Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    16/03/2023, 13:26

General

  • Target

    http://launcher.theice.com/launcher/download/Connect.application

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Modifies registry class 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 34 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://launcher.theice.com/launcher/download/Connect.application
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2368
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffc3dee9758,0x7ffc3dee9768,0x7ffc3dee9778
      2⤵
        PID:324
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:2
        2⤵
          PID:1424
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:8
          2⤵
            PID:1972
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:8
            2⤵
              PID:1472
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:1
              2⤵
                PID:1796
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:1
                2⤵
                  PID:1464
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4872 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:8
                  2⤵
                    PID:2044
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5080 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:8
                    2⤵
                      PID:3668
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:8
                      2⤵
                        PID:2400
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5020 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:8
                        2⤵
                          PID:2496
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:8
                          2⤵
                            PID:4244
                          • C:\Windows\System32\rundll32.exe
                            "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication C:\Users\Admin\Downloads\Connect.application
                            2⤵
                              PID:2524
                              • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
                                "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
                                3⤵
                                • Modifies registry class
                                • Suspicious use of AdjustPrivilegeToken
                                PID:4784
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:8
                              2⤵
                                PID:2768
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4876 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:8
                                2⤵
                                  PID:2276
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1756,i,17916193600013995598,7573592711506862303,131072 /prefetch:2
                                  2⤵
                                  • Suspicious behavior: EnumeratesProcesses
                                  PID:2496
                              • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                1⤵
                                  PID:900

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                  Filesize

                                  1KB

                                  MD5

                                  cc0739e82bbf75594cf10dd63422ca6d

                                  SHA1

                                  d1c18f97f910e4033fdb31d2e680a9c34818a21d

                                  SHA256

                                  8b3fd2b9be03fb93fd1cae92a026bc8485888019549389ced3d54f18e3c80620

                                  SHA512

                                  d8273979c20f5e90e4d3b5cd778df6b48ecf6e071a74ac68c6ac147835a4a612ee2625f9c7beb5120228225b5a76350c6e8023bb3e16bd84bc39522e7ac490d5

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  2090d5aa879a8073415292f500fbea98

                                  SHA1

                                  5d21880ad7d4cdb929464feb6a9da25f31e1de10

                                  SHA256

                                  903778d06fa77fb6560f10a2485316ebc6b696d6ec8c436276267ee8493027d4

                                  SHA512

                                  70ccc5f3259652467a5a741f2abd81706ffb0c3282efe0f8df037b5de8f75dc58bd61fcedfc18b1ce7844b721060c6d77500b1592395004e06b5b1977f5c146f

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                  Filesize

                                  6KB

                                  MD5

                                  7ca0f66acb2a6b49590c444a642d2866

                                  SHA1

                                  03fb996c26af89abe4d0d21b2dac670b2015a501

                                  SHA256

                                  7703cefd0b9d2e824557df86468befaf80802237d2383b286864eb3f13eae26d

                                  SHA512

                                  086e7a40e2e63ed8419f48b80e3047773318f2e19381a6e88e2721a4cef7ef5b82137ce422e3fa1546e27d69dc1066e31c302384c375d31dac4a2402eb6d35b6

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                  Filesize

                                  15KB

                                  MD5

                                  d5a1714262f00417e47edda5098c3cce

                                  SHA1

                                  fb8752f75e66bd83ae3c4fea6df45dea12e660d9

                                  SHA256

                                  c15b830a7fb4f63ce2b342c69f386b572922a3a9fe88381d0882adc07972e6f0

                                  SHA512

                                  3c132f1152800d6fe9e3b034891c73ef1a8e276bf977948cea51c49a9f611d644043abfcef9aeca93272d73f38adcff567ef8ecfe762694a1d0130c2cda7bfb4

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  145KB

                                  MD5

                                  653670fca3c56f484916fc051483543c

                                  SHA1

                                  bd33b7a72fa82e4e4aa2eb368527b814282931d8

                                  SHA256

                                  7e8222c0bdd1b6da0610d4fadcb975f40604669141b5ccd162860310eb9de99a

                                  SHA512

                                  e1bf4f42b57285a552e6fcfeab14edb34b83f26853c636a5771611e29de64d20f4474680c098027541acf71d55a2dfe59e80339882b6bd01bf5000b05093b2af

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  72KB

                                  MD5

                                  f51b75ab04d7b023c523e395bd0ad891

                                  SHA1

                                  458ad5e5066a4919d7d7215648fe7942786ab80a

                                  SHA256

                                  21e8eeb6affe46178149cedb38c5924ff578370bd8260f4d6c309b208c9ab057

                                  SHA512

                                  4cfb894bb3034c883e1e8b9bda80e939533123dee960808abc3b28ed79779bde79b671863a50c56125fa72628f2545757b953a3c13791670941c555a4039ed25

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                  Filesize

                                  144KB

                                  MD5

                                  fa29a12c3a8b37045bbbfc2ce73d996c

                                  SHA1

                                  1283ce5c7d1e1fb44a8fa816cfb42b3bbd7e6376

                                  SHA256

                                  b1f6baa9209a5688ac252e6fea910acf55169ce39a006927a74f7a61ca2f4f0d

                                  SHA512

                                  c2b5ddc95cc8ebac0b188c095d352744ab3791d40dbc084266f19c85c2c55a0e85a8a1fa3d67ef288ae07d64d5668ccca630dafb7a80a4048d15ae02d322c3ab

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                  Filesize

                                  109KB

                                  MD5

                                  a8be3ca105bffb40d47f7909c4fd51f9

                                  SHA1

                                  f5129af4adc3ae8a65bcf5ede8e1afef038514cc

                                  SHA256

                                  50f7d4803bf059ef66806ba9312beb610d6b3db6e08806aa0d2341f64bf0f7e8

                                  SHA512

                                  7a7a938d4b5577278c177b694ed7a6656172c1d237e7a964b21a3062f14ba7bac24d2147c5cb37ca4b190c5af8acd34e76db6fd6f19b9b4699cb49548dd7f5b3

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe5712bd.TMP

                                  Filesize

                                  103KB

                                  MD5

                                  22fa6d9771f96f2ccc140b77e75d0212

                                  SHA1

                                  b2150792f6c26b4e161911cd37916361abe46363

                                  SHA256

                                  d802102146204a75cf356c1a7c57a997c4aea96bcaebfa67f9375613a1aac7f3

                                  SHA512

                                  601a203dbb9760f4ed0134fecac527ab2e9d689a770a469b6025ad0e1d9a802ccad8bd18654a615a426e57f93690bd48376c3bd9b50acb280cf54584b372c002

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\f864ec8d-c2d8-452a-95e6-73a24109d582.tmp

                                  Filesize

                                  144KB

                                  MD5

                                  660995de22c8441cc0680427c54144be

                                  SHA1

                                  cf75483d63cd12a3ba15d1b1e1ccd6b7e83bfd17

                                  SHA256

                                  f3b55fe668a387a95cff56598d6b5e0c8fb372887121cd0c28e9e094912ab898

                                  SHA512

                                  a6ec5d3590ea3d8f2de4dbf468a4a4cbd64322c658408bdb15bb7ac7820d63bf2033b35ed74e4d88207d9f7235677669c718da83222f0fb03bafd9ad49617b59

                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                  Filesize

                                  2B

                                  MD5

                                  99914b932bd37a50b983c5e7c90ae93b

                                  SHA1

                                  bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                  SHA256

                                  44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                  SHA512

                                  27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                • C:\Users\Admin\AppData\Local\Temp\Deployment\D4NHGKLQ.A3N\9ZKPABCH.2O2\IceLogo.ico

                                  Filesize

                                  3KB

                                  MD5

                                  a6de672107862e7fc273d3a689986c54

                                  SHA1

                                  b15558398172dabf1431b281a3e43ec88dbfd734

                                  SHA256

                                  1689720d91740383dd0a597419e54b00888f02972c2ca274fa80b24d9b22b358

                                  SHA512

                                  c863ffc518a9ab4a385ebe94a2e8c750ba692a4988ee8d6cb06692c1d5a48afa234acc07eb582fa24367801c8aca7ad76fd9190e0bf67a7949a60b25ddb5564a

                                • C:\Users\Admin\Downloads\Connect.application

                                  Filesize

                                  12KB

                                  MD5

                                  5dabdf2f9287428a53a7ff54f5a7580c

                                  SHA1

                                  c8157df21cc720e21120d56254ba2903a3c7312b

                                  SHA256

                                  ebfde6f044b6ef8becaca18fdaff52467ee63b3d3cd941c076cd4d97df665736

                                  SHA512

                                  bf49383a54d33f10c2244e5308bff8f84e196c925e2d291a36c6dc851fc1a8b699abc14ca55909d0cead3b878ac8033ac3304a8a59e89fe0f1e6b58203ec2305

                                • C:\Users\Admin\Downloads\Connect.application

                                  Filesize

                                  12KB

                                  MD5

                                  5dabdf2f9287428a53a7ff54f5a7580c

                                  SHA1

                                  c8157df21cc720e21120d56254ba2903a3c7312b

                                  SHA256

                                  ebfde6f044b6ef8becaca18fdaff52467ee63b3d3cd941c076cd4d97df665736

                                  SHA512

                                  bf49383a54d33f10c2244e5308bff8f84e196c925e2d291a36c6dc851fc1a8b699abc14ca55909d0cead3b878ac8033ac3304a8a59e89fe0f1e6b58203ec2305

                                • memory/4784-188-0x000001C8B9920000-0x000001C8B9AA6000-memory.dmp

                                  Filesize

                                  1.5MB

                                • memory/4784-222-0x000001C8A1030000-0x000001C8A1040000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4784-204-0x000001C8A1030000-0x000001C8A1040000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4784-256-0x000001C8A1030000-0x000001C8A1040000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4784-257-0x000001C8A1030000-0x000001C8A1040000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4784-203-0x000001C8A1030000-0x000001C8A1040000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/4784-201-0x000001C8A0FE0000-0x000001C8A1030000-memory.dmp

                                  Filesize

                                  320KB

                                • memory/4784-187-0x000001C89F290000-0x000001C89F298000-memory.dmp

                                  Filesize

                                  32KB