Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/12/2024, 17:20

General

  • Target

    https://www.paypal.com/selfhelp/home?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=93fa88eb-bcca-11ef-9ad6-4f869ca21d6d&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&unptid=93fa88eb-bcca-11ef-9ad6-4f869ca21d6d&calc=51784f0ee4b6e&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.295.0&tenant_name=&xt=145585%2C134645%2C150948%2C104038&link_ref=selfhelp_home

Malware Config

Signatures

  • Detected potential entity reuse from brand PAYPAL.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.paypal.com/selfhelp/home?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000238&utm_unptid=93fa88eb-bcca-11ef-9ad6-4f869ca21d6d&ppid=RT000238&cnac=US&rsta=en_US%28en-US%29&unptid=93fa88eb-bcca-11ef-9ad6-4f869ca21d6d&calc=51784f0ee4b6e&unp_tpcid=invoice-buyer-notification&page=main%3Aemail%3ART000238&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.295.0&tenant_name=&xt=145585%2C134645%2C150948%2C104038&link_ref=selfhelp_home
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffad82acc40,0x7ffad82acc4c,0x7ffad82acc58
      2⤵
        PID:524
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1936,i,8481610635346464815,10065040747563266750,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1932 /prefetch:2
        2⤵
          PID:2684
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1876,i,8481610635346464815,10065040747563266750,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2368 /prefetch:3
          2⤵
            PID:1344
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2136,i,8481610635346464815,10065040747563266750,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2576 /prefetch:8
            2⤵
              PID:4696
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,8481610635346464815,10065040747563266750,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3160 /prefetch:1
              2⤵
                PID:1356
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,8481610635346464815,10065040747563266750,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3332 /prefetch:1
                2⤵
                  PID:5000
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4852,i,8481610635346464815,10065040747563266750,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4868 /prefetch:8
                  2⤵
                    PID:1856
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4892,i,8481610635346464815,10065040747563266750,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4808 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:1384
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:2352
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:3712

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                      Filesize

                      649B

                      MD5

                      d7c3859de0cab3efce9cbc7238df425a

                      SHA1

                      705ad2018dea18f3e1c3098c7b832f0065abf2bb

                      SHA256

                      7fde5b07fb9fa1da459ffa25dc82d35850eaa5a63b37323bdb38db43e1481d61

                      SHA512

                      b418079b48c2949a2b7df131fd836f7fe618e613d295ee04cc43cd37a3cea28daec0b947f281687ab2b997102ce23649bb287cf2ab24a50abca41de10348037a

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      912B

                      MD5

                      4becb5ff0b6199ca59a172499235077b

                      SHA1

                      e238c264332e414a710f78571c442991d6dcab37

                      SHA256

                      c8fdefeabbf88d1fba63c89db4bb1a3fa2cc040d93f153751540090d4a9e896d

                      SHA512

                      9a89b2901c5d603f67f8e84db01d8cea3702b5375891279d21f16156fffbad7316cd3582f5f4f50439b5da7234ad2cd522f144fc06ddba5060532dbe915bfd13

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      1KB

                      MD5

                      9cf2f3279e1cf66e1ce459d76d58688c

                      SHA1

                      a1b4f7677e77e66056bfe6fa948e1109fb90cb67

                      SHA256

                      5fefe6f30ee18e1127b18634875d7f742ab9fded3880480645666cb456611120

                      SHA512

                      e30ca34d2dba8eb29bb625f81a620786785faf7a2d08b7f6f1040cad8a88235227b54bf363d34b051bcbc6ce3e4d94b6b04fa23c3ae85f0015b283a85167e13c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      851B

                      MD5

                      24e1bb47557bd69525c0510eb03d873a

                      SHA1

                      fecce7842305e2ac0686e00faf46cca8a2edc40a

                      SHA256

                      f3245b79bcc48ffd14ec31b0d3d9c53d9fd35caa54f391faa4478917bf234a6f

                      SHA512

                      042cae15a29b8dec40baa692fe72108251eaabd1b7df225b3c4391da40cfa3e94f66f5122517363f50a79dca23f8e6ea616d333a72cca79a119523cb30cd6541

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      f72c1876859e02003e9e8fe4ab047e9d

                      SHA1

                      5d0bf4afc03a3226626c443f9b6ab5a8bd5022c2

                      SHA256

                      55eb95cbb82acd1df95a5fbe3a2f3e315d5b9db78fa334184b9366c187fe95e5

                      SHA512

                      52c58407b68a557f42efd1ca9fb81b4259133afd0724a54d82caf3bf550f481a55a6c5ac9367a0ae2579eaebd59986d4a958fbeb5f1a0e4c010e24d16f88e052

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      084b9ab8cb8258528a32182bb9e18c78

                      SHA1

                      788ed9b01e36734c104a59a7eb0a0176e643f76f

                      SHA256

                      6138bec43abad454f484642fa321562a1934b9f58e79280e797bf3a4ab176130

                      SHA512

                      127f4256ecc2fd4c33a0d50a73b2029231e9701a9b9ac55543f98cc3d6f00e5e00c9b71c43f6fa16e3be8995deab39065bb493511957627c7d13cc7022a1e11c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      c0ea6be458ce9c5a37be9c6a9ad918c4

                      SHA1

                      13b27affcbe8a189f87e7960bc7d3af4d77e9a9c

                      SHA256

                      ba777cee41faa5c9580446a30a9e94b4cd7edc02c0b591c7e6ece608e5a67e2f

                      SHA512

                      2470c5b1471ba02e4d06e8f10d3ce3b3b72a5b53edddee49847f6df2e60ae843a2edccc41a6b23c917591424a609f99fdc7c08eadbda8828b8612e94925cf481

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      c556a32daf2d41bf5530228e81e660f1

                      SHA1

                      3e33b6db9d01f708ba3e2005ad1840cf6be5539c

                      SHA256

                      8e02d31890e342c070a2059b7b7d266479f8aa5db8a22192ab31cdb2f9c301b9

                      SHA512

                      262366d920533f3b2bf52b267bbe0b57e1cf3b0f34e79278ac2738fc1b4ff3e9061814123f0d9da9fea8ac084dc6bd524224278996e5d49e7f6b4f0cfa1ceac4

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      1241ae51820387264332191078b5059f

                      SHA1

                      9d625f27227ad009541d89ccb342163dd5a79746

                      SHA256

                      1e0b05cf05e8f14411983c4c31281af42374b38f41530147040ef3e5f3a00f7c

                      SHA512

                      2f781839307192f6831a59bc7808bb1bcc355894088d12806c49ee6f05abf12c0f20388e60a51e3ba4c685be05f6685f1d49559307fda71d7d976a04f1534cf8

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      50aca5898d515e8183a7cdf7f2cf9149

                      SHA1

                      e7f6e1a5b2e15bdcf47166eb600b3a1089a1a952

                      SHA256

                      4e63903f8c6c895f59bfc6d2877f48527f076a0c1efad46cdf83ec5a7042aa60

                      SHA512

                      c1677044a50c4775cab1d037c8809eee76efd7def774f0b6141652d35f33ffb5f4286c415327d090a54640bc259bea90f06e49942b12bcdfe47605c8e2e6712a

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      d823a5a3f9b70024007d9bf86c79f886

                      SHA1

                      c22f5e3aa9aec3f28aaaf5943505a54bf10f8325

                      SHA256

                      33c04f16b30ae0d73194cf2f5d761283d3d4d814ce967c2d60fb1d67118602aa

                      SHA512

                      420514afe27cb56e3abb48b9e44f14c5645c9dfb8fdc701d15a341ce1aca15703a942a6ac7a2fb2eecfd6521d0e2bb602f0672558af689a09e74b0b2be728bca

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      92e869350d4db1be656d2adb10363163

                      SHA1

                      55728bbc6ff53b70ba87a0570b20687515f64cf0

                      SHA256

                      4c021dc95157f570edf8778a3a25672fe6117f6c656d70cbb1bc217c88f5f25b

                      SHA512

                      7018615bc21cb48f3833d594ddc5c4f579149fcdb92500e628a85962359dbe68ce7301355e36406895094af85cb9e18c3219dcb146bdad65760f4a0531fc94b9

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      1744491d37dcbea1921560fe0f12c633

                      SHA1

                      cb8189c2bf707a366a93959ac31d21a4d9307538

                      SHA256

                      f68a912d7dc2cb5bca99dea6b8106f578a57f480671a09e7fc6ea507f3814ccd

                      SHA512

                      99c9121987bf20d4317b67d03e14131b027ee81f39e3fa57451d525ff7fc56f3fb56875aac2a2c765111f53dccf898a6836530f42fadc54176f1861db2eaf544