Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2023, 22:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://kiddyboxer.net
Resource
win10v2004-20230915-en
General
-
Target
http://kiddyboxer.net
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133415352922126204" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 4984 chrome.exe 4984 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2716 chrome.exe 2716 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe Token: SeShutdownPrivilege 2716 chrome.exe Token: SeCreatePagefilePrivilege 2716 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe 2716 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2716 wrote to memory of 1252 2716 chrome.exe 82 PID 2716 wrote to memory of 1252 2716 chrome.exe 82 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4720 2716 chrome.exe 85 PID 2716 wrote to memory of 4728 2716 chrome.exe 86 PID 2716 wrote to memory of 4728 2716 chrome.exe 86 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87 PID 2716 wrote to memory of 2060 2716 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://kiddyboxer.net1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec1d49758,0x7ffec1d49768,0x7ffec1d497782⤵PID:1252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1896,i,14013578961532831609,15062864715310135736,131072 /prefetch:22⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1896,i,14013578961532831609,15062864715310135736,131072 /prefetch:82⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1896,i,14013578961532831609,15062864715310135736,131072 /prefetch:82⤵PID:2060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1896,i,14013578961532831609,15062864715310135736,131072 /prefetch:12⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3152 --field-trial-handle=1896,i,14013578961532831609,15062864715310135736,131072 /prefetch:12⤵PID:368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 --field-trial-handle=1896,i,14013578961532831609,15062864715310135736,131072 /prefetch:82⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1896,i,14013578961532831609,15062864715310135736,131072 /prefetch:82⤵PID:2972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1896,i,14013578961532831609,15062864715310135736,131072 /prefetch:82⤵PID:1796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1896,i,14013578961532831609,15062864715310135736,131072 /prefetch:82⤵PID:3376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 --field-trial-handle=1896,i,14013578961532831609,15062864715310135736,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4984
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3944
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD5efd019c29106306c8f5e1e0422f35689
SHA106da2192086d9dbdda3778447a242b72ec027a5d
SHA25658658c32215a1d51a2b7a56a9ffd33ce3ee73dbbd814b7f6bcc9235ac8089157
SHA51228bfc078ed943fc056e4dc3c09fac470be4a591c1d0863a272468b60a34c7de820c10ea53fc0a4a3837a5b330c314ab4ce0fcaef533f0076116bd80533b82f9c
-
Filesize
1KB
MD57d51e1a262ec6baf9d251202a64813c9
SHA106c0593ae210e432eab688f806a087511a826191
SHA256bf67d65d7b44baf99fc5b1a9f743803b935311ed93db28eaac6e346285a695e2
SHA512c2c369856d2f3172673e05f1212c9c78030c44db3fdc98eff2b79847f63d4d656de7019a6f71076a49ed90b1a3ebc9ec5be04a784595a70ca289e6cb1916993b
-
Filesize
5KB
MD5085ae6b23bae9263375ffba4543c4ab1
SHA15ba6c88054ff1eafcaab4f48ae090f3808fde040
SHA2565d1d789da1063448f04dd25043c944a40e8cc401953a05a696e4e791a532a2b2
SHA512dfce23dbc41ffdcfb7c92e356ac4b53dd1b9102f194ebc8b700b02df8a13060e1a2d8eb21a47904fea7f60760467f6c76c265b0e3accc59310475f9ac9967d5d
-
Filesize
5KB
MD508af45f0be38a25ef69d71098e7dcb3a
SHA1db0e036d11d9293fc6ff1d9c05a54ff3c951e6c6
SHA256ea6de8bb25880dfa49c61120632b6234d81d0d6e4c25084e7e81b25bacedf813
SHA512704d6c055cac3c63487c15b282becaced4eb1269c7dbcb35d2adcc7a5a89357495f79a1277a2f0ebf36c9f0ee331515dc32b5e17221778bb3a55ffb54fe7dcce
-
Filesize
6KB
MD5db44166cc3935dbe23031a0013764764
SHA157ba818de4f5b8c37c9551d2e037c2464ff049ad
SHA256a080ca946b0ee5b3297b943f452f4d126fe593f82fcff36a5fa2c19660b75d18
SHA5121f0b7349a5a5db02f850e6ab933e1adfb3fa9e6042acec9e2df2c8513b3d43961c8ceae883fac770691b21c04ad82df97ac54acce99a18fd9ac41d9d637a9a72
-
Filesize
103KB
MD55902839cb6268af0bcfef374f13bc07f
SHA16ba5688b810991a9bb95ad51c13fc91d9bcd1ff2
SHA256751a5624ab7b9a107994851d3eef76e2ac845fc7d554e7984c74533bed5c2a25
SHA5126e44534cd748c79b4242d3ecbf8a9068396846214e4d9553b844fe66dc5750f3254006a1cd373af77fa24aa2453c704345acca374af21ab0d1a4e89a98485fc8
-
Filesize
104KB
MD5b4faec571fa4780fa1965ae64ce92f85
SHA122379260a395f2357b03d20c24566f03c7f2b94a
SHA256d553e46f0504a1b122a492e7218b5b6ecf69f90aec463c013a910dde3dea5d82
SHA5127dafe348134a9b80d412ae07b2261e706c179ebabd7dee21452dd265c7e8398474f4b081896ddff4b49df517b6c7f17edbe17c662ecdcd5c4d43d6ee0e2502fb
-
Filesize
121KB
MD52e67a58ce568ad074028de67f93fad00
SHA155f8bd6e0b18b31ce26ef3b8bdd753586cee1967
SHA256ccf2a20a4339949b5d9a10b54c3014cd18c2bb9621dc2b1308c0c3ee66f235c6
SHA5124acbf0d64f76db940be01309139b8eb27891e6e75dc565eba0b0b7217d78549fcd8702d0dd03fd430586a81df4e971c97bda17e21d97979136dbc886e6991f8c
-
Filesize
103KB
MD50c1959ed10e16e0206698597e386dbb2
SHA1eac88cc1d8157107ed13b6efda6c952a69078c23
SHA2568e9adbcb8952fb951734c8ba2fa7e1f65fb11e56af556e8168c74e7fcbee566a
SHA51215b402817ecc407f7f3521aecc85b3c7051d33bd9d7fd86f67c7484c0bc1b6c5498b0e52e5409d00dbaa9a90fb966b0c1f8649a389191c9f9eb494d9dd7a8009
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd