Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
18s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
18/07/2023, 19:43
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://serrated-lore-6d80fe665c89.herokuapp.com/+?y=49ii4eh26oq62p1oc4oj6d1m64p3gd1g60o32p1k6dh64oh2
Resource
win10-20230703-en
General
-
Target
https://serrated-lore-6d80fe665c89.herokuapp.com/+?y=49ii4eh26oq62p1oc4oj6d1m64p3gd1g60o32p1k6dh64oh2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133341830235956769" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4696 chrome.exe 4696 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe Token: SeShutdownPrivilege 4696 chrome.exe Token: SeCreatePagefilePrivilege 4696 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe 4696 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4696 wrote to memory of 4892 4696 chrome.exe 70 PID 4696 wrote to memory of 4892 4696 chrome.exe 70 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 1396 4696 chrome.exe 76 PID 4696 wrote to memory of 4812 4696 chrome.exe 72 PID 4696 wrote to memory of 4812 4696 chrome.exe 72 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75 PID 4696 wrote to memory of 2336 4696 chrome.exe 75
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://serrated-lore-6d80fe665c89.herokuapp.com/+?y=49ii4eh26oq62p1oc4oj6d1m64p3gd1g60o32p1k6dh64oh21⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffab4af9758,0x7ffab4af9768,0x7ffab4af97782⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1868,i,13465125145967594731,6966149706472115354,131072 /prefetch:82⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2664 --field-trial-handle=1868,i,13465125145967594731,6966149706472115354,131072 /prefetch:12⤵PID:524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1868,i,13465125145967594731,6966149706472115354,131072 /prefetch:12⤵PID:1400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1868,i,13465125145967594731,6966149706472115354,131072 /prefetch:82⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1596 --field-trial-handle=1868,i,13465125145967594731,6966149706472115354,131072 /prefetch:22⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4468 --field-trial-handle=1868,i,13465125145967594731,6966149706472115354,131072 /prefetch:12⤵PID:356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1868,i,13465125145967594731,6966149706472115354,131072 /prefetch:82⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1868,i,13465125145967594731,6966149706472115354,131072 /prefetch:82⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:428
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
539B
MD5227c2ad0d3f32417dadcdbd3732561da
SHA122563836f216416c55c13bce63b566c5adf3b372
SHA25636e9e6a0f955cf901d26028ba115b07ba6365574f2fb8557b7ceda9963255bdd
SHA5128275739c98780c1b15b8ba91e5a964e4bed6f022d4dfbb988033abd6db9038111b2a998f1a1e983c7c71bcf37b92c66b08f6151cdd1e9425333f3fb1826604ad
-
Filesize
5KB
MD5f1bfebe3b7b14901cbdd5e0e1c4b75ae
SHA173b7e2377248a7cc13a5a1a5dfce18cdbf7358a9
SHA2566c171fa41397cd28609cef03416112de7680e7ed0646101f334a68d7c40d6b09
SHA5125c04e89f4b1fd7bf1c45dcba4b14ca1b74715f7309f75148490de19fe89ed6597db63d0322d196d589757be69354131474163bc1ef4bb7401f42a884cbe9c6c7
-
Filesize
87KB
MD50393842b8a949e418a5f8a644869fc1f
SHA1165f2b07b1df0883d384ee61a219153ada7dd902
SHA25646e2323a7fda4611cbf6a0bf8e571c95a3f23e5f720c30367a8f8d5f1221739b
SHA5128d61a65a66788cde8c5a0baa06f1f1318d2d657d0d3b4ac60034fe385d936e1d483f73f968451140484f4eb34063993a24a74377023c49f4ce077d5478f4c41d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd