Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 12:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://fcamylleibrahim.top/sywo/fgoow.php?l=dxclass5.gxl
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://fcamylleibrahim.top/sywo/fgoow.php?l=dxclass5.gxl
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133438354659340691" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4336 chrome.exe 4336 chrome.exe 2384 chrome.exe 2384 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe Token: SeShutdownPrivilege 4336 chrome.exe Token: SeCreatePagefilePrivilege 4336 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe 4336 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4336 wrote to memory of 1824 4336 chrome.exe 86 PID 4336 wrote to memory of 1824 4336 chrome.exe 86 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 4544 4336 chrome.exe 90 PID 4336 wrote to memory of 2780 4336 chrome.exe 91 PID 4336 wrote to memory of 2780 4336 chrome.exe 91 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92 PID 4336 wrote to memory of 2628 4336 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://fcamylleibrahim.top/sywo/fgoow.php?l=dxclass5.gxl1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4336 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95fb49758,0x7ff95fb49768,0x7ff95fb497782⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:22⤵PID:4544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:82⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:82⤵PID:2628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:12⤵PID:1460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3172 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:12⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3988 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:12⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3028 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:12⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:82⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4028 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:82⤵PID:3252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4064 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:12⤵PID:3060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3356 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:12⤵PID:3796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=212 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:12⤵PID:1104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4608 --field-trial-handle=1868,i,5995970436685741914,14100195585930088324,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2384
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1912
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5d261c561662fcad14d99b1dd22e530c2
SHA1b3a868854051afc71d9a04ee1065d6f980a9bd29
SHA2562db0d342b2b9faeb62eaec416544632066198781afbeb312aac5b37daab5f4c2
SHA512741793f1f4601f8b367ece6f75ee88b15e3b750994cf725c02afbc66804cc1f5ff4ba10a938455638d4bfa155c215f17d9c33bf1c86aa0e5dc7e7fd03875f367
-
Filesize
5KB
MD5b0e5361dd947f2f5b9637d475e254a7a
SHA1e57b2e96e05f98e0846df253d90b907f73ae19f5
SHA256d978bcc079a9db032a3d8c7144fe1f4012b8d470a76253cf485d01cbcaa1306f
SHA512ddcc557e23eb017a8e89344f7808477b1d036c7c353f6857017fdafd6ad0ef245598984065c574fa4a87bf1cbddef7f1d582b15cec5c49ea9ef5946d0879c1c2
-
Filesize
5KB
MD5796bf5c13dcbefd8288a88391acb3753
SHA1a6eed2bc672215f76f9eaaf8aadfcf97f93a527d
SHA256a0e10b524964ba71d2eaaca7e00bb83fbcbaf7bd5b797221010a7d9c5a4da10a
SHA512c2389bc5f76f0b005a78fb1645771af450ab5a4fb9435ddb20da4da7438a912167f79675c12da9f0aba5a3c5d30848e5499f1f7f0298b9c24c824759ddd92751
-
Filesize
109KB
MD5bb169448ecd7726449391c5c6ff56814
SHA1d69426993e069c74eb6c342351822dd482f233f9
SHA25600f2425ec96027231913374ae7fd4b0ae00d2d0c526a7760b5d242b7978d28b5
SHA5128bcff1e8462f0d26a1d5c9b2d32d7c64bb106dda95bc3e668ccd95a77b874bea32a583edc8abe6a4b0073107668b29d54fa30c22b08ec53435cc7a99a2272dc9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd