Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
04/09/2023, 12:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://girisimyolu.com
Resource
win10v2004-20230831-en
General
-
Target
http://girisimyolu.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133383041749194485" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2876 chrome.exe 2876 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe Token: SeShutdownPrivilege 2876 chrome.exe Token: SeCreatePagefilePrivilege 2876 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe 2876 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2876 wrote to memory of 3848 2876 chrome.exe 40 PID 2876 wrote to memory of 3848 2876 chrome.exe 40 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 3196 2876 chrome.exe 89 PID 2876 wrote to memory of 1744 2876 chrome.exe 90 PID 2876 wrote to memory of 1744 2876 chrome.exe 90 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91 PID 2876 wrote to memory of 560 2876 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://girisimyolu.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2876 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff137b9758,0x7fff137b9768,0x7fff137b97782⤵PID:3848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1776,i,9000045559044754751,10977987155361418469,131072 /prefetch:22⤵PID:3196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2008 --field-trial-handle=1776,i,9000045559044754751,10977987155361418469,131072 /prefetch:82⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1776,i,9000045559044754751,10977987155361418469,131072 /prefetch:82⤵PID:560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1776,i,9000045559044754751,10977987155361418469,131072 /prefetch:12⤵PID:1204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1776,i,9000045559044754751,10977987155361418469,131072 /prefetch:12⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3956 --field-trial-handle=1776,i,9000045559044754751,10977987155361418469,131072 /prefetch:12⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3688 --field-trial-handle=1776,i,9000045559044754751,10977987155361418469,131072 /prefetch:12⤵PID:880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4488 --field-trial-handle=1776,i,9000045559044754751,10977987155361418469,131072 /prefetch:82⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 --field-trial-handle=1776,i,9000045559044754751,10977987155361418469,131072 /prefetch:82⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4508 --field-trial-handle=1776,i,9000045559044754751,10977987155361418469,131072 /prefetch:12⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4284 --field-trial-handle=1776,i,9000045559044754751,10977987155361418469,131072 /prefetch:12⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4504 --field-trial-handle=1776,i,9000045559044754751,10977987155361418469,131072 /prefetch:12⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1736
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5c618b5cfe1c5a6eba01486c3914703cb
SHA1b5708db21143e9d62134fa1fdd9f0df5621945c2
SHA256c1a3c42375497e2bbbc7c3c8df72a5c7145b0c8426fc8724c1b891fde6dbcf63
SHA5120f9dea17e60f012b95fae97f7a8054f17fafb1e3e28e6526a24c3c8e675ba253784b48fd6087f7123cda9fdc4b54399bc9f45fdd2ca5f0720a5dc52335974120
-
Filesize
5KB
MD59f1811d40f6db017827414ec52f6a676
SHA1b25578f65575e1b88df08c80cb49bb51c739fdb9
SHA2567eb8cb0750b5d489ec5df74340799018a53458413c94419f02bb72e7e8e6c0a5
SHA512ee21568a7df2f01d90c0d4b1ab6042996aee2575bf33eca96d428ebc7c50c7937681b6e3e51ba66542f765af5e3402a3652d9cbda7f9f9d0408533c14f4ad81e
-
Filesize
97KB
MD57d6c11612a129a38addd06b21be37a6a
SHA11d2e3eb57b015a9af49dad9da65d0de6f6300e08
SHA256b9880263ef8be7cf981bf718d974954f371325555340a4ab71fe36714a7a7629
SHA5128f627810e1659c9180ab6c8fe3a9220f250b90539f5a659ff94643f8a3493ac4fba4abc8990a615f57d5861e0ff0b87b168e23ed72ec3a235cf94726d3ea9a11
-
Filesize
97KB
MD5f67c9d12c113ca059767c13d27984198
SHA1c4feea9d2b05f2db904ba7839250b54aa3d6efa1
SHA2569a799fb5a57ecde9b18d4c25d70dac535992cf3f91eecf40ff78e825f704ed15
SHA5125c971fc610a53f02e5b597497c95dd5799827592b6fb0ce64a937d16b48d2fb0fe799fd686faaa3d85c1bf2886fa829374edfe35eeef61580ff6aa7ca5ac3239
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd