Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
18/09/2023, 03:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://mobilyfiber.net
Resource
win10v2004-20230915-en
General
-
Target
http://mobilyfiber.net
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133394829939930399" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe 3836 chrome.exe 3836 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe Token: SeShutdownPrivilege 4492 chrome.exe Token: SeCreatePagefilePrivilege 4492 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe 4492 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4492 wrote to memory of 4408 4492 chrome.exe 56 PID 4492 wrote to memory of 4408 4492 chrome.exe 56 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 4540 4492 chrome.exe 86 PID 4492 wrote to memory of 2504 4492 chrome.exe 87 PID 4492 wrote to memory of 2504 4492 chrome.exe 87 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88 PID 4492 wrote to memory of 4584 4492 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mobilyfiber.net1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa2fbc9758,0x7ffa2fbc9768,0x7ffa2fbc97782⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:22⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:82⤵PID:2504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:82⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:12⤵PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:12⤵PID:3892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4064 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:12⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3304 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:12⤵PID:3608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:82⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:82⤵PID:1188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3076 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:12⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2200 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:12⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3480 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:12⤵PID:736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 --field-trial-handle=1848,i,4725713245117367680,7161996055794135230,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3836
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1516
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD55646944656918649e295d5ade233ca0b
SHA10b4e9c73d5f50fe49c15b050bbf092a2184ddb3d
SHA2561c06dad095f8a554ec970b70822cd591fa0815128ce1c20a542174505fe21fc9
SHA5128f7afd4aa0c05e410e2ba761f638a82b37bae0e8f8c160569ffbd293235c6c38ef67a7226bae38a714837271d3319d796a7421e7ba166ce615868d6ffa26852a
-
Filesize
6KB
MD5c7d12ce7141a537a13e991ab50407260
SHA147baf731615c6a3ed2905b08e6833709395c6119
SHA2566fe85ef6291a8fa2c873fe1692cc980754777717b9c32b8bc4ee324ee7902437
SHA51232907560a22b673b40a9114a62975902fed1037ced570826651db6b898e791fb6ab693512a4a102f825c2293acf1d5cdc1b22fa66a43bf83f0219a9705765b4c
-
Filesize
6KB
MD57d5e8089cea960178158562fcaae8457
SHA161fdde3e36d4d2efe403207c9902b6ddd5362de2
SHA256ac591ae4c0e704ac6539954a1be071f4dc3c96e2997afc9e331efb4877b93eba
SHA5128995aa46806bbc455bd53edd3b1c4a5b5fee19bb5a8c50bf88d53ee4989f79c2098bf79ab0683bf005079a1fbb4c33eb0a222602a5fc94efd68aebb51472ca38
-
Filesize
102KB
MD5f70e51df33c60c5b61de61a67e9a9d14
SHA117c5077c15efae974c8280451f7a55d6af6fcacf
SHA256638e2dce855673459b9bf190aaeba8a915911185736b7e14bf688f38ae3cc6d8
SHA51208d06c8a56cdb253df6c8a61c4dc200d1a499107047184e853927ea10224e23f7e9330c9a4b128e4de70d388421e7284a896b04f7f3706ffa5d5b6b17f7ba211
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd