Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

13/01/2025, 18:30

250113-w5gthaspcv 7

13/01/2025, 18:21

250113-wzkm7ssmcw 7

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13/01/2025, 18:21

General

  • Target

    https://linkedin.com @gndbg.com/logon/index.xml#?email=cm9kcmlnby56YWxlc2tpQHZvbHZvLmNvbQ==

Malware Config

Signatures

  • A potential corporate email address has been identified in the URL: [email protected]
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Detected potential entity reuse from brand MICROSOFT.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://linkedin.com @gndbg.com/logon/index.xml#?email=cm9kcmlnby56YWxlc2tpQHZvbHZvLmNvbQ==
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2152
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff94ef8cc40,0x7ff94ef8cc4c,0x7ff94ef8cc58
      2⤵
        PID:4284
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1736,i,12887134085340958222,4689031411978843858,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1732 /prefetch:2
        2⤵
          PID:2524
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2124,i,12887134085340958222,4689031411978843858,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2184 /prefetch:3
          2⤵
            PID:4576
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,12887134085340958222,4689031411978843858,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2428 /prefetch:8
            2⤵
              PID:3300
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,12887134085340958222,4689031411978843858,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3128 /prefetch:1
              2⤵
                PID:4704
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3132,i,12887134085340958222,4689031411978843858,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3160 /prefetch:1
                2⤵
                  PID:4732
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4508,i,12887134085340958222,4689031411978843858,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4504 /prefetch:1
                  2⤵
                    PID:780
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=5080,i,12887134085340958222,4689031411978843858,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5088 /prefetch:8
                    2⤵
                      PID:5068
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=208,i,12887134085340958222,4689031411978843858,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5216 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:5112
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:3864
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:3692

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                        Filesize

                        649B

                        MD5

                        c565659f61f66c2427339a9738218ce6

                        SHA1

                        7c6ed755b4f945da59de891e6b839786583e7885

                        SHA256

                        96097e3696a83b24a9201f9eaa97527d1f0d9225a988c7b9dad58f9970636047

                        SHA512

                        1435e778cbb98c113a5eb154c2f3ff3f367b9727b62d97a164cc2811a7ac1a2bd5e5497d4aee4e452a27752e60a5fd7ac4d2c70d18f244864ec10d72af33c023

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        168B

                        MD5

                        7653dd93dd6979a8b796ddd1612cb1f9

                        SHA1

                        038d1d9bfd6ea5b339c08aa21968797d0205411c

                        SHA256

                        2cd37624cf3af597a68f56e62fe79e7c09cbc7c8e727349c3fb81d70be399f7d

                        SHA512

                        25c4a6caeff566d8e7958b512be97da376b619c41b0ac7b03626033e18b77f852153be1974e0e96d7ca9b9d5eef47bcee82d87c930fce09850a3d1ea5934fc9f

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        d75a03b0fbfd42d4e39691b4c43d84f7

                        SHA1

                        aa49b044121cb0fd6e9dd33f8c6657e0dc1aeac5

                        SHA256

                        0dc3fe3b7f49a56a004da5ff71d6cb32b9b07133ad290ba3ca2f39a390f59ea4

                        SHA512

                        d1e7c38a69f5ad1701e7fd9f6070e1d660602aebfd36dde1de91e9b49bd63d2f7e6a384ee3f22e190192d5ace467027cc117228ba15bd34bb56ed93e9824f201

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        f0f6bb9e1e2d50d82ce7a9f878d7a2ab

                        SHA1

                        5589c1968e4c366394d0ce5da5f12b9558b9bde3

                        SHA256

                        90a19f92fcb07a5431cef775d5f60749f81fbcad68efa7404da77f4eb9ea1547

                        SHA512

                        e1f99587b4f3027fabf303f12c2822ba0348b7a94d1d63deba17cbd63a44fd04ddf41bcb2ce61fa4b267555371fc512a8c71e84f709492ffeec47ebc25574603

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        8cbc27fce5486167fce7efe264c02d3c

                        SHA1

                        8b0b066449c57e50e4fd5ca26f5478ba78b301c7

                        SHA256

                        c6ed2c8a64181bb15d5d5bc595ef640b85b0917774aa39477e3ccceac43e21ed

                        SHA512

                        3fffa972fcd4651e4e9d94081f2c4eff545fe169a3d665c9be41961fff781c430a3c0a61212209ca43e082851ec6d3545fae02c465a565ce1a791afe07798539

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        817634a8c00a2b9cda5cf3d024c53419

                        SHA1

                        d30c9315443507d67b28a416e987c84c86e043b7

                        SHA256

                        341286ddb720c3e37007974cc71db92523a4444a381444ad5fdc0376fc08cd6b

                        SHA512

                        a572c68ac7df412b1ae77a4b77ec337bdbca39b9154c02fed703c81997a54b5472e8e5a4d432f983316b3b6005f5bd74bc325172c45d293a68f0575dbc0c73cf

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        284c17d9313e9a42b72c82ce6b336fc1

                        SHA1

                        ab8d087d6268bda02120a395f022de41a7cb896b

                        SHA256

                        b9ec1873567511181440e8dbbfd0c5a57b06d8a6ee0d946de1905a2376034207

                        SHA512

                        a297ea26a765baf245a8e495f6e7c7dfb4b81fd95ad7154adecaaf7a8cb77b684c140ab98ebb33917e53704bb3bc117f44658281405d1f5ac6192ee8b17e7d71

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        fa728b4552dbceb6ecf2db01b7eb189d

                        SHA1

                        fa7f1cc31afdbdd4f1218d08f89812d1b32edce5

                        SHA256

                        021a05981fbb57d69b373c70d32a6fc47119379b73ceaa3533acc8798ad4152e

                        SHA512

                        a4901b943fe37b89b9a986a7047b7a85050ad412c8440d4598bc6abd10ff4ee72dab180181285c1c4ad277b2a009c74ccc109d8f3725369bb96c27589a151370

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        eede7b2fd5cb782611c8cbcd8ef50dcd

                        SHA1

                        8f6cf890ec69c64cd0c42c9f15d862c162abd23d

                        SHA256

                        d4265578d183aceb7c8eb86027c70bde3d5ed92624537b35426dc4d157f779c6

                        SHA512

                        37ce9a4882dac508f64a183a96c4e0a0041c85df6f25bc0dfa59d2990aa44ba01aa00249b5b3439b6fa8559a99b9d94dcf602050cc6299ed4db0029893deb64a

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        5705877f88539d45383ea7da54039093

                        SHA1

                        d7c497892977552419f02e68ca3444f4d4497878

                        SHA256

                        d911a8a85a8b66e1dc1ef403a4009ba2445efa09d0846e173e14bb9aff5a3f3f

                        SHA512

                        ff97709ca7d1937a80a3c8d2c1e33ee327d6ca1b621ce9ff308723e2a51c6fbc60cce756d33fa7cd66b73d10dc67144d1d24c66e25902903fdf8984a3e01119d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        e9f6e19942ff1bcf0c2c73798165a482

                        SHA1

                        ad7d70c490b01c33df5cb09d28640c321aff1ea2

                        SHA256

                        15d583a8895e09a5a1736d45cb878d15f9b6517b078d889e6818701e83d03c77

                        SHA512

                        b9ba1abfdbef40dbbe595c04ba064276e9b85c1557d5446d0a314aabe7576411acca1917a5b46666e851a1fb55121f527c561d37d906d6d545bc45a380ac0856

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        14dde379a7a36be8feaf66d9091e0512

                        SHA1

                        aa2271918001113c9a9f1a5fbed94a42ee1838eb

                        SHA256

                        070006e2a4f7c759bbd6750d72701cdb49cc527526a0bab39aa3417c76d06554

                        SHA512

                        460bb0e4e4872c2282356a832827006ad07e94f3219a06caab2d67d3e036c431aad26a4a86df11f3cbf7734a693b9e2150b6310b78fb06654808f996ef1d0c1d

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        116KB

                        MD5

                        2f4301e7df5caedec83b9bec3c0e6b20

                        SHA1

                        25007c9a7f781f3f2ed22f23209d329762d5bc72

                        SHA256

                        2c01dbf50d4dbca324416666284fdbe293db96914cd9027da2f9558ac585efac

                        SHA512

                        4c3d6f0eb1e2f561014116350ddd8a415e4d3a00a35f2bc9bb220a2835b576f97d88af6120a7ec8959ccf3368f7629f806c45a0af29d4657c525004f842fddce

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        116KB

                        MD5

                        0d07753328ff0833bb2cc8297ef12509

                        SHA1

                        3f35f8837e3b7ef3375bb62ca7db18f670dbc609

                        SHA256

                        8b12ec80f86024755433397703e34449cd9068dbadb2722bbecff7864f234afb

                        SHA512

                        d84e31ec817f73ee999ac421bd5fc9253dd8e0ff2b354136fde459864208af3c9879d83cb7e2836a60ff030e57aeea0de194188244cea7350fc2c7f19909ed80