Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
84s -
max time network
88s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2023, 13:10
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://kemono.party/patreon/user/34750725/post/36835375
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
https://kemono.party/patreon/user/34750725/post/36835375
Resource
win10-20230703-en
Behavioral task
behavioral3
Sample
https://kemono.party/patreon/user/34750725/post/36835375
Resource
win10v2004-20230703-en
General
-
Target
https://kemono.party/patreon/user/34750725/post/36835375
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2216 chrome.exe 2216 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe Token: SeShutdownPrivilege 2216 chrome.exe Token: SeCreatePagefilePrivilege 2216 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe 2216 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2216 wrote to memory of 440 2216 chrome.exe 79 PID 2216 wrote to memory of 440 2216 chrome.exe 79 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 3060 2216 chrome.exe 81 PID 2216 wrote to memory of 2088 2216 chrome.exe 82 PID 2216 wrote to memory of 2088 2216 chrome.exe 82 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83 PID 2216 wrote to memory of 2688 2216 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://kemono.party/patreon/user/34750725/post/368353751⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee7b49758,0x7ffee7b49768,0x7ffee7b497782⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1828,i,1632314413110162212,10685802127823861115,131072 /prefetch:22⤵PID:3060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1828,i,1632314413110162212,10685802127823861115,131072 /prefetch:82⤵PID:2088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1828,i,1632314413110162212,10685802127823861115,131072 /prefetch:82⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1828,i,1632314413110162212,10685802127823861115,131072 /prefetch:12⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1828,i,1632314413110162212,10685802127823861115,131072 /prefetch:12⤵PID:3364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4872 --field-trial-handle=1828,i,1632314413110162212,10685802127823861115,131072 /prefetch:12⤵PID:2952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5352 --field-trial-handle=1828,i,1632314413110162212,10685802127823861115,131072 /prefetch:82⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5900 --field-trial-handle=1828,i,1632314413110162212,10685802127823861115,131072 /prefetch:82⤵PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5992 --field-trial-handle=1828,i,1632314413110162212,10685802127823861115,131072 /prefetch:82⤵PID:4744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5632 --field-trial-handle=1828,i,1632314413110162212,10685802127823861115,131072 /prefetch:12⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2876 --field-trial-handle=1828,i,1632314413110162212,10685802127823861115,131072 /prefetch:12⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5044
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x3e0 0x4c41⤵PID:1072
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
576B
MD599f94d5710e6ca1d35e407dd4c790cf8
SHA1a63a034dfae61f0092a1a77e37519b0e50431d01
SHA2569e833978ee0cae20e958b0cae8fb2cd91ba4e5afcb9aebc872bcd670208a3d70
SHA512eac68d47237d6f6f1c0373bc346f14bc87ca367d32f7520bb2e0fd6d975e9150f5833c19b697e3946d35c8864e8025282ee7d1b07718b8bf265e7547da89de2a
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
4KB
MD5b33b5a3f9eaba1557ff99604af8d7f51
SHA12cac8242adb2a43355361218c8618efc6f621843
SHA256d850737be58de8a35ccbafad5a90c74b12fe7e4dd132ea4bc49509a4874f1706
SHA5124e35b036f3c4d734399fd3aa641a73e67876147e34a4ebd76ecac0bcb057875f1da8bff4bcdb438f4c92a75b1ef3278a6538fac70b1439c354709d62f566c609
-
Filesize
1KB
MD5bd1b3ee332d68b0d1b45f501f5e8122a
SHA18c26584210fe1e1c3544247f41c4bf8d331085de
SHA2565ffe2b5d2c6dcc36aa789011fa059ab9bc4685119507b4650fe3dfc86f9f2f98
SHA512ac0600d6cd2390463e03bd37eeb2a8cf0976c32926a67706f49da0bfcee0ec8a9985a1fe455f5f89ce0bafbc961b5f74e6bc9a8312a67486b73f3ea3ccf87309
-
Filesize
1KB
MD52326a38cc6465824fefba4de6289e6d5
SHA19c338fc1ebea8509fbe91a816ce1351389d8c42b
SHA256c73c5668f86c05d80d07c5beea9be30aeb3623d0681eedfe1d3db61b9cd02642
SHA51243179bbf4267fcc131681a4aa291df1f7e61db19b95bab107833d0136e2c4a7a73551c728ddad061ccc7c350f21723351a89a820cdc27c96c4eb4d435f4f4efe
-
Filesize
5KB
MD5e4c854c497f2d495e2cd09684d1c99ab
SHA104b8c2ea159a389766566a32f8c4dfbbdc1ffcaf
SHA256206a431e27a80c59c9ec1e115854a5df49cc67f842ba6d6f4aa8ca95b6441116
SHA5121c896d96672fc2be29897665053c630f110ee5dcab93bdf97c033feb2e56ea024c68b8b5ff3677a81d3965c19de3db5e56a6318abc8e2d3c2feb00779203545b
-
Filesize
5KB
MD54724867d0b0b9436c58dbda9af02b91b
SHA1d15bfb54d721d9aac3e30b3586360eef0ad4ddd0
SHA25646ac066ff98df7db122b9aebe7de2deb59ab36c9ecd1fd957f523ced2e5a6935
SHA51231e38c489b6691bc1e3c0f5bf85d98564e00fd16b9c9613d96d9b862b1cd4355daaf7856172014a8546b0bc523af5a01bd8f8ee26284eb7993809e2925de5240
-
Filesize
6KB
MD5ec667e3cecc6facdf8942a461c742037
SHA117a31a36595c93a2d63236b7975319ebd71a0851
SHA25634f103249d98786b2e0aded7c8193ccc5d5992cf5269c3a525e16e7ee2842e2d
SHA512744709a627ed2b8239f458fa66f98e62d49aed5363dd9fc9d331a36382f823a7ac28b69477a65e47dc8723112c299c9c12a0aa98d25d1a8912e27ee5bc3db87b
-
Filesize
87KB
MD5355eed89869a0514446f0679b6a6acd8
SHA13d4304890888df132284d8d4dac88afcc1709b91
SHA2565515861aa43e485c5e18f2f3288bd2cfd2e6fb6643c77f8e09d4dc8773f4db49
SHA51278567fd21bee1d6c4a778c8381b884220fe7488ef7d5f2322b969cf7a2bf3134f6f8c5d77a592fca755b04253f80c789d22dd8f4786f349065884018b5c2d5f9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd