Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/10/2023, 21:21
231006-z7dreaac55 104/10/2023, 06:57
231004-hrd9kahf9x 103/10/2023, 02:22
231003-ct2vrafg31 102/10/2023, 04:37
231002-e8wndsha29 130/09/2023, 02:42
230930-c7c4jshf47 129/09/2023, 02:43
230929-c72f5sgh43 127/09/2023, 01:36
230927-b1pnbsgd52 127/09/2023, 01:36
230927-b1gbyseh2t 126/09/2023, 23:54
230926-3x9ymsfg74 1Analysis
-
max time kernel
596s -
max time network
435s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
29/09/2023, 02:43
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://dstat.cc
Resource
win10v2004-20230915-en
General
-
Target
https://dstat.cc
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 5092 PING.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4524 chrome.exe 4524 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4524 chrome.exe 4524 chrome.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe Token: SeShutdownPrivilege 4524 chrome.exe Token: SeCreatePagefilePrivilege 4524 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe 4524 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4524 wrote to memory of 4512 4524 chrome.exe 85 PID 4524 wrote to memory of 4512 4524 chrome.exe 85 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2044 4524 chrome.exe 88 PID 4524 wrote to memory of 2964 4524 chrome.exe 89 PID 4524 wrote to memory of 2964 4524 chrome.exe 89 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90 PID 4524 wrote to memory of 4440 4524 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dstat.cc1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4524 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff70d79758,0x7fff70d79768,0x7fff70d797782⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1916,i,778466018141083412,14164709086747448702,131072 /prefetch:22⤵PID:2044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1916,i,778466018141083412,14164709086747448702,131072 /prefetch:82⤵PID:2964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2268 --field-trial-handle=1916,i,778466018141083412,14164709086747448702,131072 /prefetch:82⤵PID:4440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3356 --field-trial-handle=1916,i,778466018141083412,14164709086747448702,131072 /prefetch:12⤵PID:2976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3104 --field-trial-handle=1916,i,778466018141083412,14164709086747448702,131072 /prefetch:12⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2292
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:5064
-
C:\Windows\system32\PING.EXEping -t 172.111.36.232⤵
- Runs ping.exe
PID:5092
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
804B
MD588e347de287a18753f4167507aa5dd1c
SHA118db371ad84d622c9477ef4848c4538e2ad495d2
SHA2564af9272a6cc27de22b1feffb72e59a73298c3af867de73a845bf9c5cc229d21d
SHA5121335eb1af72f5cf5525f2ef38f40b5d3d3db1398ec7e10dfc2d0f47fbf1c8443cda68bc7773d9840e8d70f21901fb990388b516aae0709a738418f458e5176be
-
Filesize
539B
MD5a0f729084111121312480312c5d99351
SHA18bea4fe641089084210a0d708bfacf492b1bec5a
SHA256baa8c8a950eeedcd442b53b6080480ffbfaf0727becb4ab4b4b1368b58ea42e2
SHA512f594ececc1d1f3598a28088a9d7248e4b96362b6352e04b27bfe2e5970b003aa976e6e16032eb5eb860838a46976bc3d8343e996b053ffb9466390ba1ad8db7c
-
Filesize
6KB
MD5bf501763085059236bbeb069954e5ffb
SHA197d57eb5c730a1c910c805f2d704cc4085356afd
SHA256d4aa85fc5f44e22ab519d6e1417d74f0cd5f74539ed9289bc74590da48634378
SHA512c0a692d709ec8b7d33d4c2a7417c14427717e81ed5501bcd7b557c24f3da32a1d3f1084f12572c5d2fb5a9954c6b4482137b4cff545ca8e44a922b1da362c8ff
-
Filesize
101KB
MD5822f6e9b234977c365b774fdbfdcf4de
SHA114421448e29ec79f78a1cc876092eb19795b67c8
SHA256e4bb19fef6619f792477f98740a8b9450ee24d571412ed759220f712432db3e1
SHA5121ed34fb1a52f5646e18589e81ca5059c78279577774e54b4f149a8209960ef8668f9e0e19930facab857dc408490125e8b228f40a2e9cd27776d8e7503b481ce
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58