Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/01/2025, 20:31

General

  • Target

    https://steamcomunmity.com/glft/771243

Score
3/10

Malware Config

Signatures

  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamcomunmity.com/glft/771243
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xdc,0xe0,0xd4,0xd8,0x104,0x7ffa6df9cc40,0x7ffa6df9cc4c,0x7ffa6df9cc58
      2⤵
        PID:2876
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1948,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1940 /prefetch:2
        2⤵
          PID:4408
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2192,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2208 /prefetch:3
          2⤵
            PID:2764
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2256,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2460 /prefetch:8
            2⤵
              PID:4664
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3184 /prefetch:1
              2⤵
                PID:4516
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3148,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3312 /prefetch:1
                2⤵
                  PID:2212
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3736,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3700 /prefetch:1
                  2⤵
                    PID:3948
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=3372,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4812 /prefetch:8
                    2⤵
                      PID:1648
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4868,i,1793990235942410929,16115846815894633162,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1628 /prefetch:8
                      2⤵
                      • Suspicious behavior: EnumeratesProcesses
                      PID:3848
                  • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                    "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                    1⤵
                      PID:4724
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                      1⤵
                        PID:4456

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                        Filesize

                        649B

                        MD5

                        8f9fc86c2ae6834c8c43f10037de670d

                        SHA1

                        3212f9215885c8795959727059ef0e2b33241475

                        SHA256

                        5b0f728a10973d37b2d73a8ab3f709260ab9039aeff31e469b2c7a92da5e3d29

                        SHA512

                        ad46f52c1eb9884c59d6eb20f631d0ce73cf0bc7f1c7eac8aff91b45fd58f9e2c45b356cf6eea2518a00c3ea6ac7daf67377d0e017d4e405984f8b4025742d62

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                        Filesize

                        216B

                        MD5

                        92747456eb98c5b51cf2db49a7d7877a

                        SHA1

                        47cb51b03bf28bf045cd7616e3f483e60804b651

                        SHA256

                        dad8acbca7e614a636c2a5cff17620bb633e7ae997fc61fca55ba65642d8d7e2

                        SHA512

                        31ed7751449debc8070b9ceedeb1d8be15e8f86004e64a7ceefea947fd299e68a9b4ac76607c9efcacc97ad7e2c1acf457c6309249e13b82a4de1c628a3d4f7b

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                        Filesize

                        2KB

                        MD5

                        4f4fe99403a8aec0046782fbbcdb48d7

                        SHA1

                        8d5f3ee168ee6c1158e20ac3c644227d04a77a11

                        SHA256

                        b3ba2ec645b50675acd25c386ac60a88370bee854182acb37ecba0ff16fca332

                        SHA512

                        ba2012124f0b98107c7b72e05e5f32eb660b483379fd010dfbed51b38d634a3871e10818835efd9fe82512d5b5df38d268e58b434b416c1e642c8857092101c3

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                        Filesize

                        2B

                        MD5

                        d751713988987e9331980363e24189ce

                        SHA1

                        97d170e1550eee4afc0af065b78cda302a97674c

                        SHA256

                        4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                        SHA512

                        b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                        Filesize

                        691B

                        MD5

                        e8a285f0b173a59bc2ba15f685869819

                        SHA1

                        c593bab11756b0db4cf4c4924e1928f228dbe374

                        SHA256

                        d7909c50b258aa1622391d43b7dc0ac9d54fe7bc6361ef646207df6d02e74013

                        SHA512

                        58a0e710ed9853b672cf3d5334fb42bd197aabd0ba564b4508344f0a80369abd7005779498594663e08fb24627f1cc67b94eea3f2f2b2de62a73b7a2d6709bdb

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        e68090a066990f714f58b4f568f8bd2f

                        SHA1

                        9d509df9b75cf6b3dd865f8bd5ada850c75a4aaf

                        SHA256

                        7d5cd106d041a55717ea182473ea5be878df2d839702a38418e17750f8a65c98

                        SHA512

                        139acfb9e47ed8e6353784c7f2a0a0361294ab85e529b59f3ea75bad12cf73495f2756259476e563d058beb93787bd7307e10ea72d69e05a3fc383616e1e6613

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        ff7f4b3ccc477bdd3c4b08a7f4d99d6b

                        SHA1

                        66f8833fdc23a396f6c351ce69eaf0b24a62348f

                        SHA256

                        491915e1ea056038f16122abc8db23a57093539cc2255edcbb90cf8cf60888fa

                        SHA512

                        94d9f81d68699302e7a0c90403ddd7a99a4427900e9b40eed76514ce78d7049ca8e103717e0d69a70755d81a3c25e335e616ea4e81f38272a6916f0b6fd70818

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        f72ccead57dc93d273ef6f6293b0a2cd

                        SHA1

                        69b79eff17b98339d20bc1acad1cae5722f0ee16

                        SHA256

                        24819e8f619ed1481d843aaf018ceef1701b2909e0dc8a170524b29f029af4fb

                        SHA512

                        6755c2906ab85bbfbe3e3137f5faac2752a1ec7f1a014c3a8b726b9bf8962b60cba07a02241064d05278f5b48fdd64fba4f60b7c37e7cd95b33eec9d4e8f08d3

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        a35e3c4dd8715d7834fa8d5ab3e866c4

                        SHA1

                        68fd2b4e693572b6ed28028a7f34326f3705fb2a

                        SHA256

                        ff9796d0b1830b118be835ba6997cd0c9b00e47796a31a66ae64b8b9c25e9f4d

                        SHA512

                        6926a1aebdc1189ae99f3c58f3c98b014bf9b2ed6e0272ffaa1f3ee4af5dd5c26576d3b71f60db4f0e281f4ce351886cecbf103e2e5b34cefd52693af33ad5c8

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                        Filesize

                        9KB

                        MD5

                        4020c3bc8df4b5caf7cbee6a7e8b2cae

                        SHA1

                        a8309fd4de5ee720197089c0b47794d144630ea9

                        SHA256

                        33f536ebdb97b3815ac8da197c4a80fbe08dede0308f7f669ee2450a4fdd4fca

                        SHA512

                        9f7d47561815ea0b091ff5ea066542a10db1a2cfdd87160ab15fcaa5b499ccad2e7f8235e83784d31e8557dade5e5fa36342eda2f37bd6733a460721c8ce912e

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        116KB

                        MD5

                        b67b7988bdafe830c9018036d965b735

                        SHA1

                        56223c98b0ed6057d67b27903f60927d2620e228

                        SHA256

                        2667d086193cff308a141302238d55bb27b1fb62787c64ff063165f973839ce6

                        SHA512

                        696ffdb8fe528b089db861f91afd63814c7b63d588da5c77a1061cd4567d8340d10da020d6e3e138a088b783fe067610505532f01539630952ae3f803770bf70

                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                        Filesize

                        116KB

                        MD5

                        96aa5e91f454c758a1f95e28d92c4008

                        SHA1

                        44f0fadba5ca0e2ae96b8157f188c2685268fbe3

                        SHA256

                        0d0324afa6a99713d532c13f5dcdf520ebf878a7064c9f31ac9d2e90c7365a19

                        SHA512

                        3fe5830ced4274c8ef13994892f22765d276bb95648b915990741cd6820df863f288b12d5cdb36f2d093c283d5637abc074332b660fe7d974945065f075df78a