
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1884,i,17870719096057108800,11881439200890993724,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1880 /prefetch:2
        2⤵
          PID:5032
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,17870719096057108800,11881439200890993724,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2172 /prefetch:3
          2⤵
            PID:220
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,17870719096057108800,11881439200890993724,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2432 /prefetch:8
            2⤵
              PID:4848
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3044,i,17870719096057108800,11881439200890993724,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3060 /prefetch:1
              2⤵
                PID:3628
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3048,i,17870719096057108800,11881439200890993724,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3264 /prefetch:1
                2⤵
                  PID:2372
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4508,i,17870719096057108800,11881439200890993724,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3872 /prefetch:1
                  2⤵
                    PID:3480
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3744,i,17870719096057108800,11881439200890993724,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4664 /prefetch:8
                    2⤵
                      PID:1168
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4880,i,17870719096057108800,11881439200890993724,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=984 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3556
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:5084
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:3232

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                        Filesize

                        649B

                        MD5

                        d42b734320c1d84b5d10926b92ed6ae0

                        SHA1

                        223f47f99d200ee2cab2680d791e013d44cdd392

                        SHA256

                        0d69d11b2c337b436a6843f5efa5ccc15ce2a573f378b4fa8749918ca50ee380

                        SHA512

                        21fac17f92801c0d8926c754df356109a9203782b99e41d885e4b718a06efe21a477e117a22a99be4996573fed96c02237d5e6a71636c4e211aa9acae19649b0

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        576B

                        MD5

                        c0ba2b4f61f9c039b11c061797ec2872

                        SHA1

                        4d8d6b9a61ecbd27237938726fd4578f92e3a150

                        SHA256

                        a973043cc425485ac18555ca3a48b4c9a727de987b3bc05c5c3537da1cf2445a

                        SHA512

                        54e7266929616ebc182bb4bee24305742fd46c377d803311733e780866cb5292725db3d6a2a4d92481ceb7a30196748694deea7d03cf3a99c0933faa8d3e088f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        480B

                        MD5

                        3c2338d39c2206ed9bdfee76fcdba543

                        SHA1

                        6d43a28318a881114576dd0a833fc9388fc42967

                        SHA256

                        7c62e1e777b85980e1a1a5fe0ede41b2120bc5f0208ab1ae828a4ad19f89b563

                        SHA512

                        10210ca94d0dc1747be65dd52f06a1d8d5be9e688f335508f1192e2b34981cdebd2f26469fba04bd927b4e565df6f71da51a33f78ac54fdafad84ecfd37e2abf

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        7779ef2a21967c41945ad3727a7a55c3

                        SHA1

                        7509a2f90d5663d7b9d4e00b49c3bbf3cb98195b

                        SHA256

                        80d5402b3d43e58f811bf2ae23504fe0a5d5eb9e7092e651ea364b2ee1c392b3

                        SHA512

                        9d40cdefe84b93783168f309729313e7bb2e139647a3d9b29b194f80566c2550b0f5a04800de729823d9d1a9f359b19743432e1c1dc4aa0105633282bc61f8a8

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        3KB

                        MD5

                        c44756c77f31a4f3c57dee52d1975d23

                        SHA1

                        243aa1b7972767a5cb53f9b373d4ed02571baa8f

                        SHA256

                        330091bc9caaaa5c6edb7de5f746e0e0e27f92135af5d77ad3b915e03510e2f3

                        SHA512

                        9053212b83148b52b90d6ccb5d35297ad9cb7995391b511b28b6456786021c34a1772c87480473927ac84d799743fcf26b048c17f4ca4d65bb85f521ad8a46ed

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        083e46c1cfa7455d2e0ea0fbba6d9e83

                        SHA1

                        5413443e2c288814358e351159d6f8dabeefeb67

                        SHA256

                        8f69b23aa1aae83c868ecca9ae0fbcb358667f6c8f44aa6e98888ef88d04de01

                        SHA512

                        ace06e044d83b529557ee6bfa13bfc6421a8e2bb5ab53e5235acc97f4209634e46743f49ff26fbdeeaa2fcb4cfb9a05eb540cdc31ee7f99141374417cb52773b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        1KB

                        MD5

                        4a0be3991b432bffccaefe98dec63282

                        SHA1

                        a5ae8d974d150809be2b5cb61accbee7c5bae001

                        SHA256

                        48ce719394c840f501eb26f60a57fdc2dd689a8e1a6488810df0a9d3c1e2e9e1

                        SHA512

                        e5063129cdeb1f85a849530c50791abd0682ace19089619b133771584a7df58aad2791ce461f5d3d156c42ec5e8c602d021cd23de3e8762dfec97aafd259c31b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        0d4889cdda525505baf8400c207ebcd1

                        SHA1

                        05d01b71b7abf4c13685849165e74db4093eec85

                        SHA256

                        0757dac00560af4454a2dc5aa14d5f03862531a34edfcbb1d715c77d341da685

                        SHA512

                        c2eb5764aa2d8e477d77430219159abe6b3485b94849734c8f46e585ca155bf44cf4a008849d534d90966fdd88bb45d336fde9609e731e3b1c4183da75f2cc6e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        6f9a84f773b17f054023daf359a631c0

                        SHA1

                        03c1ae88e0ffb0b84617a8920192dcb296022c54

                        SHA256

                        25ede4faf1a223813a99390c7739365d696aac25822e4fcbf564b21603c60789

                        SHA512

                        9510daa47de6249b707e550169a2c441acf3f44b6d58aa40bbe081413d40f1dbb05a0d2968626cd9b2b9e279e5b919931ec8b5d1049f4815a73ceb4209e44894

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        55ea68d7956cab0c39cff7ac4ea82254

                        SHA1

                        af9d5c15ea9f98411b7432b50a93cb53c5998714

                        SHA256

                        29d4830c25407d36fa4250868ba4e66aab717ff4a9e77a18ed151da951c14c4c

                        SHA512

                        52bd464ab02d5f6d0478373250a0528d7ff363c86a93a1e9792ba2464b3a99f4ba49ad41902ac03d3b4b7018a5e5e02410c16acc8dfd03c943ec99f311f8346c

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        7aa681054ee1d8eb6c6296d1733c24c8

                        SHA1

                        e78882d4eda27c688f233bae461003835ca8da7d

                        SHA256

                        db7c63c3cc8aa95a44570809f95917844d78c176f250baf7a3a4370947adda1b

                        SHA512

                        e082ba5509908b9cafbac9a7e5f3eedcd8d9aefb1fad0aff672a3ed3829135a35d33663a31202dd7e39c120e252f6ae4e0c2987cc6691d22fd2f41dd3e939ba0

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        c283bcbc028f3b0843464dc77b2fcc7b

                        SHA1

                        a1ca5a8ddeec3608c04c27ad24375829d538269a

                        SHA256

                        16271d4a0113a62f95632a62d4e2c74fc9865fcdde40d6a8caac25e4a2bdc40b

                        SHA512

                        4b3279f1231370fdb719e455b2eed89e73d552d92e4c927c29490fbc2140f2beb9092e601dc84f67d4ad225007acf0f9316bd326c09ccf53d3b88295dfcb79b2

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        0feea7522f6d66a636ca837fa9b7d3b6

                        SHA1

                        465fb7b369aede6c4e09316c1d74d9a91a61eb16

                        SHA256

                        82fb10830c20036832751c637a8f7ba0d04d0f677c2f1c3466bcfe807ebfb797

                        SHA512

                        c4fd036b2a00da6049cb6094e42fec745985241ced22b2075340b6613d807161f7c148adbbd0f21fd97ccec4236218354ef62396102cb36128af5d499a6ed823

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        731b88b09408664805e729e47aa7eed3

                        SHA1

                        e1e7dcb789feb7a97a7700515c115e34ef5e3269

                        SHA256

                        91eb56830da87caf763d936506915170011fa1b35e7700d9bc15cb6f1763b406

                        SHA512

                        766c6ffd9c05a47f232869d85258bf53c4de5ae76f16d70fc9af65973e1a8005fb149b0fe3e536e7db2ccad58ccfc1c28bd9ea8cdd9136d21bc2c8228dcfbe46

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        116KB

                        MD5

                        911da972f80d5d546739d7304e998b1e

                        SHA1

                        eeef77af4ae36ed1c9925701efb11a8e339d5913

                        SHA256

                        a05f7fa5f545b26d282a62040e44728602263241178658be6685fd79b70e19a1

                        SHA512

                        f7430bd9fab6a15b8ca9cadfc4b4c39e70f8917a8c8e39ea05f40fb9a3b8d5e0d45e119d75f95be714d3a0488051f1ef6d74c12ee3f9c26c3479be2946c17bd3

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        116KB

                        MD5

                        4a5729fcac28a3c8268dc3d537ff828c

                        SHA1

                        bafdf15f4e3f890081eb48d8655281910f3c6cf1

                        SHA256

                        7450dc33668cd7913652aa08b53313d2aa5ea7ac24c7dcc63a772555c334e977

                        SHA512

                        a8fde4ef8fa2d23877040560985509eaa89ab05fa5ac7d90861359168efbaee8ca61f34a24f8accee490b49270e84099c2433cd01843f7bde5898d18ebdc38f3