Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
21s -
max time network
21s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2023, 18:10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://wearedevs.net/d/Multiple%20Games
Resource
win10v2004-20230220-en
General
-
Target
https://wearedevs.net/d/Multiple%20Games
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
pid Process 1216 Multiple_ROBLOX.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133242450728054198" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4164 chrome.exe 4164 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe Token: SeShutdownPrivilege 4164 chrome.exe Token: SeCreatePagefilePrivilege 4164 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe 4164 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4164 wrote to memory of 3104 4164 chrome.exe 85 PID 4164 wrote to memory of 3104 4164 chrome.exe 85 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1256 4164 chrome.exe 86 PID 4164 wrote to memory of 1904 4164 chrome.exe 87 PID 4164 wrote to memory of 1904 4164 chrome.exe 87 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88 PID 4164 wrote to memory of 4788 4164 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://wearedevs.net/d/Multiple%20Games1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4164 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacebb9758,0x7ffacebb9768,0x7ffacebb97782⤵PID:3104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:22⤵PID:1256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:82⤵PID:1904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:82⤵PID:4788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:12⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3160 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:12⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4528 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:12⤵PID:3872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4712 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:12⤵PID:408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5304 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:82⤵PID:4340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5132 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:82⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5608 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:12⤵PID:2464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4740 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:12⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5444 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:12⤵PID:3404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5624 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:12⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:82⤵PID:1688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6140 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:82⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=6156 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:82⤵PID:4440
-
-
C:\Users\Admin\Downloads\Multiple_ROBLOX.exe"C:\Users\Admin\Downloads\Multiple_ROBLOX.exe"2⤵
- Executes dropped EXE
PID:1216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6320 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:82⤵PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 --field-trial-handle=1952,i,4771777312343472196,11062506479689778587,131072 /prefetch:82⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3772
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD529b6e3a5e2916546476435037222bbe3
SHA10111751800a8bf087e51a31ef07db7849b38698e
SHA2569a05ac1ec366497d70fb476cebfa54ac3e2d2eeafa1b7b4fe4903fab42c1e8c7
SHA5129b79995c4bc3079bc7ab4b61fa55da804483e072a9afcb28a6d5b143ec0915217917f4c84735401174a8a7e70b36db221eb9812c3fe1a06cef6c210ac3fe2d60
-
Filesize
4KB
MD5c123f167b905523da3c5f6017129c9ff
SHA17d734cfb195e34d4f6aba39c4a3743700b54b59a
SHA25610f655ebabc8387317af2fa9ea07db4ae3574f06d2d55eb4c01c631d4564442d
SHA512f51e56e850ac97fe8bc6151787b127240b4a583078fb5e746d27fdf93d869d786ff0374105823547efd9722f0ce0c446bbc801d35e51517533d22c7057ed1ddf
-
Filesize
144KB
MD5c7b6dc3b0fc742dfcfd4681ea43ae9f1
SHA16a7bbb6e31b3aea20af3bf0f522fc451b1b9a53b
SHA2567e427ad759991df51b5fa3e00e8aaffa0072c7801ff23762bd7bf77c3e635059
SHA5127465298f7480971efe763e15a918e789eb9ea0de865e5b1423e2a3c2fe94f11036a95ede063950ab1170d086aef86700035f173c91f7254214048c862d7356ee
-
Filesize
764KB
MD5aed655395747a6602479f6032d3c099f
SHA15fcbd5735ed0e4a013667652f4c1382abb45203a
SHA2563d6123dc6ffbd1a11d73229988203052809bd17617b24a034c1122c8f4983db4
SHA5121a3db9e195e9e504a0a6c24557f1e141f90a73a89a853b8ad3ab2248d8e3fd97ba1ae78b93ad33005590ef0a44c5237e608b66a9c9fffde39e4730c226d91637
-
Filesize
764KB
MD5aed655395747a6602479f6032d3c099f
SHA15fcbd5735ed0e4a013667652f4c1382abb45203a
SHA2563d6123dc6ffbd1a11d73229988203052809bd17617b24a034c1122c8f4983db4
SHA5121a3db9e195e9e504a0a6c24557f1e141f90a73a89a853b8ad3ab2248d8e3fd97ba1ae78b93ad33005590ef0a44c5237e608b66a9c9fffde39e4730c226d91637
-
Filesize
764KB
MD5aed655395747a6602479f6032d3c099f
SHA15fcbd5735ed0e4a013667652f4c1382abb45203a
SHA2563d6123dc6ffbd1a11d73229988203052809bd17617b24a034c1122c8f4983db4
SHA5121a3db9e195e9e504a0a6c24557f1e141f90a73a89a853b8ad3ab2248d8e3fd97ba1ae78b93ad33005590ef0a44c5237e608b66a9c9fffde39e4730c226d91637