Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29/05/2023, 04:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/yntd/
Resource
win10v2004-20230220-en
General
-
Target
https://github.com/yntd/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133298169836819358" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4260 chrome.exe 4260 chrome.exe 2484 chrome.exe 2484 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4260 chrome.exe 4260 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4260 wrote to memory of 3788 4260 chrome.exe 84 PID 4260 wrote to memory of 3788 4260 chrome.exe 84 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 1496 4260 chrome.exe 86 PID 4260 wrote to memory of 4512 4260 chrome.exe 87 PID 4260 wrote to memory of 4512 4260 chrome.exe 87 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88 PID 4260 wrote to memory of 4464 4260 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://github.com/yntd/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff987469758,0x7ff987469768,0x7ff9874697782⤵PID:3788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:22⤵PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:82⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:82⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3200 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:12⤵PID:2548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3208 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:12⤵PID:980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4968 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:82⤵PID:2732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:82⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:82⤵PID:3300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=920 --field-trial-handle=1800,i,17111060560299786663,8725344243096123807,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2484
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5028
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d5233155ac0208de143543028ecf1977
SHA17afe2ad2d85428a20fc3382e0ed80327f2cf2911
SHA256d3bfd3d338cd190297b8d10c1f9076d03e045c74fa96a726ce43ed7618d0d852
SHA512ee8beb216a94c20e48264f1f9db955a9e67f5b2f127bd25d8ddcd7bab8cb5a5684c770f5276ea966e228ce62316ab8c8e94febdade63959badae076de17c3410
-
Filesize
888B
MD5a27c4927b7d645ed7f2785e20a7b5087
SHA165aadf8f07f28c98086a9a6180fd874848515cce
SHA25600dc63579316e2da07879489025735bfb236bed2b0b017df99cbb651f2a2d0ba
SHA512ac2c19c4a7ea65fa353b8a869430906a6b7447cbfdbfa210eb0667ee23bb3fc93a06ffd929b8d1df8208c6ba8cb5c7b1790c271f5b387cc030cecb8284ac7312
-
Filesize
1KB
MD518a26076cc59d8cc840518970d159a4c
SHA1a494e782e876d70635b938ac7f37caa2e6023fff
SHA256c8876660174c5db1fde2a01528d9b7002c858189cfae67b42ace4f7039bd2caa
SHA512216b05394c56d4239b2765810eee6af17e43a264c7603f924bf5791631826f6f9f11452f506293a12d363af3ee322c992e36ffaddc809dc2552843f2f7dd31cc
-
Filesize
1KB
MD509d5e2499a687e4e5dabf62f44b4de0d
SHA1ba39cab77eb90c3213f2f4fa52fceddd9735ea1c
SHA256bfa63e1830bbc9b874ce498e7127cada3f80c199d488b98a1bea8d13368138b2
SHA512941617491d8cb23abc27cd5769f37e426bffb31f60dbeb22b2374993b1fee7674ce3c1e5924a8e202875afe1457fe771c158aab257d490e5b35e2e8fcaaab4e1
-
Filesize
1KB
MD5bddbab06071557b68f00a0feeac18756
SHA1665e4ad72fd15827c3ed220c38e6b527b4ee52cc
SHA25644ae290733e92ac464ed1a2be6f3f8c4a34f60e9816850690cf9b52377f4b17a
SHA51200e8a5009f73a6d85080103fc14107234b161f2cc0ee7cfa31ad8119004682c775a054ca981302f8be68cc2b313d53e8879ea09ddc9b99674bba42c68c58af8f
-
Filesize
6KB
MD51c95979c2334f0a866748c5f74a1c360
SHA14edbcd285dbb082a35a8fa0172b1a7c031aa40b4
SHA256a371626b77addc9edb783595a955685bacc4e4a912a2fc7930a6adec3b0346d1
SHA51286f24c5937d4cefcdc2323d3f0b13732476072532945a267d7948230c3b818e7c82f4177e77b5ebfab603acd0a31e87c09d16c378d4e6c0b71362ab531ee0843
-
Filesize
6KB
MD5c78cdfb371de13696d0387a3ec7727c1
SHA12573de060617a90e79b020e860e96be19ca5063b
SHA256607838946b0f3d55403c262234c82f23c787fdc30fbd0e9b0c698c70d0125c50
SHA512f5084b262b26d80da039103861d0106bd264eb713b9b1803caa253cdcd7cb2d38423764e222f4a1024fb4c6bf065013db378c04be363dbf8bc461fc4ffa931c0
-
Filesize
15KB
MD58dcc79f95a2e38180aa10d24ff994a51
SHA138fe0e07a931f5f75b21305b0fc658848c252568
SHA2566233596d890e7104390489c5f0889c36243d872d0ccf1c36851659443de30443
SHA51212f1bfc32d74ca9ffcd2b46e741a24aec312cf1d21d6c72807f0c2bddb01a6833e6c77394d788ac9bfc25a74ae73e115909549447827fc34c44eb0f7e5f53b38
-
Filesize
154KB
MD5c765c53485e15b3ea8db86deb5961c08
SHA1113ff1195c6e4e46b4f7560cc5dd6e091b6d3415
SHA256bc2572e10cf83d2a99090affef5a9a0ebc9ad9edfefde2a43ed396db9d8be8c8
SHA51268d2068c2d7957bfedc41294ce118d0455c2379dd5a2ff8bdb3167e814a7e3d4e16e9ecf7757cfd8c4c201bbec730123e2d37a5b58f6b67864c3ceae77b10041
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd