Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
185s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-es -
resource tags
arch:x64arch:x86image:win10v2004-20230915-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
13/10/2023, 12:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://melcusme.bubbleapps.io/?cid=704770916086454482497785198108749386421008988896
Resource
win10v2004-20230915-es
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://melcusme.bubbleapps.io/?cid=704770916086454482497785198108749386421008988896
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133416728675650702" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2980 chrome.exe 2980 chrome.exe 3736 chrome.exe 3736 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2980 chrome.exe 2980 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe Token: SeShutdownPrivilege 2980 chrome.exe Token: SeCreatePagefilePrivilege 2980 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe 2980 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2980 wrote to memory of 1136 2980 chrome.exe 84 PID 2980 wrote to memory of 1136 2980 chrome.exe 84 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 1744 2980 chrome.exe 88 PID 2980 wrote to memory of 2716 2980 chrome.exe 87 PID 2980 wrote to memory of 2716 2980 chrome.exe 87 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89 PID 2980 wrote to memory of 2688 2980 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://melcusme.bubbleapps.io/?cid=7047709160864544824977851981087493864210089888961⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd6759758,0x7ffbd6759768,0x7ffbd67597782⤵PID:1136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1860,i,15956780675122673414,14896011746500303952,131072 /prefetch:82⤵PID:2716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1624 --field-trial-handle=1860,i,15956780675122673414,14896011746500303952,131072 /prefetch:22⤵PID:1744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1236 --field-trial-handle=1860,i,15956780675122673414,14896011746500303952,131072 /prefetch:82⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1860,i,15956780675122673414,14896011746500303952,131072 /prefetch:12⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1860,i,15956780675122673414,14896011746500303952,131072 /prefetch:12⤵PID:3548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4752 --field-trial-handle=1860,i,15956780675122673414,14896011746500303952,131072 /prefetch:82⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1860,i,15956780675122673414,14896011746500303952,131072 /prefetch:82⤵PID:236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1840 --field-trial-handle=1860,i,15956780675122673414,14896011746500303952,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD53e91104486ad0f1c6f45ce8f96e0bfe3
SHA12f276cda3f94185462bd8d33e541959efa8ef08b
SHA256c47b7a4b70406550b801790053546b76e459d78d89cb4af21bc2327e033ac47a
SHA512841e078f3bda85760d7da9ae2c6d8e42fd770406bc1d2deddde4b7c1664c426b893de3c65252c6bdf94a32216e4c267ee57d15b104e1b07eedf1b0b9650ccd67
-
Filesize
1KB
MD5ae58a89c8339c30b6eeaf01ff3de16ec
SHA1d6a1c04a2da4e71b363844d2af56799c07c1a87c
SHA2565427a28b92f1d3fb70feeb063feaaaeb4e4ea3ec7363fbd99fc39611c4ed5066
SHA512462667883e5bd9382a026f3d028dd193c69033be223734c6942f6c74a3751ab86b4367eef2fe3548ef4a509cf82adb4d01c09bf276974e6967c74fd8f585b14c
-
Filesize
6KB
MD566104bb3813df99616f89bfad12e3202
SHA168a11ea20306a7c3cbd4147ca76e94910e2078b2
SHA256e821a820ea06e9cd9df6d23b13ef5bed120a949e2998b132926ca45f6fef0721
SHA5127cd44b6c4204633199fca7f03436c1c30492656cc3ed7570649cf9b5371d7e96176471aaf97c2a8a6914a245f1265ec6fecc8e2d1fcbac6b8ca1f1e2349bc391
-
Filesize
101KB
MD5999d764246fd4a8604d94964348d68c3
SHA1595c572c39f9fa01e61854d478c78187e98c8651
SHA25683d9d4445d2f6b48d469af6eb505870e1cb30a2e6743fda3c99b5b33ba7f5139
SHA512e89eb8ace849aa94cd9ca79e6bc0eb282c9ed45f55f04127f75c92ccda4c7781fc2e0435ee61b1a1b62d8e6ce13c6b4c7a6c5843e9a6a9771dbf7c2c83c5ebfb
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd