Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    299s
  • max time network
    274s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/07/2024, 20:23

General

  • Target

    https://godaddy.cloud-protect.net/app/digest.php?payload=4ica3bdb9cd3a45c39a4c3bb814e7648bea5502c8e94194e376e9f5a22fcfdddd9f6cc6381435011c473fefc7c5cf55bb4d604ea5351970ad208f627ef7e10a7d2939013aac23e0da684ecbee1b277621702a062a56534ce528452ba4b97a2a8f1feb7ad3b443d50605540aee0b729e57136d5768ec039b64e2508c4205bf8bbaac3f6452d49a1d432e1dd2c&k=k1&action=block

Score
5/10

Malware Config

Signatures

  • Drops file in System32 directory 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 26 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://godaddy.cloud-protect.net/app/digest.php?payload=4ica3bdb9cd3a45c39a4c3bb814e7648bea5502c8e94194e376e9f5a22fcfdddd9f6cc6381435011c473fefc7c5cf55bb4d604ea5351970ad208f627ef7e10a7d2939013aac23e0da684ecbee1b277621702a062a56534ce528452ba4b97a2a8f1feb7ad3b443d50605540aee0b729e57136d5768ec039b64e2508c4205bf8bbaac3f6452d49a1d432e1dd2c&k=k1&action=block
    1⤵
    • Enumerates system info in registry
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2124
    • C:\Program Files\Google\Chrome\Application\chrome.exe
      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff84703cc40,0x7ff84703cc4c,0x7ff84703cc58
      2⤵
        PID:2444
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,4246718773004243493,15671791064910107490,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=1800 /prefetch:2
        2⤵
          PID:2612
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2060,i,4246718773004243493,15671791064910107490,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2064 /prefetch:3
          2⤵
            PID:4084
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2240,i,4246718773004243493,15671791064910107490,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=2432 /prefetch:8
            2⤵
              PID:4572
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,4246718773004243493,15671791064910107490,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3152 /prefetch:1
              2⤵
                PID:1696
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,4246718773004243493,15671791064910107490,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=3188 /prefetch:1
                2⤵
                  PID:456
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4600,i,4246718773004243493,15671791064910107490,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4612 /prefetch:8
                  2⤵
                    PID:396
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4868,i,4246718773004243493,15671791064910107490,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4384 /prefetch:1
                    2⤵
                      PID:3868
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=4956,i,4246718773004243493,15671791064910107490,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4988 /prefetch:1
                      2⤵
                        PID:2500
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4836,i,4246718773004243493,15671791064910107490,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=4792 /prefetch:1
                        2⤵
                          PID:4916
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --no-appcompat-clear --gpu-preferences=WAAAAAAAAADoAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=3420,i,4246718773004243493,15671791064910107490,262144 --variations-seed-version=20240708-180128.343000 --mojo-platform-channel-handle=724 /prefetch:8
                          2⤵
                          • Drops file in System32 directory
                          • Suspicious behavior: EnumeratesProcesses
                          PID:836
                      • C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe
                        "C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"
                        1⤵
                          PID:3624
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                          1⤵
                            PID:4644

                          Network

                          MITRE ATT&CK Enterprise v15

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState

                            Filesize

                            649B

                            MD5

                            f9708d31d45131aab15a6bed79388696

                            SHA1

                            54a876e7391ea2c0a845a2dfb63cc2dbd1adaef6

                            SHA256

                            f5728afc2975f51dcaad1c77771b6784391994933ab7c7c326edf59afabf1b38

                            SHA512

                            047ee8a9a64c78e5eb62f6376a6894401fc2c4459a888c6e4f6fff39e4bcddac2149010c4af0fbe26cc7fae7c4ed2eedd26f1cde132c566b7478a0c881978813

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir\the-real-index

                            Filesize

                            432B

                            MD5

                            6bc07027336feea7f85ffd446e8929bf

                            SHA1

                            c4d272b413c4d90b7a0ea00897c2949232c7d630

                            SHA256

                            cc0035385dd59f05f8d756054793aaa0d84eb1300b21627311fe800dcd3383dc

                            SHA512

                            1c6d30b2dd365d4b33e67e1bbd801d450c5dffe6274641b57316fa3451b3bb3dec72dbd3b0e87658e812c5931acdd848c4005e43948d8c97cd4d6095ec9a7c98

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\9e5fe34d-a0b1-47a3-86ad-2d7901238fd2.tmp

                            Filesize

                            2B

                            MD5

                            d751713988987e9331980363e24189ce

                            SHA1

                            97d170e1550eee4afc0af065b78cda302a97674c

                            SHA256

                            4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                            SHA512

                            b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

                            Filesize

                            521B

                            MD5

                            8c9ac5bc63e14b67754fccf13d0999d2

                            SHA1

                            7c0c96957c6f97ded453ddc895d6dd4aaec2c7b8

                            SHA256

                            418ef95252c3893312842332891ecd921be0d9b0c6e14953c5309a2ca6fef217

                            SHA512

                            261078ea5564106a81243d9f423c8d90af5e3d5493d4d59eea26b5047284c5edf485cc8d4f8825ee2a7d6321ea1514ab746d19bd80bc603adf9200c0dff564bf

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            4ed533e77e36eae50d6ec9d5e1971479

                            SHA1

                            4168f0750ace746a50ce3a5f08f2e134ea37b70e

                            SHA256

                            6f7ae45d2329842e1e734a4846c107d79f1225be6979fd03d5be438617ad0e02

                            SHA512

                            8dfa26e2c7e6347add3655e75b5fa8da2d84a2d5c5f57d45c13f0f0ed7d50b9d77eb27ae3d19708eee508b1b8e034850af909ca6ba712132364a3b4975b5f5dc

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            d413ea6ca58d46279b18262a16564b50

                            SHA1

                            14f861699ce6cf0c6feddc32cc9b24baae2db89b

                            SHA256

                            0f5643c30bddfd5dcea5669da14342cec426e8b6530219810b8adf443e30c116

                            SHA512

                            5c98f1f733c69a062fcfb5ca37539630cf22d96233bfa20c121caf29db150eb90dce04483299a3b4d2c3c6f7f05311485c0736fe358dea730f2a6f41e7cb29d6

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            dc108e515bce0ca6cb3f157e88b17be7

                            SHA1

                            e7cfe2bb911e2af590e384232b5aa99001abefd5

                            SHA256

                            13ff3ae97b3bafbe8e4ea20981352b2ddf135d94d16eb1cbcd45e5d1719398be

                            SHA512

                            c7f4d133ae5de9b74fcdaa32014f34042ce622ac238c1970886b51e83557dc09d62d6b80efa44405186bf6d9798062b602bdced52966db9b01dcbf57801b916b

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            fcc02dd7fbe1a7a7dd57da5f80a6187f

                            SHA1

                            e91a8e83e250a3e09f60df258f354ac1a336d82c

                            SHA256

                            c5ebbd7fff89408f281b45932b310d4a20a17d38e2c7ecf8d5085dd40085de38

                            SHA512

                            7f74ca3cea81c87bcf9b7f8c64a88dc6060f61d41bbbbeb20fd463984452de49465ac757a97efc6c4ec2b33e95ab62048426d7552e6c0ba1a8673667aefdf27a

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            bd6ff3e4ff43bb6c3aa67b4877dcecd2

                            SHA1

                            25ae47dfae17d78af85042924238ee455fc0e783

                            SHA256

                            36ab5b11c89ada3164430ebdc26582432f4d25f4fce86028371c9de8f7953447

                            SHA512

                            1e7935335de7ef284d5f92c48b7ab1939e7b3a58589f389b25a00a8e6c56f168f459be82ec83d37d72179bbc95e5fce98eededf2fa4097f62658882820a76876

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            1355b05f528655ec4277f4b97d87d844

                            SHA1

                            405c6092e223212a076a156a3adcf34c7efe22e3

                            SHA256

                            e799d51aa5348ae22949e4420b8f1e55ee92068ebe9a44d36d3f614b924732ee

                            SHA512

                            9411f910091c1671c50616788be29776f881f2ec25ee07a37e29c43b2747d34e039b2e900244459d790a6589434279262a0333014004a2396cc888be4143cbf9

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            dccab31687b0b007e59dc120fb5235d6

                            SHA1

                            a82c761fb98c925711a4b579a936a69b47501ecf

                            SHA256

                            0d4c9b69b76409dab298eeb4a46620c8a9c9dcb4b4ea60b1a83dd778138c3632

                            SHA512

                            91e9caea770aeba3264cb3208b8f58e48bf39e6f1965eb17122574585a610aafd1156acd91a6b1410af97a5d11427da4c13a15c54afd2caafad3dd1bcd6d27aa

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            6287cd96a0b93172dd6923f7232cf608

                            SHA1

                            ce38aa4180ab7e141ef8d5678166a2500db93a69

                            SHA256

                            4d904d7b69f254b30eb5b1a2278e154108a71bb1788f621ba5336b074753323a

                            SHA512

                            cbf166f622e1b10c44fc3202897551d315013ea0d7e9d9bbf5eba5d41a69907d52e411d31f55203314452da8fa3238b9dbde73a7698d67cb35873bc883b87155

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            186ab6a133d76bf3f1d7401611bc5fed

                            SHA1

                            05af2e4d33d41e4979431298151bf145df7414de

                            SHA256

                            6dbec5b615bafa8840f88ab2781128bbc05561d773e99b57448e0d7f302b3207

                            SHA512

                            37fd0ee40cbde32bf0a79312286d50382c6de03831d030321c841c8ece072c83e7a04d6eeafb47f8bc2fb21257867e4978b45d40985a08aa5dab0f56d5fd1f54

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            886463ae6cc567b521b08a2b0de7b239

                            SHA1

                            1f5d6ec13473aedcef7b9f730955e90515e4fa77

                            SHA256

                            9e245685f82a1aeeec7a800f70a8283d59184388657c5be60f2f93873d77b0e9

                            SHA512

                            105288438805a443e43f1a80f39e42a0d56974fe3234649f449ed26acd3518ce9ee6dae39c4fcb6ff0c8c678340732004c7772b55d98db5a795e08748eb68b8c

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            641a6295678d410697a1b473ee8ca443

                            SHA1

                            cd7a4f7c9b4f0905e12e5b3993e3d1fd5233dca1

                            SHA256

                            a93963d1c9ccd6712cc119b549c2aecb839decf529e9f5b9ab08680d37829690

                            SHA512

                            58210f454842efa98f4029493fb972d7d587c095b6211516ca8a2b8eaf62c87d6efca96e107bb4af15eaf6e89997c3d569645a48de920d3eb017ac20d48f04d4

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                            Filesize

                            9KB

                            MD5

                            b3a7bef70e11d3147c406c28a65e6a12

                            SHA1

                            8dac4d0c24f0c2bf1807d143375196580e0d2fbe

                            SHA256

                            148b9b2b5a2ab12bb8c4c8d176acc118b48b8500debe7261d5554c4303ad2533

                            SHA512

                            343eb2b57f295ad13385b68e0e914074559c87d4762690881c4b96e1466fa629d35be849fdba92daecfd77893eab6b6663b4d1bf2659b8afc24fd2a343fa2164

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            92KB

                            MD5

                            e2d9af9522403c1cd1e215f90888fe0e

                            SHA1

                            2b1d8e26777b198d329ebde04635e5cc32c4dfaf

                            SHA256

                            a042f1b76522a7c275aa87223e4aa567d2278eb89163530eff3f88620ae6f4a9

                            SHA512

                            b38e5e96baa64da6da892952c3e0c7c58313b759cc8f691584b7e89195b8c2a9520d4f23efd3ac0b926dc1522e05a9547f4ec753e7cdfc1db1d44571e4db872d

                          • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

                            Filesize

                            92KB

                            MD5

                            49a53b4820904c8080aafe2c95217f39

                            SHA1

                            21ff243bb84b28c1f08ec1cd776fad4e8dedd4a5

                            SHA256

                            b52fe550fa2f6a9993fe0f36cccf4a381a3c3cc6df7a78ac824572a27e4210f9

                            SHA512

                            e8c8369c4caaf05a9832ea2e44801777566f7ec11fd6f0280f85dbd41737bea1b40fae4a699b5a7a096fa3723b8c4a2a9c9c6923a7b4129ce139633493a9cae9