Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    299s
  • max time network
    300s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/12/2024, 21:19

General

  • Target

    https://www.paypal.com/us/smarthelp/article/why-am-i-receiving-emails-from-paypal-when-i-dont-have-an-account-faq4172?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000298&utm_unptid=9176306c-c47e-11ef-a782-b51c7f41a1ba&ppid=RT000298&cnac=US&rsta=en_US%28en-US%29&unptid=9176306c-c47e-11ef-a782-b51c7f41a1ba&calc=f320300dcbf5a&unp_tpcid=email-standard-transaction-unilateral&page=main%3Aemail%3ART000298&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.296.0&tenant_name=&xt=145585%2C150948%2C104038&link_ref=article_why-am-i-receiving-emails-from-paypal-when-i-dont-have-an-account-faq4172

Malware Config

Signatures

  • Detected potential entity reuse from brand PAYPAL.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.paypal.com/us/smarthelp/article/why-am-i-receiving-emails-from-paypal-when-i-dont-have-an-account-faq4172?v=1&utm_source=unp&utm_medium=email&utm_campaign=RT000298&utm_unptid=9176306c-c47e-11ef-a782-b51c7f41a1ba&ppid=RT000298&cnac=US&rsta=en_US%28en-US%29&unptid=9176306c-c47e-11ef-a782-b51c7f41a1ba&calc=f320300dcbf5a&unp_tpcid=email-standard-transaction-unilateral&page=main%3Aemail%3ART000298&pgrp=main%3Aemail&e=cl&mchn=em&s=ci&mail=sys&appVersion=1.296.0&tenant_name=&xt=145585%2C150948%2C104038&link_ref=article_why-am-i-receiving-emails-from-paypal-when-i-dont-have-an-account-faq4172
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1764
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffecc5ccc40,0x7ffecc5ccc4c,0x7ffecc5ccc58
      2⤵
        PID:3948
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1828,i,7655845478575362243,4721073354687386471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1724 /prefetch:2
        2⤵
          PID:4744
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2044,i,7655845478575362243,4721073354687386471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2188 /prefetch:3
          2⤵
            PID:4664
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,7655845478575362243,4721073354687386471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2568 /prefetch:8
            2⤵
              PID:2064
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3096,i,7655845478575362243,4721073354687386471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3132 /prefetch:1
              2⤵
                PID:4448
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3104,i,7655845478575362243,4721073354687386471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3304 /prefetch:1
                2⤵
                  PID:4004
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3676,i,7655845478575362243,4721073354687386471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4632 /prefetch:8
                  2⤵
                    PID:4700
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4936,i,7655845478575362243,4721073354687386471,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4648 /prefetch:8
                    2⤵
                    • Suspicious behavior: EnumeratesProcesses
                    PID:324
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:1724
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:1532

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                      Filesize

                      649B

                      MD5

                      728df4e085fa6a31f2e87a9a3f60c3a3

                      SHA1

                      a6cdf5708a1daae58649106bbdb060e3162a66b9

                      SHA256

                      61a8f1bcbb99f6a777aca0c2f7b1c524fa4207bd014c899ba50db591295b6adb

                      SHA512

                      533cf7bdc8a4cb39d29280adf77b8dbb4697633254bac4aa55a79edef429fc76140ed2cfedfbdaca8746382f48ce2c1a003dbe743e06103028824835eaa0511d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000013

                      Filesize

                      1024KB

                      MD5

                      971e3aecffd96449cdfec98ac624f2d2

                      SHA1

                      a9297615146eaeb128885ead7f4eada94f0fd428

                      SHA256

                      f3d58878f721e6c0ac0e1cdd9935713a70eed6c26cb6bf0ac47e731a7078612c

                      SHA512

                      d01e06b0aac65d7a4a0a8a956ee692d998b0dc3980985dc635743f0d74817c1d59240938ec708508295e14593cbf521cc071df8134afe58cea9da1519009d393

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\temp-index

                      Filesize

                      840B

                      MD5

                      e65abef92b195103a13de8f0ace78267

                      SHA1

                      fe904f9f647cbd96b0edd8b455a793ee677f027f

                      SHA256

                      397480dfd0917718f7f46a8039fdd5cef99a1e41b57d0399aa4325ec05df7735

                      SHA512

                      a138f6cec817512745c5ebf0cf8727aacfd72b15614295a6d49bfcfc96c80748b0e49b6f82e7656cc950b24298aab3e08c8c48fd051b11f6a46e6a79c9b3da24

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      2KB

                      MD5

                      a8fdab80bf62f1745f7accdea9506459

                      SHA1

                      ef5c254e778a750e140062ea2a93fa5ed6b4dff8

                      SHA256

                      352fe17ddb955ce23f2c5328b900c0b83afc9aa3a21aba618a4872757ec732bd

                      SHA512

                      5c79236ccb9c115240bb41f4fbca40feba8c44e83191e180c8f954a8db80dab5a60a83e32556143ef408f821611ed3da3900913f1853c56eb630eb24f63e7478

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      858B

                      MD5

                      267de6b60fe0dddb25b2e56e7711620f

                      SHA1

                      1323b7713ae0500a3d189729e540434d2d5a9b1c

                      SHA256

                      701b9b0e7837ec7bcfbe738361ed2119b2f28c36515589a059e17ed811d6a5c0

                      SHA512

                      1388ddbfd90105ed0ca2baa78d44d06935a49e4f1199ff156a3d78a55b4cd6f178f8f40ef62965e6ec3b59b17d29e3df59cdd6fd507af4a7cac07af8ea4d57a6

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      18e4750a14ad6ecf7c18ee9b17becf43

                      SHA1

                      518a643d3bdaa8b3e8ae64fe47f4276a0cbdc3ab

                      SHA256

                      248c11d9a1d3491358a7a11a4e2454c8ea7d9cd39868454cb3b7c3f5a6dbd0d7

                      SHA512

                      4b0099e11ef40c1b5eeac2420931804dbf2bb2d3a7208d5e530ccd6fd24be86f973d51948f147ed468d6b2f7a7b972674111af8ebf901e63c006ac22c0d85df2

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      12d2ec8c6bc151efa9012d3299b25cc4

                      SHA1

                      4788ba1ddc2384290aa50a99ff6980a3d63ae8c2

                      SHA256

                      1ea19a622025c94b5384a3f76eb37dd6d0e433469483455f2d933655b4970980

                      SHA512

                      ee61aa1b8812ed6552fe974274926743941dd1011bfd561491669fda48f39bdd4b74730c3f9a2779e14f8e8fbab7c821c245e9285951901e8fe45b14d4201fdf

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      281842d213709af33615e35d1c2fec97

                      SHA1

                      1b56843515b1911a8a1ebddc97423f06caa19718

                      SHA256

                      1eb24c898df497e8817d1e2b6b48b601e016355407bd1c5503d5f7e5a413ca01

                      SHA512

                      dba22275830a06114bee3b61885cff849383386ec84175e86dbcf608efbe32a116aaa32407ce0f9a14365ae829de4c0dbcc8e738f4361ac6a1983482090977fb

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      4b89bf6648035521a7bec766bf7abeff

                      SHA1

                      dab46e0bc3fe32c7c5f97775cb9f0ff22186a4e0

                      SHA256

                      f7f43099d1995c6a370036a0185d047e5b59b8938cdc29ee73976e624d6fa46e

                      SHA512

                      70b56fd956d9d9c276e92ff16eb42ce479eb6e772e4673232a9a6dd1a5b17e2beb66afa3c1b399816af707976f033099eef6600a48f34a5172b6045c858f01e3

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      bc62e70ac28a4a673adcd4b4ccc7872e

                      SHA1

                      353a517383add50ca0d30b189c2c7d6ddec39990

                      SHA256

                      f5a148621b203af98a1392913578dddbf295d4a87bbf171c7531b171c8306378

                      SHA512

                      a23d5b385c094712a11640ca74be4b44d63944e36a207c4be074bf50111a47528117d11333fd5322cb9aef4bbcba9d530d0810da06a1dde68a7daab4cffce030

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      bc25670b1a06aacf19a215a5be1cd83d

                      SHA1

                      764357fef189712736e2156d09b9f05cd590fe95

                      SHA256

                      867bb03a896d054120eff70ab6980d816d02413220d4c22a21adbc10d6e0a1ce

                      SHA512

                      19d5b7509f27729c29865808d93237a6fa07b36105ca7626501db8ee995177eb05bef4b6c63e6bbe8cf5fe54cc5414dba2ae32a5e20a3283ba7ca21706bb9f2d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      524e47c97c32aba861b83e7188eb7819

                      SHA1

                      ac5694fca3f3211ce588bcea7188d98505860efa

                      SHA256

                      9837507835637a2cc50624e61c57e2dfec3807cca390c53cda542cd84dfcdce2

                      SHA512

                      30955f64da3eb7eed54af37afad3e4342a5f20e143e8bf8c8b864b66e70b884345e73397099a6d645e2266461769ff7019d065570f8c5791738101d783eaaefe

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      5da2e7aeec744c0a7e1b8711f304a78e

                      SHA1

                      8ad2e86e877dfddf96e87553e6888c32b604d8c3

                      SHA256

                      e78821beb60d60213a5d0fd0b3bb8951cb818f0b88881636579abd47842dddd4

                      SHA512

                      2f94ee893ac55f7cda6a1d48c358b7ccbc58e3b06ea1b4d72f74dbaf4603da6d71dab2df0483a1c11c3dc1eb2416c4b189337d985276747ce8c7515a10a8684b

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      a14ed835f4441b1b69485409bcaf5383

                      SHA1

                      3c8cbedd38a8b82a11368ca121e25d758070b621

                      SHA256

                      9dc3c9230385179ba3750a190d088c0a6d3ce61c4cf67d776b765260b4e43987

                      SHA512

                      187038febd88f83dad476b68a547357f13b9cf7496c9a694f8f5514e6821e1970b596efc2111030a9d7a8437ac92e966868972403ab243516192dd2b97716868

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      f15d223a9bbd706e01b99e5f7f486bb9

                      SHA1

                      dfa0dc8428bd589bce8ce857f5b362daafcd5985

                      SHA256

                      58985264e03b36b0b30c546eae7612389431b0f3949c4317f4c32ffd911294b7

                      SHA512

                      e38a8ecbeee27a2b7ea4f2fb667e50d144defa26d205b02287e8138601f844a953cbfa726cc12296e7f1af042734441d50b57dedc2a280b94bc7c4a784c6d7aa

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      88d556377f49b193e836be382577d09c

                      SHA1

                      b276ddaf78dac5686762a844d2ae28f17d75131a

                      SHA256

                      8cf1fb7f0b0023422e4eda5f41896e573218a5ed2df164eb9f142e0e0faa9484

                      SHA512

                      7e72527f69f5798e49035aed3139038cf5552ce96e55daacdff1ffe7782e6d09c3104d9c7dcf2e8f432d0ec8e3a9b15ea6396f4a179844faa8d8643c7f7a34ab

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      03abd9eec144dedafb6eb171e207174f

                      SHA1

                      cc6dc632ad5cd37e904fc97cbf1ba25e514302b9

                      SHA256

                      350db31e02fe44eaa92c7b5efa8bf3c313ce3052e48b575b282a9cf43ab4b7d2

                      SHA512

                      1a651d2971ff33f5c73a4599dfe1a6045feb83a5ee518b97cb1e77259ea27b19f1929fe836f85ff1282dab2de15dda8f96f120674f1dca63ebfbd681af27155c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      1172446113ab7ac4dec4bd2739383411

                      SHA1

                      ae1ee2ea40b6ffa7792b9a2268ed2eb2f28d1776

                      SHA256

                      0e918e78e4e83f5818ead1c0c74aebd4826c492f9fa0bec81d5e570a9a582792

                      SHA512

                      03fd032877be790410da574b742fd30f5e2dd95a4162a1aea14024fc1bb61de9186170e9fc3b04f194702a45b1c2686cd56af4bc71c30fa42b782181e061619f

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      2934d25cdc8aa749de268256445d3f1f

                      SHA1

                      e4522dee15faf9a98e415d0c4841524ee7e7bf3d

                      SHA256

                      958ba4bdefda3f9aafebc351b95c67949a728a2394b75a4083807d3987beb421

                      SHA512

                      c5bec70cbf995e093a03ec966ae78539d21967e7de26098ee6d44139adcf79145ad73834f3c89dad14df1229802cdf092ab15421022013ce585c87c3a0595b53

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      a5659ecb3ee411bebe3d24054a0ba348

                      SHA1

                      4615d4095dcf731abb000076f4a8c093da4ce69e

                      SHA256

                      8c1a7d39a4807888b3d46683109b3d01ee111d4e6fe546b73e28734a83c2007a

                      SHA512

                      459b0248a3bde73457c74cbca93c9aea0649053931b7a0ef2a6555849a14a3cbb57b380d8665b2bdc9806e6801930c9aad88ff81698469250a485b22ad27e38a