Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1801s -
max time network
1693s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
28/10/2023, 16:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://krnl.place/
Resource
win7-20231025-en
windows7-x64
13 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://krnl.place/
Resource
win10-20231020-en
windows10-1703-x64
8 signatures
1800 seconds
Behavioral task
behavioral3
Sample
https://krnl.place/
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
1800 seconds
General
-
Target
https://krnl.place/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133429860182546733" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4608 chrome.exe 4608 chrome.exe 972 chrome.exe 972 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4608 chrome.exe 4608 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe Token: SeShutdownPrivilege 4608 chrome.exe Token: SeCreatePagefilePrivilege 4608 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe 4608 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4608 wrote to memory of 5012 4608 chrome.exe 85 PID 4608 wrote to memory of 5012 4608 chrome.exe 85 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 1476 4608 chrome.exe 89 PID 4608 wrote to memory of 4084 4608 chrome.exe 90 PID 4608 wrote to memory of 4084 4608 chrome.exe 90 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91 PID 4608 wrote to memory of 4936 4608 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://krnl.place/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff89b0b9758,0x7ff89b0b9768,0x7ff89b0b97782⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1892,i,3351953108131299453,16978160903217179356,131072 /prefetch:22⤵PID:1476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1892,i,3351953108131299453,16978160903217179356,131072 /prefetch:82⤵PID:4084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1892,i,3351953108131299453,16978160903217179356,131072 /prefetch:82⤵PID:4936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1892,i,3351953108131299453,16978160903217179356,131072 /prefetch:12⤵PID:1160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3016 --field-trial-handle=1892,i,3351953108131299453,16978160903217179356,131072 /prefetch:12⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1892,i,3351953108131299453,16978160903217179356,131072 /prefetch:82⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5464 --field-trial-handle=1892,i,3351953108131299453,16978160903217179356,131072 /prefetch:82⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5412 --field-trial-handle=1892,i,3351953108131299453,16978160903217179356,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:972
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4576
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c52132b0092820e34bd59554b208b979
SHA12164f0ca7029f5baad5041fa681d72d56ed133d0
SHA256947165a501fe9dc349e21727d74213f2f4249265f0010b977821fbeeefabfaf1
SHA512e7e01ca18ec28e477b8684deac7b3c9e869bc3f64152ea14463d98e9dd13216e4ab1714316e05a98a1872cb51e8042acbf74d47b640699628d04c2b6d780f8c3
-
Filesize
6KB
MD5a3a8ba8486f19eb10c97b7a816322f28
SHA129b54f49b2ae380576498609147facd672571b82
SHA256f8fb8aed021dc07f2c9b10f449bb8cb6dfcf6b08c9f312eefb360adeff17e2ff
SHA51206e49ad14223505408f3cdb8f7632af906a81b4abc6d90d09c8b2fd34bb24bfd526f9a2688534a8cd15d406608bc3a6654f6c378fbc93ad4fad7dd2133e0bb8d
-
Filesize
5KB
MD551726a0150f562ef127f609d37896af7
SHA1f724b55a492dd00d314bca433b471b3de33c9946
SHA2566d9d55a7c7d0620306e864d354db4836c81686d0f4bbc01da21868e11553a161
SHA5122fa3785cb462c752603fbde2140b99f8ae0267572ec9d2e66837f0fa9416d6c70a86686c15c3675660a9a509bb0f155262a89b718e14af242afbfee08fbd7e94
-
Filesize
5KB
MD541cb5babb9d64c80bfad0e6def75176c
SHA18fec09b5aa884f265348b53b2fdd36d6b62e9c7e
SHA25612e677621760388082468081992ac60771beed1e78b730db94b1ac0410111ccf
SHA51231ae135206b2d78163f81d55c6da6c623d8c2b46405c5114eec8a561fa65b61433beb2ade95807bf9d072f0a8e9a46f361b09ec6e351f9f8f6b608f3e27b7ee5
-
Filesize
109KB
MD5da7b3b8fdee666356fc5f30b760b2b7d
SHA13960c7f6f9ebe19bc6e8493d305ce50f83f68a63
SHA256d08764f5d72dd56eb5bf911d3402e5a22a61ba781cf76c832da2e7b0946900f0
SHA51284a971deaaada4fea3f10478edf5036612c8a63d2c6fd62b282ed03a7892cc6274ed9d4dfcce5fa806683356f08945b92896a7764d986fc64c7b09483ed3f281
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd