Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    300s
  • max time network
    245s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/12/2024, 22:43

General

  • Target

    https://www.paypalobjects.com/digitalassets/c/system-triggered-email/n/layout/images/ppe/pp-logo_x2.png

Malware Config

Signatures

  • Detected potential entity reuse from brand PAYPAL.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.paypalobjects.com/digitalassets/c/system-triggered-email/n/layout/images/ppe/pp-logo_x2.png
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffaf3dbcc40,0x7ffaf3dbcc4c,0x7ffaf3dbcc58
      2⤵
        PID:1224
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,2174282182091981086,4526135720292182462,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1916 /prefetch:2
        2⤵
          PID:2544
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2164,i,2174282182091981086,4526135720292182462,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2176 /prefetch:3
          2⤵
            PID:4268
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,2174282182091981086,4526135720292182462,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2424 /prefetch:8
            2⤵
              PID:4840
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,2174282182091981086,4526135720292182462,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3168 /prefetch:1
              2⤵
                PID:4252
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,2174282182091981086,4526135720292182462,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:1
                2⤵
                  PID:4680
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4556,i,2174282182091981086,4526135720292182462,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4568 /prefetch:8
                  2⤵
                    PID:748
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=728,i,2174282182091981086,4526135720292182462,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4712 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:2960
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:2336
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:5036

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                      Filesize

                      649B

                      MD5

                      363c767afcb9c2ebf5633575f3682fa9

                      SHA1

                      d9b4a0fca3d89198074a2fa179617cc0f29444ae

                      SHA256

                      76f9ca51499ef3fc53478aac9001b498369eab9de28063f5033e40853a14d263

                      SHA512

                      9a739b826f6239ded088954090fb9cfa2ac38f69d0db4b78d9b09b81700399ce5872b78108a66997e35a3b998cc1c5d51cc425ca257cbfe1f311457f03cbdf21

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      1KB

                      MD5

                      3d4e98c0bc7c0b6a5e9c9f0a8e04e61c

                      SHA1

                      b93ac3f3326c94a54ed363f11548e56c60b7f1d2

                      SHA256

                      b3fa177bf8831eb49479e44afdd917d6016d432bbd01b7e3d3866b9094563325

                      SHA512

                      ef00f38ad1fec85e6fff188ea5b6f08274df94052ac1015bc80a0ee56dc5c9dbde9b5cf499bbd119083a67f4375efe3ffbe9d958830ded170ee1058ee085c437

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      523B

                      MD5

                      97fc69fcaceda5cb049025c91b7da090

                      SHA1

                      54cb9c67f9ecd3223ed8d079fefdeb261af43bd1

                      SHA256

                      2074e3e4507266270f79f0667f12f34045c475f0318397d18b16a49ccfcc7827

                      SHA512

                      145a2267a8f17bdaadf448951c3c7396847e9589b5996d2c3d75a83b5c4e80d060b97660e77db62fee69313cf2add9857bbe6e2aa4b91148cbc5b66e0d810110

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      4aaaa35a636594fef7a330caa92a5435

                      SHA1

                      aaf344f018c3b625f4e788e40cefe694bdbfd93a

                      SHA256

                      b7a37d8c766893be8af76e6835f44cf137753ed121ec39579f8e16e181b228f1

                      SHA512

                      e13e2b9762bc081be2595a6443e5d3528b0f50c0461c63767364636ab4778bc9668ec98797a967f12b18fb2e824fe302d3b8c5bc499df71360afc25150b1396f

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      0a2f79b938f465557831ece0261d5367

                      SHA1

                      1877320549fde4e559c7d8ef64d2f8bdb8bed458

                      SHA256

                      9c6c882330bbd28873fb093ee785d899cd54bdc9917c7664f1434600cab5c8dc

                      SHA512

                      9ea2f5d2aa972b221740bc8e9c68c6752ad0caa9ab2a2c06cbf08b71053a94b5f0c538fb028ffc804488c3291b379ca7251d4fd7661ef8aae62452948e1a877d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      502b776e1611a1ef653583305ba8f64e

                      SHA1

                      0bab013749882b767768d1ac713406f2291b3d81

                      SHA256

                      b985333c30e9df9b564617db4cffc559ddae7999a147a9568f4d7c9fe9030870

                      SHA512

                      39e58547086c6c1b4f7854ea6e3a2ac0554af83cadb29b53b775f004f5e8cb0025b36ce4cc8f560be5a0dd9ea01082d283c1cfa7fc818333614d412301f46a87

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      c5dbee8f4857c838349224d547887784

                      SHA1

                      95d3576e63dda9b052ad3de715ee26752e088c27

                      SHA256

                      fe5d99ef14d902f1e92614bde60e4ce3e238a0aeb2a76967b170a93b3f9420a1

                      SHA512

                      2f0cce37a397085c69b0d7707f645faf1732ec32aa541dac54e2aa91db524e83bc90778567a180897887a29da6f21d1fa2af93db6ae82ae55299c1b5b7694dad

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      4f6f1bc788af443f05598d720581acc7

                      SHA1

                      b43a64336d19e3e05b001b27ffa9104eb74a76a5

                      SHA256

                      fbe97c0cc65c8a36e2bb1923b0c635a9f0c6d57371e4b7a0e61b8321ec846b97

                      SHA512

                      70eebf9072973ab454c8d1b7bda3fb8ef47cb0e87c7e31223bd544b0138b36f0ed9a7fb2726c5674a22d7fda70e3c751125d5729e78308fed8b43fbe622d97cb

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      f341ce2cb205ac34b95899f6c149a669

                      SHA1

                      54b246a14a22112fd2a84a69e7140ac7dff6c820

                      SHA256

                      2f58f646419f148e95b7484eb5fef7cfdde6e8180aa251c21dbc78938dddd391

                      SHA512

                      dce2af99a909d421e2d34dddf6b15ef309978e859d86d6e6c5a8b174e231abc05c2794cd79c206465a137633838e38b67d2b4d402b911b6cb35cfdb297d85bd0

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      191971300d5db0da9662990d24837266

                      SHA1

                      06a4baabc11d5235e85f1843705ccbeccf0db20a

                      SHA256

                      bcdca20b83c1e12f98505314779ba2bec571c75172bbb3e4a495a261fb87cb52

                      SHA512

                      95f3bdda659cf878c9309dd0497f24509bbd6bfd7e2c6cde71e4a119459042560cbc9a7c8b9cadd64df9e6f3660afa0ebd7ac3f388951c6cbf18c796c9bbbfd3

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      2f580ee7a672d0f5a15f4e528a68fd0a

                      SHA1

                      c14f2f39761d39d83885429e5b5239d85fad468c

                      SHA256

                      fe287a3ad6d286f98b91de3791d884d9a5f4fbb85387a729584334e45a360c3f

                      SHA512

                      f9d7471e0679dbf2778b0433edee8d2e6025ffe30a50c6ae6ae9ffce6b1ffde619f7391fffd85cc77ef811cce730bbc81cb66ea6beb974a7198a251d9a9161ff

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      7f9cb88ce693c5bafeb929686d25fee1

                      SHA1

                      b9e52aea70b9980c69cafdd295db0d61a758260f

                      SHA256

                      0e7ee56abaf4d54a38d693fe8dc8a6dc7c4e8297bcae632b5535af3139aa88e0

                      SHA512

                      db0e0af2dccec58b501595294d2de4a9602d57f9b6856661a9898008c30f8fc10c80d60834616a10cc3a6ca29085c0375c94269f93c20f09ff13ba3d6b05fc58

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      8aad3ad81b6602b2f05ea695e39e6e25

                      SHA1

                      05b9329fe64e7249c601f60dc7e247fca6785b42

                      SHA256

                      ca9eca195de0edf7f67fb7eb1b03c67371364172741b5108a80e0cd943832a6c

                      SHA512

                      619381adc7422eee04747f15981b91072e4278955f6409953481e88b47306add562b3f9486be891f97add8df3b26f152a06d6beedefeb5efa199126606092dea

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      626298ae42827bb2917a5f1d2c276790

                      SHA1

                      baac37478cf7deae064c7ebff365b3040b0cadde

                      SHA256

                      104999e028ea763258b0daeb5744f57b96fa2c3552ef0aa77b52b84c29e315c6

                      SHA512

                      dacc774093346db82cfe6eaf619f3711a701e73af47ecc030eff64f93d274e632a9d1cdb40e61c4d291b570964ff227e5139090b429e773c58ce628e0b2c53f0

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      33c2f4570242a8659cf06f1280a3cb58

                      SHA1

                      f136035d898188617e167b3251e8f753984851fc

                      SHA256

                      a76d36e0dd3d6375678f88b0bb4945a7284148c6949846c4848332b16c4822e5

                      SHA512

                      a0c9e0509f3b09b75fa2275a8ed9d75932bdde8e78c3bbc72f125e19007661e00bc6864b38eadfbc66cb6946da6541fc187bf67dc233883f3b18408219e01e3b