Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
23/09/2023, 10:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ouygyufyu6t6yf.craigaussiesoles.top/?ZP=3lx7s
Resource
win10v2004-20230915-en
General
-
Target
https://ouygyufyu6t6yf.craigaussiesoles.top/?ZP=3lx7s
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133399400909370269" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 464 chrome.exe 464 chrome.exe 4596 chrome.exe 4596 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 464 wrote to memory of 1660 464 chrome.exe 60 PID 464 wrote to memory of 1660 464 chrome.exe 60 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 5108 464 chrome.exe 88 PID 464 wrote to memory of 3844 464 chrome.exe 90 PID 464 wrote to memory of 3844 464 chrome.exe 90 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89 PID 464 wrote to memory of 5080 464 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ouygyufyu6t6yf.craigaussiesoles.top/?ZP=3lx7s1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91d219758,0x7ff91d219768,0x7ff91d2197782⤵PID:1660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1620 --field-trial-handle=1700,i,7920095946833230828,9412719624086820309,131072 /prefetch:22⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1700,i,7920095946833230828,9412719624086820309,131072 /prefetch:82⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1700,i,7920095946833230828,9412719624086820309,131072 /prefetch:82⤵PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3188 --field-trial-handle=1700,i,7920095946833230828,9412719624086820309,131072 /prefetch:12⤵PID:628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3192 --field-trial-handle=1700,i,7920095946833230828,9412719624086820309,131072 /prefetch:12⤵PID:4408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1700,i,7920095946833230828,9412719624086820309,131072 /prefetch:82⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3908 --field-trial-handle=1700,i,7920095946833230828,9412719624086820309,131072 /prefetch:82⤵PID:3392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4808 --field-trial-handle=1700,i,7920095946833230828,9412719624086820309,131072 /prefetch:12⤵PID:516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3372 --field-trial-handle=1700,i,7920095946833230828,9412719624086820309,131072 /prefetch:12⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3852 --field-trial-handle=1700,i,7920095946833230828,9412719624086820309,131072 /prefetch:12⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=212 --field-trial-handle=1700,i,7920095946833230828,9412719624086820309,131072 /prefetch:12⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 --field-trial-handle=1700,i,7920095946833230828,9412719624086820309,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4596
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD50c0b9802a8e3b4d9ba97fadfc0269ac9
SHA13d24153b7cd3cfb9ffa969a5b1fb4811cc094c23
SHA2562a48fa61a60521909ee63e3110f9e5edcee79d1677bdbcddd36578d97211773b
SHA512c04497fdec72877d5956cc8ebb7ebefffd02d6cd0f3cb027152b04a519935643e0e1c6df3184cc428cd5e4643707c1a9f3c084d669bb80b5335b1a0d41795f70
-
Filesize
6KB
MD50b0094e5bcc52aef1c886937a5ddf480
SHA147c33a33f5528bb3884e64129abd67a2a469b1ef
SHA256ff4a0d189b861080bf3c8d305a09551b23b65892927eb0037154de3fca1ed007
SHA5127f1498482b9d97535a406f73718152baf7ada0c68673791665acbf0e221ea91ee2c237b0358e4897831cbfc37ecc259e370e9a02983c12010920750ce2ca3a4a
-
Filesize
101KB
MD5862c768301f57fafa8aa58e761515dd8
SHA16d5757494d2d4ed8c95c145db27914dbd18e97c4
SHA256f0a261ba4c8f8d38eff0beb3e71a1adf80e51463c363afda72d1ad05d3757cf8
SHA51207d34e483377266e2a2ef59981eede48fe318fe64b0c1af9b00007dfff64b2a4d19489db08ab23ff31f6753c8bc292a87578a91100fff1ea3e6d4fe661b20260
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd