Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    57s
  • max time network
    60s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/01/2025, 01:10

General

  • Target

    https://navi54.com/

Malware Config

Signatures

  • Detected potential entity reuse from brand STEAM.
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://navi54.com/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2344
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff80d76cc40,0x7ff80d76cc4c,0x7ff80d76cc58
      2⤵
        PID:2452
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,13476520995839050506,17279426528930819103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:2
        2⤵
          PID:3548
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2128,i,13476520995839050506,17279426528930819103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:3
          2⤵
            PID:3164
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2212,i,13476520995839050506,17279426528930819103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2396 /prefetch:8
            2⤵
              PID:4312
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,13476520995839050506,17279426528930819103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3140 /prefetch:1
              2⤵
                PID:1392
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,13476520995839050506,17279426528930819103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
                2⤵
                  PID:4244
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4608,i,13476520995839050506,17279426528930819103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4620 /prefetch:8
                  2⤵
                    PID:3708
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:2416
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:3644

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                      Filesize

                      649B

                      MD5

                      5738b5c0e0f42a3c81cad56a591315ba

                      SHA1

                      dfc588e5f3b1762f8d382a0cc3c0e5b485a49e93

                      SHA256

                      69c77a17a769ecd8fe574ced38a9a7813227f982891f1ccb20e7184c115a2c9b

                      SHA512

                      7d04680ef0cc19350021c0c330a16547ff697d0d3cd0b04673d5f8398ce5302afd5b83488a6be215ef71c8aac404c2044a0ed68defe419eeaf4dd03c4732e332

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      192B

                      MD5

                      aa238bc6beb32fd4470ec3863139ece3

                      SHA1

                      779acb7f37b17e1fec020205886a3e0aa6db8a32

                      SHA256

                      bd10c342c82ad6a42cf30efec6d622f0c267c0965d1effd67efdd66f80dd826d

                      SHA512

                      26f2147dc41f8c06e77db59aa72535550265ecd7a4584ac9af808789a9d7e28f17d116739259fcd15fe88ab93a5020d2ad8623b74daad0250b21a8aacaa2218b

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      168B

                      MD5

                      092a8e3269450bd462affc1f958448fd

                      SHA1

                      a4fd03372099627e8847d80f2e3f14766ea3bdab

                      SHA256

                      2662c8db3b575b0007a8ff75fcedf28ed3ab5d33868b13eaef749f28831cb8f9

                      SHA512

                      dfea5f227ade65f755bef25369bf0957f13e51008704819876926158a0d3e1a9f5962e187cfd268eb9912f987da9d470fb5e0bc4e27b3e0f5c42acf736e43aa5

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      8f39a79f8319f87e88b377586111361d

                      SHA1

                      08d73b2e2b1a7768c57de400198c17ba73ecf40d

                      SHA256

                      b432ffd375ec2b000fcced6c510e6283ae1acdb2808ff66a291e3e6019b7d03e

                      SHA512

                      489df565d518b933bff9d2a99a696adfb02d03824578c4deb23ae8cf9429e159128b17021aed11f9ccbd728d9ced9637389ea9a994a8d117eed162e540666c0d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      9628405e82bbba0457ac66168358c573

                      SHA1

                      9cd92088a68a7b6295b9a2e9860295cff9dd1381

                      SHA256

                      3e095d53319f9cd3415f5f6d493eb9303bcc715959633f833c92d3584d905c5e

                      SHA512

                      cc79420fd04895fc75d2d4b4a4311828cacebdfed5e44665ed65933a1f904fa449d446acfe0ebcd9c4717272929fb3e1cc8ec96c002d0aaa38856bebc4557aac

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      6ed45146f2ee1900185e8c537fd80c57

                      SHA1

                      83574c0401f0c4cb3dbf49cb65027207a57797ea

                      SHA256

                      1bedcd1d26f4625f364be6dde84bae87b254253274ecf55c3ebd1ec092905594

                      SHA512

                      11f17ebec39a639dcc9373510eb688224afb495db3a90d21cf7811374a3c24554030b9c9e0745de6e7712ae8a89342b029c6ba5038a6c6f4ed821b8190f404c1

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      c5d88a8793ff5b1160d2c285c708ea14

                      SHA1

                      8e4bf4ff376f416b1ab55ed2edacc85ceb1ddda4

                      SHA256

                      aa7fb57935529de30ad3d73c9e47d38c0433e69ec1fdc1af554ac24624f8bd9e

                      SHA512

                      e52527c160fb1b270d095a628a5ce2ed8614574d3893b2cbee9b09eab992618b3b2817f8d28bf6c70683a5b05bab8ce308b627358e508e20b9728fe7fe9ce735

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      1507460c049eb6bf4e1b83274ba6d7f9

                      SHA1

                      fd08d3275cdf642dbe57ef5a2f80026f2431424f

                      SHA256

                      51e23dd0784bf0fab7cedb5688e0d177af1d4fe69a416fcace86fd72be30e128

                      SHA512

                      c8367b9fc0f58e7d3a13a4c9459b8f6cd68ee7f233d3d0e1a7b3ee7c199a72d67ba61aef5212c0e659e17922a12d01e5c73fe730010420997e45b7220b362573

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      6b8e023295c0526b92d339ca5012cbef

                      SHA1

                      dbca68ebefd6831c0d33ae2a217e475a6dff9735

                      SHA256

                      d0dd93b7f5fba04d0238e8fd173f39a3251a171db290a6352ad95568a52247c8

                      SHA512

                      c9434cfaf8c08aac2d508099d389eb3852c1dba16790b834a7f0064601a2017be6682bc2518c50be0ca21ee9faf48e8ec778088815df6dda1ce5456e8666d7c2

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      448b511ca05b2dc94ddfcb45611d2908

                      SHA1

                      a23979a07b1bbb1f07cd99f3729477ce38a8ebd2

                      SHA256

                      f066a367b7e5df3a116de6fa1fa65011ddc5d5368d9753803db25db8d874eec1

                      SHA512

                      aa994e57e1480181dd4958300587030787ac755382b1167d1d80beafc8312348dc6d20c25172128c0d448956708fdc487b34173afecdbd6737a7ceb610cd15b5

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      1bd0bc9c4ce2cda0d46ab28fb14a29ca

                      SHA1

                      e0dea1bf649a7c7dfae80f33c14e2fd2b99e89fb

                      SHA256

                      4158a474a28a7e0fa1d92506ecc8914e6aac74f10c78c6ff644d0ccd6233b685

                      SHA512

                      ca342881f366f2140f67f580072e16ab93b8c51021fc71a6c69dcdd356ceee1edb4319037383f0a88265803b87f9f9282bc4c0c8f53172bc3451560a7e644acb

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      116KB

                      MD5

                      10f963f664bcb8adc0c684f6996cce2b

                      SHA1

                      32370ecc0e28778d7e4ef2ac9419a55fba51ac1a

                      SHA256

                      0ed254cea248d6891a3dc74ee4117eb8e7fc0fb250e6fd5ed1d8987ebdbd4f71

                      SHA512

                      879c4446b4a3db35177ba1c371a7600d080a237b454347e69a7a888d153d3be6722389e8fba86d8aef46e257bfa807743ddd3fa0fccadead1507726bc41b3f51