Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1690s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2023, 22:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://therailsbyronbay.com
Resource
win10v2004-20230703-en
General
-
Target
http://therailsbyronbay.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133344538833943277" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 968 chrome.exe 968 chrome.exe 3888 chrome.exe 3888 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 968 chrome.exe 968 chrome.exe 968 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe Token: SeShutdownPrivilege 968 chrome.exe Token: SeCreatePagefilePrivilege 968 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe 968 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 968 wrote to memory of 1612 968 chrome.exe 60 PID 968 wrote to memory of 1612 968 chrome.exe 60 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 4200 968 chrome.exe 87 PID 968 wrote to memory of 2760 968 chrome.exe 88 PID 968 wrote to memory of 2760 968 chrome.exe 88 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89 PID 968 wrote to memory of 4592 968 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://therailsbyronbay.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc7f199758,0x7ffc7f199768,0x7ffc7f1997782⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1832,i,15856992287483857820,9075570658620115185,131072 /prefetch:22⤵PID:4200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2044 --field-trial-handle=1832,i,15856992287483857820,9075570658620115185,131072 /prefetch:82⤵PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1832,i,15856992287483857820,9075570658620115185,131072 /prefetch:82⤵PID:4592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2824 --field-trial-handle=1832,i,15856992287483857820,9075570658620115185,131072 /prefetch:12⤵PID:1924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2828 --field-trial-handle=1832,i,15856992287483857820,9075570658620115185,131072 /prefetch:12⤵PID:1940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1832,i,15856992287483857820,9075570658620115185,131072 /prefetch:82⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4592 --field-trial-handle=1832,i,15856992287483857820,9075570658620115185,131072 /prefetch:82⤵PID:2328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4820 --field-trial-handle=1832,i,15856992287483857820,9075570658620115185,131072 /prefetch:12⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2672 --field-trial-handle=1832,i,15856992287483857820,9075570658620115185,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3888
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1524
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
840B
MD5c470c0e569480df1d426fd54caf245fc
SHA13fdc765d2b895a4e879d658feb83969b20816b0a
SHA2564541a2c3da7e6ee4f8fdd6b96f7ae0543ba13b222fdcedae6aac4dbe5a64e497
SHA5127bd84ec681275181df3f528d23e973d2c6ecd90d37e4646da65e7ad868aba2005267feaf1d16b1bc50d45a1f0334f809a4b02de8eebfd8590442b5890e85cb18
-
Filesize
1KB
MD52fbd14ecf41064bb059ba2acd4e2c8d1
SHA1c081b89e0139ac1effa42e43ac13ba3e97480417
SHA25618232f92d58d3fc14e492157a6a3752f0ae65edacb8aba0684d1c3e5c722799d
SHA512f2b55e32f8e6b14ee60075f69b48a9a6aaec9d37ec7f0e3891ae992843f143f0103a73f4ae69c6731c1b90b44df4edd7fa1f8e70cdccdfbba8edc9088f30fd86
-
Filesize
2KB
MD517ef3f1292a01908fdbe3b70498979ac
SHA184e57aaf140c03a7abbbf6c6c073b960287a96b2
SHA256bdb2d19fb68097b3a10831740dee1fe837a7466d50decb7d98890acdc4738730
SHA512a9e11c8cdae3a5d0102be262df68821b7525e768862e11facf3211925a03b6b01dc04b69f9ace80bd6d171f85c346ababac702f7937f96d09089fb925bcbf9e5
-
Filesize
3KB
MD50376e6e31215f4614692d1805af7fc96
SHA153c1f281cb8966fca0a41e25d5ff5bc69880aeb4
SHA256421fe06f0b9a4c01e3c04337733c2b5c936956f7c673a300c41355edd256af1e
SHA512d0e07bfebb78e58f9c6d8a24dbca7415780c99b45b580bb940b462bf096788292e1df07fb8ae27819ae3fc1194a12a6f09ce48800816a1bfb51b16d10d2179f9
-
Filesize
2KB
MD59c1907deb854777cde27028d714d8dda
SHA1e856442a5713627eb38481f526c6a0c25db8040d
SHA256c934cdfbef9624d8c60fea1f5708db9775adf8207781cd5a0030d6ac1655c041
SHA512722377411c8d955ab7f8c5fa8cd50ceca39d40863285a339a6c9d027ef5efe5666fe2ac4700ab30e40db08038e6a1b2e0513a0f44530635db2a19296487332e1
-
Filesize
539B
MD55b01550deafce027ba328c5bec1d6000
SHA1ff55eac4d4249c4296eac75bd1cf63b7873a0017
SHA2562f28df372cc96e823c157ae98772894629a132976199df85a6985ff5795378d6
SHA512a429e5c60fd9df339c516df9582a97296f2bae366c050cc87d636533d8c2a337d530f222596231fac4cc772b39817ca863d2254a5c3455e0a93e0424e74bde0e
-
Filesize
539B
MD5fea46e5191a7f8831cbc034f419e03cd
SHA152cf5823341c41143c7c989a0d9b0ded93200691
SHA256396b1c6841a51edbf951203e51293103abc1156f35045728d42e81917edeb0f2
SHA5122575ca6fe10b1d01ee6dedad680dbc90a6a6a147313294df57f6589009032296e7d324b6c06813eb43ae4f11d8a65d19b139d75f90867518c78ea8daad635749
-
Filesize
6KB
MD56b775e26714c6035a149a6b93899f907
SHA1f6c47b27e0cdd35c9d876a4d065509c51237944e
SHA256d577142e33c5ff99243a46d788f5e2184b0af20626c3da218a382396657ac16c
SHA512f9e409cbe02244b812e25d7a504da030f5c2c6ca52c62bc62ddc173dcae6d6d6a3fa5a93b601b3880a2f70fb698983d2c012510cc8d18a2fb93feb5830ba9b53
-
Filesize
87KB
MD570b230e74796080890a623ff47c05020
SHA1cfd0394a4ff1d8dff1419215bc1b0143b8dd6277
SHA2561b99212275f38f672f01bde9ed9e31074eaa21edf0baf443e36be9f454157b15
SHA51241453081cfb75726da816ef742f92892e775171f6b1a1aed1ed9219f77a50c88e5a9ed663de6f8e554f22338402d4306f42c1a627e86a0220231709310488e9f
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd