Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
600s -
max time network
491s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
17/07/2023, 20:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://fivesecretwords1.com/n64/7t1/mckhjud7ld9
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
https://fivesecretwords1.com/n64/7t1/mckhjud7ld9
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133340992397624989" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3060 chrome.exe 3060 chrome.exe 4376 chrome.exe 4376 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe Token: SeShutdownPrivilege 3060 chrome.exe Token: SeCreatePagefilePrivilege 3060 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe 3060 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3060 wrote to memory of 2088 3060 chrome.exe 32 PID 3060 wrote to memory of 2088 3060 chrome.exe 32 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 660 3060 chrome.exe 85 PID 3060 wrote to memory of 4352 3060 chrome.exe 86 PID 3060 wrote to memory of 4352 3060 chrome.exe 86 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87 PID 3060 wrote to memory of 3132 3060 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://fivesecretwords1.com/n64/7t1/mckhjud7ld91⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffee3179758,0x7ffee3179768,0x7ffee31797782⤵PID:2088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1888,i,15658886101212544795,10075228244750812631,131072 /prefetch:22⤵PID:660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1888,i,15658886101212544795,10075228244750812631,131072 /prefetch:82⤵PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1888,i,15658886101212544795,10075228244750812631,131072 /prefetch:82⤵PID:3132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1888,i,15658886101212544795,10075228244750812631,131072 /prefetch:12⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3040 --field-trial-handle=1888,i,15658886101212544795,10075228244750812631,131072 /prefetch:12⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4856 --field-trial-handle=1888,i,15658886101212544795,10075228244750812631,131072 /prefetch:12⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 --field-trial-handle=1888,i,15658886101212544795,10075228244750812631,131072 /prefetch:82⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1888,i,15658886101212544795,10075228244750812631,131072 /prefetch:82⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4668 --field-trial-handle=1888,i,15658886101212544795,10075228244750812631,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4376
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3488
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5786a6206bc6abeff1f0a34f11116d911
SHA1c928de2b1c4e89027dd10a9afa0ddcc4729632f5
SHA256d143e6e56bed6a7bdb029ef726cfb10dd2a5295a3eeb5e83939d8a0a93737572
SHA51247c4ac19baa947f548497eda02c8f9bbfd7037239f6fe1d11759591a3890e23bbd48774ff6b84daa74165b743631cfbc9121b3ef87cf3e437d4c762b2a8c5728
-
Filesize
6KB
MD59fb00cf59646a101bb7efd4b1f985daa
SHA1f10428faf4bb3b8d304e8b32ab53b5e471ca25e5
SHA2564e52fa5e0f7cd23516f920317ae4a73ae80d97936cb6ee478fdb358ee0861c93
SHA5126a9167fbe489778e49b47f05a5e9e796b5c997354acec02d1ede9a8f99f35e21446ef00d224da1edba744a5c0c590d77444f7c5e0b4ba3d6dcffefc748325fe4
-
Filesize
6KB
MD5676eb5625a727e071ff439aed880af12
SHA12d2808da81322a762253c46cb7f3117b722363a1
SHA2564b976ecfc5c8aecc074cdface0ef4cd3233716cda9192702ef8bc40963dcea44
SHA512d807501c415918322c2ad4df1b52b3e2d29b9c0f491c364aeb6b492edcf846d2b34f6a0b7ad5e75e03ba354dd73eeca9463a3ff0e4f8337dd3ad26d257152fca
-
Filesize
87KB
MD5850c319d4d90e0383c3729e228c34b0e
SHA19078ff4252713dc00a397bbb50bd9f4861e80817
SHA256ae15c38e96b77cb0ab3d5b03d6b2e63f4d792c6aea8ec19ac23154cd31e766e2
SHA512a305139c68d99dc8e9e9bfc651096f424b6bb28b8833233a9b31a6b992ebbed0a7ec3a86fa20303b6d2a34533360594b4c51ef90b0f947c8fca50e6129de76e9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd