Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/05/2023, 22:15

General

  • Target

    https://sites.google.com/view/novogradac-company-llp/home

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://sites.google.com/view/novogradac-company-llp/home
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8766f9758,0x7ff8766f9768,0x7ff8766f9778
      2⤵
        PID:2312
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:2
        2⤵
          PID:1996
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:8
          2⤵
            PID:220
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1296 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:8
            2⤵
              PID:4640
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:1
              2⤵
                PID:1500
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3184 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:1
                2⤵
                  PID:4772
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4828 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:8
                  2⤵
                    PID:2072
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:8
                    2⤵
                      PID:4300
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4784 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:1
                      2⤵
                        PID:3396
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5060 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:1
                        2⤵
                          PID:1644
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5480 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:8
                          2⤵
                            PID:2788
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4912 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:8
                            2⤵
                              PID:636
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5568 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:8
                              2⤵
                                PID:1912
                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5100 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:8
                                2⤵
                                  PID:228
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3892 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:1
                                  2⤵
                                    PID:4280
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:8
                                    2⤵
                                      PID:2224
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=18 --mojo-platform-channel-handle=5560 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:1
                                      2⤵
                                        PID:1044
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=4976 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:1
                                        2⤵
                                          PID:4100
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:8
                                          2⤵
                                            PID:2596
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5696 --field-trial-handle=1792,i,670087955879556229,6156716935255298856,131072 /prefetch:2
                                            2⤵
                                            • Suspicious behavior: EnumeratesProcesses
                                            PID:4952
                                        • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                                          "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                                          1⤵
                                            PID:1492

                                          Network

                                          MITRE ATT&CK Enterprise v6

                                          Replay Monitor

                                          Loading Replay Monitor...

                                          Downloads

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                            Filesize

                                            336B

                                            MD5

                                            ba852afcf3a358c89b3b6c027ac4e5dd

                                            SHA1

                                            86f35a91ef1c900a1eb7f807dd229334883fcb21

                                            SHA256

                                            e4c315ab1c99abe0c6778a0e17ec8a47f63e5d2137dc99b72c83f3d0c7e88f09

                                            SHA512

                                            3aa1013917a9b6e710ee2b5d74c5f35624d97631534d56078d1529ff085bd1545353d0a5c84bf4a046bf21efbcfa96010b4ed3cc75cafbf4559e3e239aebd130

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                                            Filesize

                                            360B

                                            MD5

                                            69ebb13e76514b0991c907aacac2a6d9

                                            SHA1

                                            4be315d3032c2d856148f17791c2f41c6e0011eb

                                            SHA256

                                            f5b4ff51aefac151dcf5947079e34556f5af241c3ced7b51a84917d378df7f05

                                            SHA512

                                            5b30386b09af1874e2e67e9e3586e743c6fc242c8ee06df2c0e375847df107364ea8c70277ebca2d1f6924cae1219d0d6eacbac91905ced8b6254624261dd1e9

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                            Filesize

                                            3KB

                                            MD5

                                            e591fe3fde62c486bbab905d9acd216d

                                            SHA1

                                            afcc3bbdb466d2e0186137faa0afb3b3d4e3ef65

                                            SHA256

                                            4d34695b751c1ba237141107c13a3a7d95407a7389281f81508a0a4edc678711

                                            SHA512

                                            33240b7e0b0c99d92f5c5931f3de5fc385953265a4d93103aec1faae3d2d772a141e44097c91b2637430f6a57c4d5cc08a5ec584ff7faca413f86494223600af

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                                            Filesize

                                            4KB

                                            MD5

                                            b5900902a11408173f10000e07132054

                                            SHA1

                                            be7302e50b16d52bc2360813b71d57a4a721ec6a

                                            SHA256

                                            2590f99214595f71c806a619f8262e59f4243000e21639a71962b2093d4a1d9c

                                            SHA512

                                            750e45703f6c09e418c83365f75d992dead8e9b9cffba724af068a976bd73e1a1e175daf375a592bdf6362ee18a9b6de0a00d863176ce08a9f814e680f72f2a0

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                            Filesize

                                            707B

                                            MD5

                                            167e92c0ebd1806936a5d7c9e8ce4674

                                            SHA1

                                            e755823a5ea6bb6e331dd07c99877eeff0fd5491

                                            SHA256

                                            27ded03425bc258e5b073a2a67796bb69b7ae905f4d7c90802527aec04f1a4e8

                                            SHA512

                                            df3a51791aa9a90f22da4024ce53691e79fc6730003e763d0bc3c3ad872fddde0d2d8d5bd7525d0af84d7ef2b4d513c1d02ba7209ab6e90f80cb24654ba674c4

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                                            Filesize

                                            1KB

                                            MD5

                                            0a80844bcff890cca1c834036b96b18f

                                            SHA1

                                            cd185175cf9f8ec35c5a0ae97d21178889a262b1

                                            SHA256

                                            d574f3950a20b4e47f1e36d88d059e9c5a10f52b1fb54a89a6fde83a46aaae6c

                                            SHA512

                                            377cb371a435f1efc3cbc12ed6d33e8c80244edaef60fb14383e410b95d2d387bf841fc47c0fb551a6ca35b338f266d939494f8e6bb21bec1472b6f64bbbf21d

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            5KB

                                            MD5

                                            87526bf86f116a4f2caf6802e6643183

                                            SHA1

                                            59d678623e4903e614e34d65d5a74c2747f09b7e

                                            SHA256

                                            cf7804dbc80ddce536748f3b3ecf5d5477dabbf61126e597b20888fe5100e74f

                                            SHA512

                                            6e4bd9ed087e24807cb20621361a3d8b2237ea495341786831a4fd7f24075a367e86476803694319d55fe9d819f4dedfb4da92967a2e16e37aabc3b4400dfd01

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            5KB

                                            MD5

                                            99fb9423e03e8e059f538df60c405c3c

                                            SHA1

                                            a457c75cecd089dd4a60e3042bc2970b34a0f317

                                            SHA256

                                            4a9e32a152f4b002bfa9332fe62117d504d3841f3c759c1c13c0869555231ef7

                                            SHA512

                                            5dc192d3685eb8d720ac702caa5ee7534031e0964200a58956c6f494b6704dffc16f5115b5f155fac73dab7dbfa70dfd4fa081192f1a143cf278c9fd695ee3b5

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            9KB

                                            MD5

                                            dc3c9c895cced5392bcd9af710dd2dca

                                            SHA1

                                            5e83b3b9d730abd6d437d074190bb06933af4bef

                                            SHA256

                                            72f1dd33a77a82d9eb3bbca8d7a05f9358b7b1c410a2e92471e1699fd032b797

                                            SHA512

                                            2ea1dda2e9b02c3fc9ca4c79c8f9f0370dd5ee50b3ad80ebc78cc25a94a7a7292e927014fca86f07bf8a66f7c08a21de3c3c9347e6cf2c975835c1e9fd76d7b4

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                            Filesize

                                            9KB

                                            MD5

                                            09a40d8f0f5aa90ded943019e964d3be

                                            SHA1

                                            84d6d525f4679dcc0fad04fcde9f4256cc5b3a15

                                            SHA256

                                            c9edfc17b07efe78a3a7833866ef51f01bbf80bf0681f5b87ec96989327490ad

                                            SHA512

                                            98da0061a6322f7cb0a8565dc5e9eaefe1bda5b2ad7003971cc9daa354ac192cf6174488245f9c6a597e6f1a18a4172c67b39f78ea4d5c4fa9d46b2cf7d68768

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                            Filesize

                                            149KB

                                            MD5

                                            093537a9d9ae9d88da1447894a70cbc2

                                            SHA1

                                            f7f3f6ff7ff494e8777f430e0f4e3d457e218942

                                            SHA256

                                            bb4d9d73d5310e33ff1c4e36748e0d3d37567bcd43312a128c76177a2ce03c5f

                                            SHA512

                                            8812542848af86341f9703dd714e361c0ff75713d442124e9363f3ba33c453a19d5d3c706b6296669b302a3273c24c14c5142ecd68dda2c0f3cf924dd76dea9d

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                                            Filesize

                                            149KB

                                            MD5

                                            94984dfbada0d65551c05b60a6d72e46

                                            SHA1

                                            8ecc704a23d513db1c4f702a6daeb2499d5b0358

                                            SHA256

                                            321685192aa6042b82f80801cdee3a629da10e5339300447d3e133c8b9b05bf8

                                            SHA512

                                            591e6a929722ba48afd00abb337f243694a81838d199b2730fe85a2b828d0984531d3922e889654df4f7c2e31315f9f15cd7d8131c8448cbe3b6e282ba20cc2d

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                            Filesize

                                            101KB

                                            MD5

                                            c6bbc8f931e83ae0f7097e84db9bd56b

                                            SHA1

                                            6363a59a1e2741c36c949a6168d315a66b401080

                                            SHA256

                                            485f033e3807c185a707a74b9d4de27ab0ba257578eec90127cfb969dfddb7bf

                                            SHA512

                                            2f94c7b020247ec70b67a13b7325bd727a29e710cde19307b0c644719224574f5545c42e0bbd18b31b4fbac3fc52f5bc58de4c27a2b6240432ca14ff46143875

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache

                                            Filesize

                                            100KB

                                            MD5

                                            fb0fbbbffc4813a686af9123d5b0c190

                                            SHA1

                                            31c01c0528d0c60b5f03021b78a2c7ec0165a0fe

                                            SHA256

                                            e7ccf1847d7c032b6fcab0c965c8c29d9a2590ac8dcb891151cfac97ffe66373

                                            SHA512

                                            86fc0b7b050a7b57da98bb45129fcb7f33d05ca4e6e4a0048f99382e97cd586b769749d209c62a36c2c8efafe0c0ff86ff1b57582999d795d115138e82ed4545

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Module Info Cache~RFe57b9f9.TMP

                                            Filesize

                                            96KB

                                            MD5

                                            fa654ea4d367b490a2137e0449587e1e

                                            SHA1

                                            803a5127322c2cd1077798a00acea2f471afb3be

                                            SHA256

                                            cf499cb0c05fc061976f4a152b7d97445e03c75825b62b4670b74d330b11d89b

                                            SHA512

                                            362ba0358dda38e5f2056c2b381206ad0080ce89945d1b824f88ab0b251c5d33239c7c15ae0f21746a1639d99c2f538d968192c58bd3a59440c6d3ac99d46aa6

                                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                                            Filesize

                                            2B

                                            MD5

                                            99914b932bd37a50b983c5e7c90ae93b

                                            SHA1

                                            bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                                            SHA256

                                            44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                                            SHA512

                                            27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

                                          • C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

                                            Filesize

                                            2B

                                            MD5

                                            f3b25701fe362ec84616a93a45ce9998

                                            SHA1

                                            d62636d8caec13f04e28442a0a6fa1afeb024bbb

                                            SHA256

                                            b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

                                            SHA512

                                            98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84