Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240419-en
  • resource tags

    arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    28/06/2024, 10:54

General

  • Target

    https://url.au.m.mimecastprotect.com/s/HZWZCWLVoDij1O8LC6EJAU?domain=rainmakerlive.com.au

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 12 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://url.au.m.mimecastprotect.com/s/HZWZCWLVoDij1O8LC6EJAU?domain=rainmakerlive.com.au
    1⤵
    • Drops file in Windows directory
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:5100
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff250fcc40,0x7fff250fcc4c,0x7fff250fcc58
      2⤵
        PID:756
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,5020277095641761575,5438960966644090014,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1780 /prefetch:2
        2⤵
          PID:4544
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1936,i,5020277095641761575,5438960966644090014,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1944 /prefetch:3
          2⤵
            PID:4340
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2180,i,5020277095641761575,5438960966644090014,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2192 /prefetch:8
            2⤵
              PID:3448
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3080,i,5020277095641761575,5438960966644090014,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3096 /prefetch:1
              2⤵
                PID:2624
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3084,i,5020277095641761575,5438960966644090014,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3136 /prefetch:1
                2⤵
                  PID:2740
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4296,i,5020277095641761575,5438960966644090014,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4368 /prefetch:1
                  2⤵
                    PID:3016
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4392,i,5020277095641761575,5438960966644090014,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4704 /prefetch:8
                    2⤵
                      PID:1108
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4916,i,5020277095641761575,5438960966644090014,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4848 /prefetch:1
                      2⤵
                        PID:4468
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=4492,i,5020277095641761575,5438960966644090014,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4968 /prefetch:8
                        2⤵
                        • Drops file in System32 directory
                        • Suspicious behavior: EnumeratesProcesses
                        PID:568
                    • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                      "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                      1⤵
                        PID:2368
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                        1⤵
                          PID:4732

                        Network

                        MITRE ATT&CK Enterprise v15

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.idx

                          Filesize

                          64KB

                          MD5

                          b5ad5caaaee00cb8cf445427975ae66c

                          SHA1

                          dcde6527290a326e048f9c3a85280d3fa71e1e22

                          SHA256

                          b6409b9d55ce242ff022f7a2d86ae8eff873daabf3a0506031712b8baa6197b8

                          SHA512

                          92f7fbbcbbea769b1af6dd7e75577be3eb8bb4a4a6f8a9288d6da4014e1ea309ee649a7b089be09ba27866e175ab6f6a912413256d7e13eaf60f6f30e492ce7f

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.lock

                          Filesize

                          4B

                          MD5

                          f49655f856acb8884cc0ace29216f511

                          SHA1

                          cb0f1f87ec0455ec349aaa950c600475ac7b7b6b

                          SHA256

                          7852fce59c67ddf1d6b8b997eaa1adfac004a9f3a91c37295de9223674011fba

                          SHA512

                          599e93d25b174524495ed29653052b3590133096404873318f05fd68f4c9a5c9a3b30574551141fbb73d7329d6be342699a17f3ae84554bab784776dfda2d5f8

                        • C:\Users\Admin\AppData\Local\D3DSCache\cb00da9ba77862e\F4EB2D6C-ED2B-4BDD-AD9D-F913287E6768.val

                          Filesize

                          1008B

                          MD5

                          d222b77a61527f2c177b0869e7babc24

                          SHA1

                          3f23acb984307a4aeba41ebbb70439c97ad1f268

                          SHA256

                          80dc3ffa698e4ff2e916f97983b5eae79470203e91cb684c5ccd4ff1a465d747

                          SHA512

                          d17d836ea77aeaff4cd01f9c7523345167a4a6bc62528aac74acde12679f48079d75d159e9cea2e614da50e83c2dcd92c374c899ea6c4fe8e5513d9bf06c01ff

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                          Filesize

                          649B

                          MD5

                          2dff3e662d8dea506093a5bb6f0ea403

                          SHA1

                          97b76ae58e21bbfebbb5b3291ec4af9205ab1b7a

                          SHA256

                          6e1e5a72a79c31d73b7fb6314591e52aadb0530189d3d9b30285301ecfc99ca6

                          SHA512

                          03d971f6e3dc471c7b1978d1a0c4f1ec238412f65a3d5d1da5883cf79724dc76c95e3a932e636525ea65f9ea008f56f73aa0d609fe006d1eab62b50f8ff0fc21

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                          Filesize

                          1KB

                          MD5

                          a8db3b8483946bcd47f5eda4275b7279

                          SHA1

                          985e2fa2edf5c48511d7bee56e83b654da0279b9

                          SHA256

                          beda9e6216c2e71f1787456888748f2e3af8ac725824f7a35219487520159379

                          SHA512

                          51bf1f43c9a50d051bb7f9386bd0c5bd730de87e56bd5ce5aa8adc71c4fc5499f982fd4d44fa3f48e3a4d61e1772e1c04b0a0411b654018f26beacf02b3e338a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

                          Filesize

                          2KB

                          MD5

                          91073c5159a1fbfc09710221fc6e15ce

                          SHA1

                          9396aa6b965d83946fb997adb638c164b7fb83ad

                          SHA256

                          0dfef63bf48092155d2016fd0799cdf68a396fbc3dd272889f1bf42e872ec755

                          SHA512

                          2286692f9615b7feb356c0cd3e34ff0ce473c4aa49a0f31443fc7f63e3b5474f9c1fc6cd4dda59e4a927106b9e98498060d7bb8134cfe6ed34cccc2f85e92461

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

                          Filesize

                          2B

                          MD5

                          d751713988987e9331980363e24189ce

                          SHA1

                          97d170e1550eee4afc0af065b78cda302a97674c

                          SHA256

                          4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                          SHA512

                          b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                          Filesize

                          1KB

                          MD5

                          f1d730785ac1e4b9f917e71fcac936b1

                          SHA1

                          e4b619e0b9bbe0699aef02b3e0a7366dbecef475

                          SHA256

                          25562b959154c336f97d1bbf23cf2ffdbeabb48118bf5afd82bbf9e137ef646d

                          SHA512

                          f01617064ab6cc7b28afeb8bebe2ae17b28cfc2057759e3bda54e11247879d1b59ca3e2cc40a1f50e0432635ad64fb415caf3c046ef1ba23d3f45a3a32c3c2d0

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          8eed7efb50d78fe06f8835b1a32a90cb

                          SHA1

                          d67dfc2d3fd8b92b67205aca6f15c439e2f521e5

                          SHA256

                          14a23ac910ca26a631f72e665d6125a845b09d651eb7199971a1a72312abce92

                          SHA512

                          b94ada8ead701aeb86cc489ddf76df5f0902ba0ac07fae81b4c5f1ab7d3754f152a30760e21c43183fc4160f2f7d434575dbdc269b869e4c455f35aaa8eba64a

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          e725e1893d4e2efc7f8d0c66153dee59

                          SHA1

                          caf234d3cc9db31ac515c0f0182cbeb0424f01d8

                          SHA256

                          2a4dc20901811c97b62a6f3336fb7cd6cf9b40c092edb42be071f9a362b07d74

                          SHA512

                          20af1704c2115d7764e5739de97efc47679384763b421f8b4e177d68f78d322287fbf6236b7b34e86b77ab55f16c949fb0ddedeafe2998cddd2fbbf3c937f98c

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          f01e3c25e37e8acce0a30afabc452e3e

                          SHA1

                          0e6e8b205246290ca1cb7c234c6a82a682755d29

                          SHA256

                          3b54772b98d64abca0a92a19d1516de6c9e52758770eb3aea34918778afee0d8

                          SHA512

                          c6e0c9fc10e10e6979a216e8b85342a55eb32c83b4ee9b5f5f40c512d0e2c34f9c106ab92eb0082871696472dfcbbae162d0541a8b7070391b4bd6bdbd624b69

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          214333f52ddd181ec86ef9d3cec3acb1

                          SHA1

                          faeabdbef78d702a8991bdb6a3aa3b5e99aefa81

                          SHA256

                          3fa1c51347b3e3d530b5ddd9d37b2b84a34527ad88662058b18e24a875bf3537

                          SHA512

                          4f290fbf89b7b4fc4a7dd94814762a6aef348af9f1f30cc4809ddffb5ec6bda56b79baf78c3129c24cd0ae035a56cbd594bbe91a4a551aa8fbce8dea1115cb1b

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          42f164b48b3de5e9f55a3517ff9e4dfb

                          SHA1

                          775ab4276870259cb11a8f7fafedce97d3014240

                          SHA256

                          a02abbc12b0e09ef949b576854e742868dd0058a056091d6212e86dece4359cf

                          SHA512

                          c9bc32335be9a0d94dacc961bfa24657f0f710cf090cb622abe1daa174350a1369643caa024547752a8b7a1fd17ecb67fba777fe2e9ae33307c4b7d2a5e0eeda

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          1a17fa15c3f0637167456b5fcd39b368

                          SHA1

                          f94f4fedcdcda5de12c1628cf543db4e664a78e2

                          SHA256

                          6cb78cc7004f410ac5306e0d5783fdf2ec3b7685b5b4b3facd514aa8daa7e3d8

                          SHA512

                          ec9eff4b61291ab25c25eecae6e98f2451f0111254749b9a5193e1ec2e268e2cd9b04c5a3f085cf3b226bdf6d5b354c675b958ee08a74bbb2165a344d9b6bd09

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                          Filesize

                          9KB

                          MD5

                          0b7d84d2906a79c76bd40584479d9e8f

                          SHA1

                          74c568aae1f2dcd33500728404292f22cfed6f4a

                          SHA256

                          a86be19d84bfa03ccddf5fc2849a039dc3a893c38ebb79e8306a324e866d2082

                          SHA512

                          32c494b8e41e57ca255180edf387d1abdcaccd67acbbf6087a8c208fbda93edc6fe6c1679f94cff314e2bd6e85c5a358f5f0d07c9f5c88eb628cf02fe3d18bd2

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          77KB

                          MD5

                          f28a683829be843fb112fcc57c3bfa1b

                          SHA1

                          0cec9035498d91f3ab35330b8181927f609fbb5d

                          SHA256

                          78fba4ed09bf63110fe2399344980b72811b9863ac31a110540783ece8385d90

                          SHA512

                          ca74623cd9f40d7317085f71b129d0c37257156e5df71dbfcf2b8ad862d7868edf185150368b39b9ab3513862598b1b664f74a9678ca7da5e0a7a13c1d86709f

                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                          Filesize

                          77KB

                          MD5

                          d516692a39ff6924b9b5757e258a4c2a

                          SHA1

                          ddd6844cac5f9088c389a7e083a88636dc579be7

                          SHA256

                          599606ffd9e965494b9988617f1ba7af124b9bcd7ec34fb80b3d9667888264bf

                          SHA512

                          4666cd35bb9ae2c6dc058d1b7956eb5c967c4757df604784623e1a50a811d5ada6a8eb6cb73926a42b63e6612954629aee91ee957884ac2f2c87703dab417a09