Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
275s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 10:00
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://egyptmineaction.com//organisation//organise//lasenassss//amFjaW50by5jYXZlc3RhbnlAZXZvbHV0aW8uY29t
Resource
win10v2004-20231020-en
General
-
Target
https://egyptmineaction.com//organisation//organise//lasenassss//amFjaW50by5jYXZlc3RhbnlAZXZvbHV0aW8uY29t
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133425288818712568" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3836 chrome.exe 3836 chrome.exe 2600 chrome.exe 2600 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe Token: SeShutdownPrivilege 3836 chrome.exe Token: SeCreatePagefilePrivilege 3836 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe 3836 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3836 wrote to memory of 2412 3836 chrome.exe 61 PID 3836 wrote to memory of 2412 3836 chrome.exe 61 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4872 3836 chrome.exe 87 PID 3836 wrote to memory of 4272 3836 chrome.exe 89 PID 3836 wrote to memory of 4272 3836 chrome.exe 89 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88 PID 3836 wrote to memory of 1756 3836 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://egyptmineaction.com//organisation//organise//lasenassss//amFjaW50by5jYXZlc3RhbnlAZXZvbHV0aW8uY29t1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3836 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb06049758,0x7ffb06049768,0x7ffb060497782⤵PID:2412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:22⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:82⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1908 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:82⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3056 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:12⤵PID:2340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3036 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:12⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:82⤵PID:2536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4644 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:12⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4628 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:82⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5524 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:12⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5344 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:12⤵PID:3160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5336 --field-trial-handle=1976,i,6779520022929081026,9639296497742630655,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2600
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD59af228502da22ca25e07ed314b10948f
SHA12f47957fda5b79a442ec64aa4279079445497131
SHA25636187a390f29607dec63fd1638f039b21c4d7a980ddf3548f51ec814247b0345
SHA512afa2fbbc8407d753746e176608f82206c7189e4e76e616942526caa61f3d59f620ac87fc721e1037695ee28dccba91600b28026b130adeffd4274ef86a748ab3
-
Filesize
1KB
MD5fe43ac5d4f37850bf09bd60d76457fc4
SHA1444e5e2a995748adf8c9b029a084243b8d450242
SHA2567cbfa5edcadfaf52ab496f468130b5adc7f13191fa1873219f3e2376c9a5a589
SHA51265a7b9402375124e351f658f9791fb668e84e794a98639ab303456011e2cc5ecb3eea88deed3907c965269b0565734275f04e731dfc65b93b5fd90cae587c70a
-
Filesize
1KB
MD542c315afb53ce32daedaa56916f06265
SHA1f565213b5d255e2aea6a6143e0525b35788a91ea
SHA256c34b1ff1a7c5cc7601d209a68298eafb8ed19a59a4346ff63c3c588cf17c076b
SHA5126b6f407b2f3ab7851d1582a584cbc2215bdfbd99747578b98ebdc11db6dd2b8eef1ed61af228bd80742f6303458696f57eccfdd2b660b460a176d7ecf7f3cb64
-
Filesize
1KB
MD54e2306043462736deb5318063b382a36
SHA1bf81e63bfd7818cb448802a70d388df18693813a
SHA256b84241b72237571357861e63f809293e72fb32914733f9b8e7f2c63a911c5aed
SHA5120ab07743757ad2a5df9bfc4feb21751771a6d4ba419779ba7ebdd38a88cbee46b45bd5923679b0c80d882e4f128225d6eb20bfe206f80440b9dbb42afe0915e2
-
Filesize
1KB
MD5047e856425a2a895605e70a3a507e605
SHA15c184453a2a4b69aefde70544ef003c7e155fff4
SHA256f0f9e2f1d1a6f58fa0166a40b88016696e3503fe13f24569dcefd806093fbcbe
SHA512f68939d787cd12dd0485a81eb284223edfe6ecc15165cf638a0a6db8ee43d9b626a65ea4fd8f4c65ddc00d816492248d67af06e2ee87d3ba0f3d61e5e2a7e0a5
-
Filesize
6KB
MD546778c9de3a8b46d4d2e12f90b985a51
SHA1dd8a15b8804df2f0d4a59bd8371619c29dcbaf08
SHA25631ba05ad16ceffbd3a45eaa4e1fd4066f5845d6b6b8b2f312e656e81cfe79823
SHA512b52cb02b3245d956d07ae0b3d9c04a6cf5bf40a1edbf5a5cf6ab47df4114963093d8cb0c9939a091ead48ff4c3e91def903c0168ed99ca4d96b200c56d76feab
-
Filesize
6KB
MD5eae985babf19ef1e1206de538ef5a0a1
SHA1a9f930cea5eae56b2af3276951fe11f26c12af0a
SHA2560a1d38057696e3419b8407fad8fab186eb6c8adb398104008d6e81bf600e2341
SHA5123e4af5ba05b94f69ac62f9d4e07411349745923cb9209e87cd630d5abe78c3b673cf9ef69807b57d4da65de6eda4b943722cd67a61ec8e5540cd392cdfc3bc92
-
Filesize
109KB
MD568de546e552d0089b9dc3ebf43b28b64
SHA1c4c1962fdb7921d64830a21d39020f84bf643bb2
SHA2565e994c45a773776cdd3028a8a9aee3fba5c3fe04e070cb0ecd4b3077cc1dfe08
SHA5128171fe750b8a7cec17becdcbaabae8c49d0a5cf16ef3d57181312213d244db382c4120336bb958ea22f4c76e883cb88c1247abdf252672d9b85d7bb33745d33d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd