Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231023-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/11/2023, 06:30

General

  • Target

    http://autosupgov.cc/

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://autosupgov.cc/
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3344
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd77539758,0x7ffd77539768,0x7ffd77539778
      2⤵
        PID:5092
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:2
        2⤵
          PID:2944
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:8
          2⤵
            PID:4784
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:8
            2⤵
              PID:808
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:1
              2⤵
                PID:1080
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:1
                2⤵
                  PID:2632
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4472 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:1
                  2⤵
                    PID:2512
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5068 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:1
                    2⤵
                      PID:3164
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5056 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:1
                      2⤵
                        PID:3580
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:8
                        2⤵
                          PID:4980
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:8
                          2⤵
                            PID:2264
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5348 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:1
                            2⤵
                              PID:4460
                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3452 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:2
                              2⤵
                              • Suspicious behavior: EnumeratesProcesses
                              PID:4252
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:436

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              144B

                              MD5

                              20c84c9ebd66b28a005a4dd3bac88511

                              SHA1

                              280878917db74b00ca00767059b2f0cac60e7375

                              SHA256

                              d2ca9cb0a0c44dab689ebcbb9684249ce5d0342ce833856cf91721aedd7fb379

                              SHA512

                              b85f107b7b4aa45bb1545137f6ff7f2f5734b1aed4dbe071ace806984b43c626c63897314895f87449d5f02ffb75ea2dacc1845c82082fcacc4cd49d5d8224bb

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              2KB

                              MD5

                              e06b49f2d7c9d23e16787b35fc57e7ab

                              SHA1

                              69d64286b0ee65fd7fbc511bb59fe06cee0e8aca

                              SHA256

                              db34843c8429cee60762a2b2e02935a4a5a21f4e63eb973036dc22b6b7407bda

                              SHA512

                              030a19ee7e71de60631d1dde3252b72dd9b4b5317c71323f64c1555d93a05479d3ae351f71ad6e2511c23e9bc0263f62ef133f1844e77b522a7bfae4698ab609

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              535B

                              MD5

                              b6cfdb486b1f0846c57817d1df2b3db8

                              SHA1

                              0b919683babf1a9e42ca145205027944bb44a6bc

                              SHA256

                              2dbc35bbee087fedbc69775f25056d611eea684454e2b199428e62b66cc28608

                              SHA512

                              077bec898417d2f190c46f3d98dabf48563873951cd9cb9561813a2fec5ccaa447598c05b92039a3a7ea49679b2613a18ba432322d5c1c1cb2bb48882cd381b3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              612a80acb806a9fd5ab3be6f0faacdd0

                              SHA1

                              a0ba664248df8ed177b6944f9cf9db087026619c

                              SHA256

                              b6f3c40924c67aa434a795397c9ea554c29383ecd54460da07ddae5f45cc3d16

                              SHA512

                              2e49fa055e5bca7681dacdcc7a12bccc2b5ad7a7e82a3d3d2e2a5d8c7f46312a2bfbfe5872f89d5ec22eae343ea9bd1db068f438af5c64b394a8a4a8cbbaf3ab

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              76215842aaf30d6c8fe5ccbc0d0bd16f

                              SHA1

                              38a1a3fc81a522c02b4812eb7d2fb1790a165f25

                              SHA256

                              73e42f5a8d05fba2c4f53bc4790dfbf28b05d64e48e8c7a68c0057d82cc61ff6

                              SHA512

                              47d3ef7d248685ca8fbc2b4439f9e1230dab4601c7e4f57e65ad51069fdb3fcb15a882d6d42026ba193543d1fef0a295c26c3368aea051f87729b3837fea353f

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              5KB

                              MD5

                              88ff698670f1ed43c5df9844f4a4e773

                              SHA1

                              b9289125416c0034f893c93cd4fcc4811ef7c9b8

                              SHA256

                              11197c908d73b6a1dfdbc5cfbc49f5cfb72cffebb52d9f1ae77d2f6a7b94d9fe

                              SHA512

                              6ad2e06afed59eb3a5441aad14053bdc3e7dc7c54b989dc5f451880ee840b733da9697be6940e6f5b41e105e7ea1997c1aa77a44533532b518906eeb14fcb436

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              109KB

                              MD5

                              9ae9abf61dc6a772153230c92a78844c

                              SHA1

                              46bd4107057a50907c71ddebd9794e997a587cf4

                              SHA256

                              4e75661a0736cb3fd71ad0d955b06ea797db83cdca2533f2ae2f8a90157b147e

                              SHA512

                              b52029b934f31d136b4aaa625cf4a7f9067102cdb7236f63379f21a9401a9d4245fe694c5ee2b89e84aec1db412edceaca11afd61b65faad1f05afe6179f67c3

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd