Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    71s
  • max time network
    68s
  • platform
    windows11-21h2_x64
  • resource
    win11-20241007-en
  • resource tags

    arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28/01/2025, 10:31

General

  • Target

    https://stearmcommunnity.com/10538429063

Malware Config

Signatures

  • Detected potential entity reuse from brand STEAM. 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://stearmcommunnity.com/10538429063
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1336
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb35b0cc40,0x7ffb35b0cc4c,0x7ffb35b0cc58
      2⤵
        PID:652
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1784,i,2778378240779697969,153389526041004103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1700 /prefetch:2
        2⤵
          PID:3256
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2072,i,2778378240779697969,153389526041004103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2088 /prefetch:3
          2⤵
          • Detected potential entity reuse from brand STEAM.
          PID:1616
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2152,i,2778378240779697969,153389526041004103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2368 /prefetch:8
          2⤵
            PID:3384
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3048,i,2778378240779697969,153389526041004103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3088 /prefetch:1
            2⤵
              PID:1168
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3080,i,2778378240779697969,153389526041004103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3240 /prefetch:1
              2⤵
                PID:3260
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3052,i,2778378240779697969,153389526041004103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3584 /prefetch:1
                2⤵
                  PID:1060
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4520,i,2778378240779697969,153389526041004103,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3420 /prefetch:8
                  2⤵
                    PID:132
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:4728
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:3140

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                      Filesize

                      649B

                      MD5

                      b4164fb757f993dffabdea5d6aeb3dfb

                      SHA1

                      ac0413bbfe4d6a37fc51dd111e1525df5f757d03

                      SHA256

                      42ef7e75c5b5b1100b37526f666ca279c02c24df9a2804759952391bd095f092

                      SHA512

                      45de1f596da3343eb34ce71b64da3feb963c3afd3675b578401919a02602bc8e1bb9ca459f0975dec4e5895350e539a5a73961fc48c0108624d5d8821fa93afc

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000006

                      Filesize

                      37KB

                      MD5

                      231913fdebabcbe65f4b0052372bde56

                      SHA1

                      553909d080e4f210b64dc73292f3a111d5a0781f

                      SHA256

                      9f890a9debcdfccc339149a7943be9aff9e4c9203c2fa37d5671a5b2c88503ad

                      SHA512

                      7b11b709968c5a52b9b60189fb534f5df56912417243820e9d1c00c97f4bd6d0835f2cdf574d0c36ecb32dbbf5fc397324df54f7fdf9e1b062b5dbda2c02e919

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000017

                      Filesize

                      1015KB

                      MD5

                      51ca4442fe09609762b7c903571b267f

                      SHA1

                      82d52b49cfa937e8c5c6607cc3090048c50f16fa

                      SHA256

                      bd0704da0667d788a09e2ae5e6430b827b2fbbec6e019c0fcabc361d33de4810

                      SHA512

                      29365cba45e96331803393f33f8cba51afeee9c465e1fe028960b79cec3767aaa15002e88918af9817ec40c8453943da1e285c9263e760ce7a5663909ba4c560

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000026

                      Filesize

                      52KB

                      MD5

                      d64c6a8c04ddba50a452a13e70f75323

                      SHA1

                      1d45aecaf0130f85b70be97e52429ec6c83b6892

                      SHA256

                      e270b780f14a9b4df9e87caaca4859589fa6923e373dd2783ac3ebb392c7c2e3

                      SHA512

                      7673557dc4c4fb0045a3285c6f7abfbb978e6c37df62b97380820070ff56c136ae6e8ff941c3dc47b995af3a0e2eefdbaac9df8cfab4d9887d5c9feb9071246a

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000027

                      Filesize

                      28KB

                      MD5

                      f24c6ed9488a9b460cd598edafd89144

                      SHA1

                      f8c8d2ef4b09baee2f66917bf5bae3abbffc7c05

                      SHA256

                      dc8bf81ae6bf302018e167f412d4440956d65e1f993810b9a017c9efec4dd069

                      SHA512

                      53c57ce41a8534f985a4875cbe6122d96a450f58a9f849f05b86a44a29c64dbedd4691b8f46bf0553f7fc38bd487f7ede444b461b7b4a44ca37f4c2a81429925

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000028

                      Filesize

                      22KB

                      MD5

                      fafd090a0b63d928fbe8b3ce4e9260aa

                      SHA1

                      172120d138fb4c6afae97bfc0bae13d424fb7c16

                      SHA256

                      c0ff9308b0e13a3e743f56ae84abf5a054fb964fb3f36e52729d78f71ecbeb67

                      SHA512

                      4840a5455dbc8394a7d47f935aba64e5c23ee7157e9a00848a2a8bad1c604c280e4a56f9445c3c63bc0e778066dd3acff31b973521ca5384c487ea27f89ae71b

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_000029

                      Filesize

                      22KB

                      MD5

                      cd9956d2b6201b91899207bb167832a7

                      SHA1

                      d446c9a6b7eddfb458390d760ef9bddc9b251139

                      SHA256

                      e357f17301202634bf112fbecde34147ccd4e49fb8e973831195a718cfacf770

                      SHA512

                      170ca2ec9fe8bd68ab005fb965092e20899d4b2a3becd84767e3dc49036a2e3af571c4a7fe3840d2a074b9960d2e9d0b55e26e87523fa297efca093718a6fd85

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002a

                      Filesize

                      23KB

                      MD5

                      02ace8c9d46dc9bbb939e071c91e93af

                      SHA1

                      883a9db4b0e196f59758a2d136204ec7ea5b2322

                      SHA256

                      c31d6f02f5896ddb35f0eb3d19387ed782738cc2966246f2dbb121a033fbbade

                      SHA512

                      692d00d5f3a79a13bea3d938e564fa55303979a78565937b932765eb7afd621a8fb125528da39fd8a214dac7d7ffc3571e0932c9985d2201117d46cd09e2ef54

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002b

                      Filesize

                      23KB

                      MD5

                      f9e969a5ff052424471f3b3c656fd229

                      SHA1

                      516b9c1e8bdad02de157b04e194f8e0ebefd14b3

                      SHA256

                      0b6875ff3955b3f51370572fb12e0f30fb0581700d2897a107168069c36cd70f

                      SHA512

                      be950779d942725821775586979c28f5cd24b8490ca6a30c62ede38a616c1b4d0bf009f919ae432b833a34b63880017c8ec09663f9cfd24ba1f63f7d91d178b7

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00002c

                      Filesize

                      42KB

                      MD5

                      9f99d451beaef738a001906081c09598

                      SHA1

                      07bc95a20276c5b9ed3eb3e9555bf7ae8a551aa8

                      SHA256

                      d8d86c330a68d0fa63ce959e8541879ba61890638cfab399021dd183b7eca641

                      SHA512

                      8412b93b0888840a3791cf6f88faa2ad333c61ecc74699ba5a81a45a1175a6bfefe1c295a166bd1cc90189b00a16c5dfcbc7673d21255cfafb18ccab242bb566

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      456B

                      MD5

                      0a7377ba47edb9cb784be244762f3301

                      SHA1

                      f0b675a3b5e58b25313175fc3585b1da5d06e1a3

                      SHA256

                      181d57cb0b2704c22b46f78492606ca272990cc85e1a6082befa770a710c5498

                      SHA512

                      d95158913be53bd31bded43a9c6428736509e6b326fb833f406d06e08115423b1d2f67f52fee0dc6029f3a6a509132577dad4b9644eb157baf1fe2adc1ff91a6

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      3KB

                      MD5

                      fe24457ee86402015120c8d734ef286a

                      SHA1

                      0d857ad18c7f511639c938c8ba32b219d0d32fe0

                      SHA256

                      a4dfd0703abfd5b9ecec402cd5bf88e858bc06899675b4e4ae72f1f811426b50

                      SHA512

                      7489675865ad69d675ff7708e4d3c9d9202ebe58cf4aceb918fdab17ca6144a2835aff1af2b37301dd413f323cd77bdf6765ed03a927a45650d18a89e7201eeb

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      5caddf9fefc1d232c0a11bb5e1727fbe

                      SHA1

                      508f2768d885887666a1be2359f9f4420874c20c

                      SHA256

                      dd5dc212d55fd40962059386fc9b600f9dc0808a2ee5caf3bf7dac79499cebad

                      SHA512

                      3346981bb6118b51b5d8df61a7bce2b6a5aac389748fffdb05049e47c8d20ea44d728ebab5b137f30dc4d047fa5d96f58b5f18546ec7294db932776ee89ce1bc

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      b7337b72ec8f9dd4a073c2aa89a1642f

                      SHA1

                      8e8b30691abaa5a5b1204ea46a5b0cf1a9dcbf7a

                      SHA256

                      fb00bc408760245fc87eabf2d37a5b6434d30c8787dd89f1266106c340c0bc31

                      SHA512

                      9606888143806a76d363a269282a3b107a6229ecf574f1a6ca7bcadb2ae965099c999ee69f69bb038c703c073d222153f6724e89f9a688e4ab36a7bbf8fc85ee

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      3336a86a8cfe4b95e66dc78e34111b97

                      SHA1

                      edb4eacbd5836accb56289c055d70b4fc208b581

                      SHA256

                      23d95d0dab5387a7f6637243e71958e9c2a356123399e740dcebb43fbbd83d37

                      SHA512

                      739745bed158723f1c649a1a0a7a52a412701b86fde2fcdb6eb603d4d0b78a2e58752b3311b72fb886762021f127c5aec72c111c706e0e47d7446a8c7f78397e

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      0e91a8bacf4381a7c4ce8b88cc75980c

                      SHA1

                      caf8638ccdbc75b41319c375a6b3f858b4c610e3

                      SHA256

                      1670f1d7ec1460b486188c9528f7f9f73e8f2101d41dc5d7491c6a3cb1167f85

                      SHA512

                      a147d26006e4b3f4db23efe8c3df0f1bbf80861d35821f2e935005a85b2001e64c94b80847b75d7e1cd4369e4603b89dbc5502c3a964e9fac60e5c372295072d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      da5c97ee34ee1019b512dc16945d979d

                      SHA1

                      b4e69a9bde97fbb48f79f6f472c3cdb787c7b3e5

                      SHA256

                      96bac9d72be3f763df3b6dc03befd1401506f3de9d65e40c2542e76208bcc3fe

                      SHA512

                      9449acbf7b65a05269625b985d615e60cf8b0ed09caf54b28f61b5b9c6ac76d1ba3ecb61b6d717ed437459f21221ea23090e8dfb6458d2dbb4e73fc7c5353262

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      a317313ace556b2641eaa2e820dc3ff2

                      SHA1

                      8898938ef68b9ea295c299a2aadf2cd0c2d8669b

                      SHA256

                      0b14aa0f591dd1d2a05c802681ee664c4d439c24b47b8ea71068e94d91aff00b

                      SHA512

                      95028387563efdc2556bfd04de0d21a4f9de42b7c04072deafc3cc47d9ef4b0b6c1f847ddf1c07205b10cf5ef13324c91363725e7e162695b5c93aaf53607400

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      ed57f1cf45622d96654f9b078a98b7b1

                      SHA1

                      6bf39bec50d3a1336f84ceca0083d42199714f48

                      SHA256

                      9adbd9e0322e2f8be9bb85d4104a68adf4fd97f82027e37584bb315087dd5081

                      SHA512

                      a09165b107182f03f80a2a6497dd452d8c7aa66090b33c5634f9587092aa3ae2abcb0eb9643b154fe25c43ca1acbf3832cf959b76064ff4a5aa11753bccefa80

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      15d20c5ef176d1ed584d4e1d2e8b0d03

                      SHA1

                      ea77bc8f493500ca2960cbfeb0bf8642d2f30c74

                      SHA256

                      297a1856e23deba82cc98b5b001a34b9e9b0ebfd90c3072711ad1d4fbdbe2b19

                      SHA512

                      89687066181c619e76c58a521b94e0fa452a4cf9b26d2ae3bb33dcd3e0f56880881308ac1ece2b865f732656ad32bd6a84215a387e6385117444de1097f205aa

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      f73e692af28c7484f217282a120ffb84

                      SHA1

                      0bc80391bc3331ea584e72ffb0ea6849f7703218

                      SHA256

                      21a0518fffe99231ac5c580df631dca7bce776a0f250f70b945279a7a7decd80

                      SHA512

                      645be41d881d494105c1d888fe76be2c3ad0b03728659ef3116f4443e08aa429e1700114a113caa099f7985ddb71fcc81b25f81cd938d38b932854ad566db404

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      4c57270e778a08710b96e1d909cdf18f

                      SHA1

                      19e27c3504a1544689ae00912dd782c1e998f175

                      SHA256

                      910bb2e28b975073f9281a1d359a6ebd65c2f3eb425837b51047f6be7bba468f

                      SHA512

                      4d0898945d5fdfdbf1f6b64c89990b13b65058a53d5edaa7a5260cd57bfd5a29e9f075d6971caffaadc180d9f1d2903ccab6a5e39e5446d8dcad5fa307a04932

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      228KB

                      MD5

                      7c76d366f1deca896f209b7d0207ec1f

                      SHA1

                      52b3ca54ff7e5edd4704b92a21616c805aea987c

                      SHA256

                      465f533ae2c751928ab02b630b8f580ff6ef054c76a17065193ff0e8b5e06e30

                      SHA512

                      cab62fccc7c59cb465a7baafececf0b617938315bb6a6e230a92f39735e1cc8938368f8ea1c77a6dc0fc815ca7649fa558bb322f508a7db831b5434418ff716b

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      228KB

                      MD5

                      5c2cc0913f99e9b1f4c08d3e6cbc8913

                      SHA1

                      0a4c6672b7f1160ae714ccbdfdf3764bd02d78cf

                      SHA256

                      afead62a4a24ad62498c6b2ed122bd3933eb0796de3fb1b68f8778c826bec482

                      SHA512

                      b097a75035e0d8ebb99e4d0f7eb6b9d3653dc189f166b4d3bf9fabb2a40e3a8a21df315e834c2317e87b460949aab5ee5253aaec843347f8e4169b748359c114