Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
31/08/2023, 05:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://faustas.com.au/a/Internode.html
Resource
win10v2004-20230703-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
https://faustas.com.au/a/Internode.html
Score
10/10
Malware Config
Signatures
-
Detected phishing page
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133379351301219431" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 2892 4796 chrome.exe 82 PID 4796 wrote to memory of 2892 4796 chrome.exe 82 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 3932 4796 chrome.exe 84 PID 4796 wrote to memory of 2180 4796 chrome.exe 85 PID 4796 wrote to memory of 2180 4796 chrome.exe 85 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86 PID 4796 wrote to memory of 3260 4796 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://faustas.com.au/a/Internode.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8d7a9758,0x7ffd8d7a9768,0x7ffd8d7a97782⤵PID:2892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1852,i,11048169864507761661,1810914059539870722,131072 /prefetch:22⤵PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1852,i,11048169864507761661,1810914059539870722,131072 /prefetch:82⤵PID:2180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1852,i,11048169864507761661,1810914059539870722,131072 /prefetch:82⤵PID:3260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1852,i,11048169864507761661,1810914059539870722,131072 /prefetch:12⤵PID:2376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2848 --field-trial-handle=1852,i,11048169864507761661,1810914059539870722,131072 /prefetch:12⤵PID:1492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4944 --field-trial-handle=1852,i,11048169864507761661,1810914059539870722,131072 /prefetch:12⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1852,i,11048169864507761661,1810914059539870722,131072 /prefetch:82⤵PID:2496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 --field-trial-handle=1852,i,11048169864507761661,1810914059539870722,131072 /prefetch:82⤵PID:364
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD5940f760b87d21ce659583aa5a970df5e
SHA159aeeb4c9b80f28154c814d85251e35aa14d1750
SHA256e8c6502087e05037ab1e52eef6cea36e99d546ca951db50fe8efb4b106a904e7
SHA51271a7e57817cc8de06dcdf81a22eab8566aa486c0b921ea244fbf2fca1d94725bbdaa5fcbd9717c331eff761c6044d48d6cb4e42c99a275941a71364286850855
-
Filesize
705B
MD569e56a5734f34cdcae1d911749b63b25
SHA19184b32bd4772f98d2400a9a16fc676c6be202a0
SHA256e39552d4d55e07c8444b9ac54f6243d1116a5d949be0d9e15c9d5cb5bc539d9e
SHA5120c710cc003060fe1439c591721d32e5f7a95788200916a8b58769edafe422c2a62910e6f78e77d6af38aa36ad1d13eab5e38fe50bda27292f418bbece145a44e
-
Filesize
6KB
MD57f8aff83d8da186822dbd2083def74f3
SHA1c3d2f9c8f5fd306fdfc2a32fc867122f183a6ffe
SHA256141f38750b66269d51de2509078a4dfc9f90a3573d9ac44ef5c6cd45b66426e2
SHA512e2ee01d8fb56978bd1c9ae75efb18e76fc3a568edeb3a5d3e0c668709d9b8fcbf7c81eb73db6103db57e15abdc2879018db48f74cab37a5bb7a8392adf35b3cc
-
Filesize
87KB
MD5e7ca4af961b3ea63c2db327bdbf57c1c
SHA15161dbf46f3fe1c9ed0571955d3e93c89893398c
SHA2569791a36ad47975d2e57ced410b7927fd0765837ecc0c907d30838e016e76c5d5
SHA5124322367777fedd9face30cebe6c7473a56498198f283d9b1024841ce9ff631a82080207ebf1b44177696dbd9489f0a5d26f5cb1fd68b971f55905402f7a52d7b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd