Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
38s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2023, 21:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://trkn.us/
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
30 seconds
General
-
Target
https://trkn.us/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133413615877187651" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3972 chrome.exe 3972 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3972 chrome.exe 3972 chrome.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe Token: SeShutdownPrivilege 3972 chrome.exe Token: SeCreatePagefilePrivilege 3972 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe 3972 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3972 wrote to memory of 3496 3972 chrome.exe 83 PID 3972 wrote to memory of 3496 3972 chrome.exe 83 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 2068 3972 chrome.exe 86 PID 3972 wrote to memory of 4928 3972 chrome.exe 90 PID 3972 wrote to memory of 4928 3972 chrome.exe 90 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87 PID 3972 wrote to memory of 4560 3972 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://trkn.us/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90b729758,0x7ff90b729768,0x7ff90b7297782⤵PID:3496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1812,i,14762068780610961167,15902747830089387871,131072 /prefetch:22⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1812,i,14762068780610961167,15902747830089387871,131072 /prefetch:82⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1812,i,14762068780610961167,15902747830089387871,131072 /prefetch:12⤵PID:4944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1812,i,14762068780610961167,15902747830089387871,131072 /prefetch:12⤵PID:1168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1812,i,14762068780610961167,15902747830089387871,131072 /prefetch:82⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1812,i,14762068780610961167,15902747830089387871,131072 /prefetch:82⤵PID:4228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 --field-trial-handle=1812,i,14762068780610961167,15902747830089387871,131072 /prefetch:82⤵PID:1232
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5bd2140d637ce82821afd7003eed33c35
SHA12d4a570b07445b61dd629728bdb362780524f59b
SHA256b06f3d510c6f7a082eae5a1079543fc5f893ad8f111a895321d46df11f0d01ff
SHA512d5b6e852791b9216505629e4ffaa65c35f5d0e85a6416a0876732f73a295b42e41e77e1adef8d913e261ecd8a38ba9f5bd2af06ed85b5c22a2331a734f651d92
-
Filesize
101KB
MD51368ae1528637f770796f02b103790a3
SHA13f434c39a0419b1a9834d22663d6d9b647eebd15
SHA25612c383b09b18f241abe0d57690e6d6f8dc29ca1d7fd3d2b814a2a78a5085acc2
SHA5127fdc9eb8bf149d957cc4fccc07d9ffbe191a59f6d2fa499a9c45d89a49f768d41c7e3ca91fdc3520ae96fc7aeaeaa6e0cc3e6c2d76e6973d694a2a5dc7aaf9e7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd