Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    73s
  • max time network
    75s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250129-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/02/2025, 18:38

General

  • Target

    https://drive.google.com/drive/u/1/folders/1GE7epoTIUQXONNi5Ua3bFkBzwBd8q405

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://drive.google.com/drive/u/1/folders/1GE7epoTIUQXONNi5Ua3bFkBzwBd8q405
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:4288
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffb6cfecc40,0x7ffb6cfecc4c,0x7ffb6cfecc58
      2⤵
        PID:4280
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1896,i,2007308739594052344,15762768758960993974,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=1892 /prefetch:2
        2⤵
          PID:416
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2112,i,2007308739594052344,15762768758960993974,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2160 /prefetch:3
          2⤵
            PID:764
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2204,i,2007308739594052344,15762768758960993974,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=2500 /prefetch:8
            2⤵
              PID:1736
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,2007308739594052344,15762768758960993974,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3152 /prefetch:1
              2⤵
                PID:1332
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,2007308739594052344,15762768758960993974,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=3296 /prefetch:1
                2⤵
                  PID:3332
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4888,i,2007308739594052344,15762768758960993974,262144 --variations-seed-version=20250128-180236.310000 --mojo-platform-channel-handle=4696 /prefetch:8
                  2⤵
                    PID:3688
                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                  1⤵
                    PID:4092
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                    1⤵
                      PID:2188

                    Network

                    MITRE ATT&CK Enterprise v15

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cache\Cache_Data\f_00000e

                      Filesize

                      214KB

                      MD5

                      ba958dfa97ba4abe328dce19c50cd19c

                      SHA1

                      122405a9536dd824adcc446c3f0f3a971c94f1b1

                      SHA256

                      3124365e9e20791892ee21f47763d3df116763da0270796ca42fd63ecc23c607

                      SHA512

                      aad22e93babe3255a7e78d9a9e24c1cda167d449e5383bb740125445e7c7ddd8df53a0e53705f4262a49a307dc54ceb40c66bab61bec206fbe59918110af70bf

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                      Filesize

                      1KB

                      MD5

                      642342d9c4d72dace365fc666d33cc2a

                      SHA1

                      a48ce2cabd0b763356ec1732204b6bcd1f918964

                      SHA256

                      5c33580271734cd82b96def545258159a606c71a3c8fe173bf4a1ee64f7262db

                      SHA512

                      1057dbdab89e95c5b5982abd1959ef0f52a51140fd28577993d9b7144f2c89296a9fb69cd94c63adb0146b419294014fbee149b076965aa0fe6fddcb2285b007

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\8ff2a925-2e27-4a85-9852-5aa15b7dc9d6.tmp

                      Filesize

                      1KB

                      MD5

                      518ab88c6d3e61bee049500ba4fc8187

                      SHA1

                      e8a353fb5022cc9cac7f1abda65aee25444ea71b

                      SHA256

                      9d9fb9cad39720b28e36f35f278c1ed292a7e8c87b01e94b70237a069ed95a2b

                      SHA512

                      a41532773ca2481fa49a368db49f4ca06e46f35426cb8d548d38f4a91c84c9c33db9237e912b4a55fab1626066c1ba520108da50d7014dedbf9a4ebe71a802d3

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                      Filesize

                      5KB

                      MD5

                      dd0c42506a6ea03a737901912d091a67

                      SHA1

                      1d7ed9f4ad7a999b8ed13f449bb4b60b12cb1322

                      SHA256

                      3b6299d0d40baf45b558e6e768e22ea197656cd8489cab1e2cb1f9fe52d36328

                      SHA512

                      b389c38af31ba1114b074672d4a705674bf21ba958c24d66aaa436e09b21bc77494740bb3fbf464e4245e496d4c671b30c10d0f92bb8c463ff5ae3c7fd5394f1

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                      Filesize

                      2B

                      MD5

                      d751713988987e9331980363e24189ce

                      SHA1

                      97d170e1550eee4afc0af065b78cda302a97674c

                      SHA256

                      4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                      SHA512

                      b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      691B

                      MD5

                      0fb740c25582385c41c8e2638876a1f2

                      SHA1

                      bf89a544758ae8d2359c62753453ccd7bc99747d

                      SHA256

                      0c1a51c62c7b0ea53e4ed9c2a023cb8ae55b298703ec2c3d31f81885cb2e41a2

                      SHA512

                      e7aa16d398077d871d3d2a26bff25b1be403bbd2946af285f9ddc1567218695dcba93857f9b7c78696f43c34d193259f3bd85c6391a2a2acbb51f3b47cc0c819

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                      Filesize

                      1KB

                      MD5

                      14793f28d76f874f9c08f708d66659e2

                      SHA1

                      efeb18f085f82227ac33eaa7b989e26cbab21180

                      SHA256

                      fd5d178f96ac851816e0493a64649fcbc5d7357dbd01dc13319a4cc3cdfefeea

                      SHA512

                      be2020de5784a4a36dd059e2d7e9f7ef686fd75d279fa1a557e3aa9671d87b73b0e3a3d3c51446c0d8a3b1964a68ac16df5c74d79388ac06216485f0c1bcd967

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      7d4f55116ad6e0f78767a5327dd1f4e0

                      SHA1

                      250f614df7af33a60181c351d36bbc11a6f69a1f

                      SHA256

                      e7d87e657944b9210bad026b5b82c32d6fa901a5f45ae4debc5eac81e7a7eb34

                      SHA512

                      41771095d91c35f437d3915685985e23aca6e1adc1f005b9c98779150c13f3e3b3cf1fbaf2de24085e8aa51052cbbcb35a7289177d4200bce30b47b2daf0d80c

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      493bca9ada66e12208d44e20e3202487

                      SHA1

                      4315933e4bd11d197c4ff6e2710e95180d6d42eb

                      SHA256

                      68d9c59078c6d4a6ba90ea6f38e226800cdd3654707d96dab60b1cefb4f54dfc

                      SHA512

                      4d05f7323e18ab99f31f66753912731d7279a621c54ca9e04ea7569c8c9d8d2728c4b3b56c3988e006db7b44d68a203941110c3aea3201652f9d035e4ff0f27a

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      8KB

                      MD5

                      2bde4729d24c1336a469edf6bd3dc5a9

                      SHA1

                      f328b030e06ece84554838f42d9649cf9c1af9e5

                      SHA256

                      eb9177d08e74f6b689121f182bef3614945ef7a4ed43f604ca1cf00cba2a7374

                      SHA512

                      04371ab6c47122a6fb78a7d074382da829f1a77450e9cb0a17582eb59c56fe326823a1460c276469dcbee06a7258e13d0ea5da73a064c2cb211de3042d00623d

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      59a11ac6f7ea545684e69538c70696db

                      SHA1

                      e9c6981da48d684fc27535cf9a843c0bb5acdadf

                      SHA256

                      9d2b060e43dd2fbd782edbeea42f8e0ad30eeda149b2339e73aeeada68fc0644

                      SHA512

                      42f14f4e42e864c948df14b07110cab1803992c26295508340317bdc5dbdeacdd786f57ab6b54c43615693a743f893d85385eda63e471e04a0c3af1f2d839524

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                      Filesize

                      9KB

                      MD5

                      57ea2dee1c3ab084e4dc769985c451ac

                      SHA1

                      58f8cbf60ed351811a14796905834c630c2f6fe3

                      SHA256

                      88dadcd7a778e9dca333f4d4808c907b358c5ca7c83f270db6348a7aaca3f5a0

                      SHA512

                      9a3426353be3cf61050a9854d222c5f6ca2ec27b7475daae3ea77a6703f41dd82c7e36b1299a7f3bb7724ccf6f5462a88a9a4850677051dca7449103b89898ed

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      122KB

                      MD5

                      49a56b18ae409356fa54c43877a4a4cf

                      SHA1

                      563237c04627cbb48e74605482d4136da82e3f63

                      SHA256

                      13165ca86f96930ee0bb0efeb085692fdf6510d16bb3e160789ce1af4e63fbba

                      SHA512

                      d53545c01c7d698ea08572b9002b867367cf3fdd63ab7b5be977a8b631fa75ac925015ab067cd32b1a7e8285346c0dad8a441cf9b1563b469640cd8f30ed72e6

                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                      Filesize

                      122KB

                      MD5

                      262210b5e37af175a2e5a94e63fd4e84

                      SHA1

                      bfd48bfe52ab3f8e6719e98863006d1d39b9b101

                      SHA256

                      0cfa5eea46bedce679fc116da957b072d89a4b9af7a3e2b11d647801c33b9865

                      SHA512

                      cdd09ef42817f884017b93d23ebb4270f0260262555a1ec963df47310473b477bd2cc81e00819162b02fe7a9a72cb405d5a028cdd6729d3d065e8280ba50953a