Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
18/07/2023, 14:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://drhodon.com
Resource
win10-20230703-en
General
-
Target
http://drhodon.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133341655481557634" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3632 chrome.exe 3632 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3632 wrote to memory of 4160 3632 chrome.exe 69 PID 3632 wrote to memory of 4160 3632 chrome.exe 69 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 1184 3632 chrome.exe 73 PID 3632 wrote to memory of 2140 3632 chrome.exe 71 PID 3632 wrote to memory of 2140 3632 chrome.exe 71 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72 PID 3632 wrote to memory of 2248 3632 chrome.exe 72
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://drhodon.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa87469758,0x7ffa87469768,0x7ffa874697782⤵PID:4160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1784 --field-trial-handle=1852,i,5675090415475428307,17670232517214204302,131072 /prefetch:82⤵PID:2140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1852,i,5675090415475428307,17670232517214204302,131072 /prefetch:82⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1852,i,5675090415475428307,17670232517214204302,131072 /prefetch:22⤵PID:1184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2628 --field-trial-handle=1852,i,5675090415475428307,17670232517214204302,131072 /prefetch:12⤵PID:4988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2608 --field-trial-handle=1852,i,5675090415475428307,17670232517214204302,131072 /prefetch:12⤵PID:5024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4312 --field-trial-handle=1852,i,5675090415475428307,17670232517214204302,131072 /prefetch:12⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5012 --field-trial-handle=1852,i,5675090415475428307,17670232517214204302,131072 /prefetch:82⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4668 --field-trial-handle=1852,i,5675090415475428307,17670232517214204302,131072 /prefetch:82⤵PID:588
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2172
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
360B
MD54f17c5a394ac87b1de6232c228de5a08
SHA1a15de633fcee51a21711f3ea6b9ac3117fe65897
SHA256f49cebd0831bc3489cde4565beea70b7e4a709c47ec8e286e58d1fd7b2a1030f
SHA5129ccb0dd73cd3b613e333cb02da55e83f6a4a5cf85f93cbae5520230a1a6aca00a8353dcc512a5c136009f425570eb6c73840b450fa9f10cc643cf793c659fae9
-
Filesize
2KB
MD53e47b7e625d11a877c0d8e83bca169d9
SHA1923a81e8bd93b7f91c0d18962ca377748551ed63
SHA2564befd4dc1cb6208bcb927cdee8446d0f5c8f33bd2d3ce49b9741c874b4540c26
SHA512afd096cb8b90dd5be425df89ccfeb447204cd6bf1beb11f24e13a21e9d1e1e22672f7a799ca444958e39b2b9b945c3bd7ae39f4cdaa3f24f046bc8f1f162d100
-
Filesize
1KB
MD5a31d4b767fd5e3f560e0cd82e6a213f8
SHA15db5134b289cb4d5107aeb1ce9b7098a84cef112
SHA256cb2b7eceaa5389be76a429e47fadeb9c0eb19c1de50e74d7c465eb450d0ceaf5
SHA512d7664418182d24506530007ad30633f08eb909fb30150edbd40ca9f476c5b186f07cb931e8e6b75d0e21114bfffb77a23d6d422811f908a53a35da3eecd6e271
-
Filesize
1KB
MD5325f015611bfea1f6da3c7b8c4ce4e0e
SHA1b6d95e5b7ebd9e8a3605a74960f2e82661e4878a
SHA256c3d8aed0ab5104d9a43d029b23da5b72c3ad31bb87d7421612a405f04967b1ca
SHA512682df387e8d6bb31a5706466ca98ba29092a781d4b800d0cb7cf4753577d5fe3eb1718c7907ff574cd6845b74a13e3af1f9f4152616fbb1c3fb57e83fea24712
-
Filesize
537B
MD589ac398427a918f3c8cfd075b17aa656
SHA1eac7d7faeb74d1a12d011f8151a8c5e2c3be6a03
SHA2563cef02d7f756c47a0c85f738240c6a15c7c97f2b12713b691b1a27b6b72f925e
SHA51230386e9cc8921344e5e915b3ab348b3e2286165515cadf236eaf35c6821b5daedbf474e1b2479602d21997d28670c97fd5af1c9057f4a32f6e77d03cfb3657d0
-
Filesize
5KB
MD5b6718f9886103a11ea89956db636af2c
SHA1f393b61a524d5c6058c2058d3d95280d70bc53d6
SHA256cf490544ee86ce5d8f79c1aee5ef6822dff4b4caa6a371df1c1e085b636e5865
SHA51228e51d14a8ac3e500cd93e580cf4d48ae45e30d208771736a6ac22cc8aba44ba3fd6eeace8d86e462762aa78fbf7b8f7dec579e5d54f9fba290452a8e8985f68
-
Filesize
5KB
MD55092419c8a1a8098a6ff33b554b84ca8
SHA1e2681539726ad227c734649b40015243e3d9fd8c
SHA25670981c5931ddaa77f546a66bd5d9d30401c424b711d95f80243956370f18ef1e
SHA512b8aa72b4f01a9cfcd8315ac0e5a52e9c5b9288d35ec68f024eb71f5f7eb7f9cbc93f0e50a07b4cf520e4b1762a82185c63d8d1797ebcdbd0006441ad132180e5
-
Filesize
6KB
MD594e769917aabf6ce6d61e4c3ca417d1d
SHA155d1cd75c6fcff4023a149bdcba74709f09d0058
SHA2568004a1db4a40c34af3ec71fae9dadcca8aaa19e3123ab194c4823ae5b2d5e726
SHA5125841a0ee1239ef087e7618a69f1929b683c111abbb0553155ab95c13ac97ab0ebf3618c8edce42cc8f331ff7c87c001233264447ff297bb5dcbb50112c0fe298
-
Filesize
87KB
MD5b88b54ca4c8a85746bf069ad9cdbc441
SHA14e0ee45d76111df28443f30cf9daf607fc61d927
SHA2566c81bac966801eef26177dbf6b821cb2f707eb57a395a0cdc30d94eb5cd8ff2a
SHA512d6f79ca0147511f982f4129d0853044cdad7f940f8b6bbce08b8f7745647296b0601b1ca30bf12eac966fb8c2d8e0300dca9aeb8e523497f422ed87967f5620e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd