Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    121s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/01/2024, 15:00

General

  • Target

    https://m.classdojo.com/track?uid=bb031a70-7384-4878-9fd5-606acf1ada85&txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_mime_type=html&bsft_tv=25&bsft_lx=2&a=click&redir=https%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fmartynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==

Score
1/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://m.classdojo.com/track?uid=bb031a70-7384-4878-9fd5-606acf1ada85&txnid=c7198ff1-8cb9-4da0-8556-53c68d8185c1&bsft_aaid=0a6571f7-f7de-400c-830d-81f0000b88f0&eid=1cb4f289-02d8-f133-07ba-8c33bd88c371&mid=99d07b0e-94f8-4625-a3fd-52453648cf28&bsft_ek=2023-11-11T00%3A10%3A31Z&bsft_mime_type=html&bsft_tv=25&bsft_lx=2&a=click&redir=https%3A%2F%2Fgoogle.com%2Famp%2Fs%2Fmartynpinckard.co.nz/.well-known/mot/otp/auth/bWFyaWx5bnR1cm5lckBkYWxsYXNjb2xsZWdlLmVkdQ==
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3784
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffc28bc9758,0x7ffc28bc9768,0x7ffc28bc9778
      2⤵
        PID:3488
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:8
        2⤵
          PID:2972
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:2
          2⤵
            PID:2852
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:8
            2⤵
              PID:1728
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3196 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:1
              2⤵
                PID:1552
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3236 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:1
                2⤵
                  PID:2284
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3940 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:1
                  2⤵
                    PID:1876
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4864 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:1
                    2⤵
                      PID:4916
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5524 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:8
                      2⤵
                        PID:4768
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:8
                        2⤵
                          PID:3816
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5564 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:1
                          2⤵
                            PID:4364
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5668 --field-trial-handle=1904,i,4120390426776531035,7027065679626022435,131072 /prefetch:1
                            2⤵
                              PID:496
                          • C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
                            "C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
                            1⤵
                              PID:3524

                            Network

                            MITRE ATT&CK Enterprise v15

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              216B

                              MD5

                              a05ccd06c9d1c34c60376ea2264245a1

                              SHA1

                              e7de8efe847c41b421ce9fd00a20510c5af3ed69

                              SHA256

                              587754fd4c1e5a3e6c067dca8a4a4580e5242b188c9be7a47b1d4e74627dba4d

                              SHA512

                              f66efa06d5b8e8ff6968961e1afc6c6744f2c7cc73a948a0eac8227bba5df83c993eec947ff0c8d336a2e9c63bdc7b9496a72b991fffad3f313b1c7731c91f3d

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                              Filesize

                              120B

                              MD5

                              9cffed0acd7f131b1964828acc088384

                              SHA1

                              0683e446ae721a3d241fd075f5f0e58dc72d82d7

                              SHA256

                              4af11f17f6b97dee27113500526a77cf6ec55d6ab9188f487286194c57f0ab11

                              SHA512

                              2447cade15c52c92f4942650b81d73b129ddc8203ddfeb692478274ddcfaa300893bea2745dfcbc573aa4f239e6494006172addf528685d1ec9853d83e3df400

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              01785d85ef9404fa59bf5448b708d23e

                              SHA1

                              a2f50c5318a8c5f72c260f54777d4f96ea3b4cd0

                              SHA256

                              972dd5a101ed98082f6e3593b1d0b402a5d8c1120d233e2258a522b103006bba

                              SHA512

                              737012dc99ab1d52e8e4cc7a13bf3cf382f3a7e228817b44be2627d85ce46c911f0ffcedb1c34fec21fa2664cc4a2f10f76ecbf6895699eb7cb55d69e1527517

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                              Filesize

                              1KB

                              MD5

                              986b0a0a41986f21ffc6ddd7a85b53d1

                              SHA1

                              028187942951f28ef01383ea12c49fcc79b7867e

                              SHA256

                              b98ddd8de484ae43cee37a51383e03267c07b5c29163d4a498dd69759c94ae79

                              SHA512

                              44fb6b4eeda6b58bf836d3f49af633b957f4aed9473ab293be067f70a5b89edaf894956bc1ec1bc01ae97fe147f4013b9efdc9bac6710313c0065b2ab0c5b712

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                              Filesize

                              528B

                              MD5

                              da581b671483c0a22aec0ceaec21a663

                              SHA1

                              972ad36bbb56487f922ba389ca085cabaa00e46c

                              SHA256

                              5ecc5d68ed5f74def27e134c7d8b1d8ff3cb0fe1cdcd3236005901a2fb21b8de

                              SHA512

                              de9f425b71f94dfaec7d3cdae0b9335bb94cc94fadb8bdb92c3b91b65e6cd530691fff0e2249b8910d03adce68531eb4e27f5f0335990b8e9cc84249cbbf3033

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              675ada83921ba9d747c59bafbed6943a

                              SHA1

                              1a1b1c3fb26fc7c17db99ceeec754e1e2e07fcd0

                              SHA256

                              ec0f7a38b4ccfca7c89a49573791a0eb82fe15de205c227cff6dc94b0cd395fe

                              SHA512

                              a27a380b9fe423a60d04068877dd2697ff33551a58b3ebccc80e872aca95ef669d906356b8d3901fb6c47214288d03bd8ddddaaf478387b86cb817a177ce1c07

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              59e5ce90026fbdc67291f9328c18ce56

                              SHA1

                              7060c7a38f214045725ea115ff8a269b2de3c456

                              SHA256

                              dd91eefa9add3f33c60b4e893e7d5104da910a5c599c87e0a7a089f7f01fde10

                              SHA512

                              b9a0b3f3f262fdd6ff9fa045c97d2ebd075695ac23de7614be2f3059e127232fe6445957deefb32829e366ed34f9417aa763f4a240456350f75124af4fcd0505

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              e03ef126956cf680418c215f9c40f87f

                              SHA1

                              de5b4ef0211f0e7713923607ef0ad621bd20576f

                              SHA256

                              e9e3593611a115bb1dd2ff9b668ef8733707cf7233ec8f4bf1d1d812e3b1cb05

                              SHA512

                              67d17decdf58ab9b7f01dc9534e159eb458273195434ef914afb724eaa528aba9fffbd0ec46b21fe0afc71633b1d21581a1c171664e63bbdc6e4f7dab971e99a

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                              Filesize

                              6KB

                              MD5

                              45cc549ebf8bc32b4c9df6c954ed081d

                              SHA1

                              407b4b21748c5b424d5e830072551cb15362efc1

                              SHA256

                              1743504934c7a0461ce98b1255fa2983d04b5db4b096f6702b0ee91925b0d812

                              SHA512

                              9893ddcfc8adb649100ce4a50d31aef3166860ef2d3476beb6cdb69234d394707378187dddefb97e6b7ce2434efd595ac696db47eb5aff39691c552ba42becd5

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                              Filesize

                              114KB

                              MD5

                              8ef7bd4e9f0d147af12dc37c5f040526

                              SHA1

                              d994bffe1648cf346ff980b685fef563d42a54be

                              SHA256

                              b0ef79da8c7705feee4d0b60cbcd11aa3354c97c91f2660adbf6503e3948ea51

                              SHA512

                              2553f5f516890ea37fcbd2b4b9c60b8ed0b68fe2d9d0604bab7bd56079bbfed8a0997b05a180a954c0be81910a38df5208ce2098e2024b3553ed89eccb52a7c2

                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\persisted_first_party_sets.json

                              Filesize

                              2B

                              MD5

                              99914b932bd37a50b983c5e7c90ae93b

                              SHA1

                              bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

                              SHA256

                              44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

                              SHA512

                              27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd