Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
93s -
max time network
97s -
platform
windows10-1703_x64 -
resource
win10-20231020-en -
resource tags
arch:x64arch:x86image:win10-20231020-enlocale:en-usos:windows10-1703-x64system -
submitted
07/11/2023, 15:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://atilimshoes.com/Homestar.html
Resource
win10-20231020-en
General
-
Target
https://atilimshoes.com/Homestar.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133438456135155668" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4280 chrome.exe 4280 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe Token: SeShutdownPrivilege 4280 chrome.exe Token: SeCreatePagefilePrivilege 4280 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe 4280 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4280 wrote to memory of 2508 4280 chrome.exe 71 PID 4280 wrote to memory of 2508 4280 chrome.exe 71 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 3828 4280 chrome.exe 75 PID 4280 wrote to memory of 2160 4280 chrome.exe 73 PID 4280 wrote to memory of 2160 4280 chrome.exe 73 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74 PID 4280 wrote to memory of 512 4280 chrome.exe 74
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://atilimshoes.com/Homestar.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff897819758,0x7ff897819768,0x7ff8978197782⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 --field-trial-handle=1696,i,15404044622328427037,10715379913388541182,131072 /prefetch:82⤵PID:2160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2108 --field-trial-handle=1696,i,15404044622328427037,10715379913388541182,131072 /prefetch:82⤵PID:512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1696,i,15404044622328427037,10715379913388541182,131072 /prefetch:22⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1696,i,15404044622328427037,10715379913388541182,131072 /prefetch:12⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2888 --field-trial-handle=1696,i,15404044622328427037,10715379913388541182,131072 /prefetch:12⤵PID:260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1696,i,15404044622328427037,10715379913388541182,131072 /prefetch:82⤵PID:4412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 --field-trial-handle=1696,i,15404044622328427037,10715379913388541182,131072 /prefetch:82⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5064 --field-trial-handle=1696,i,15404044622328427037,10715379913388541182,131072 /prefetch:12⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5328 --field-trial-handle=1696,i,15404044622328427037,10715379913388541182,131072 /prefetch:12⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4304 --field-trial-handle=1696,i,15404044622328427037,10715379913388541182,131072 /prefetch:82⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4284
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD5a49b4f6e9f88f82ac82ccf27727a252d
SHA12cf9775ea2ed981f95279ac8a226d8186d9656c9
SHA256bbb19bed00dbe4d93b56fa31e09ee898cd1860725a6f8bbca647546dde81ef58
SHA5121677d0715db34d3c66173001bb1ebe3dc2a7c168bb5e2faf3a3cd6e22edfe424410eccc04193f43e5463f931f4e8e230d7c8417f6b4adb3e5de6d773971006a9
-
Filesize
3KB
MD542b3e961a30a7c7085b819dfeb8172ca
SHA19622cd037572572b1843c288991c6e563d410837
SHA25637a024c9da9f86156c5f6439f843930bae32a692778e9b20280926d0b1faa43d
SHA512f64a803bbdc9a3d1e9c7de243a5ddd86eb18eeb37ee0478cf970082eeaee8d7b780e0a89b3977c92d42ad3c3a0008c795203857ff88655e79f006908a072898b
-
Filesize
869B
MD545438bc8f8f0db01f71349b42211abb2
SHA1c59023754cf7b23b256fdbb59130b24e29f6e817
SHA256ff17fe18c4fe9a78048ca37ce1f11634a990e5df34e19467b779626b10327a71
SHA512a84630e8cf56cb33af1157dcc4609f6a42609f0794a015d7558f8601f58c0a7853aa4e3c14cdef750064cd71511dee4b3cc3af1e1b51676896aea3b2d23f75c3
-
Filesize
6KB
MD58919c37d264f953943d97aa75a509d3d
SHA1119ca03a8a9cfccc79a6185dc27103100a009950
SHA256038c6f464f6e4492ca6c54f7fa681a6b98599dbd615bdd24d3d21625435229a1
SHA512e8c12e506457d39ddb0c5d3499e91fbe3d1020b0b059980dcc668fe1676538471abcebef4914ea5ae978289bb8f6da1d7bcb69be1ed63186f65157d6ff07e668
-
Filesize
6KB
MD57da36dc5dcb2ebcec2bb36ff5db4fc8b
SHA10186a4f8d16b5907e74f8ef031281f5ee21a46f1
SHA256e79b59127cc2c1c8e50fd05fbdc4f9f15450841de7c2305f7e936094cc801a4b
SHA51243a1dce0eee542fb1d8655604c9912e94e1b22fe90dba920c77fafa6225d794e3ab58813e1e07b64e992fe1d6b38be2911588d851701975bb1efe55b556c09da
-
Filesize
5KB
MD52bf2f9488dbffc768816823831d57139
SHA1e97c2b9271fa6bdcbd586e437a82e1e7e2527d46
SHA256f110f065fb381c4e17abf01f93025cbc819fbba1baccf3c7f61fd2c7733aa235
SHA512b12a7f3a8c08f1277fd197bc0e8901e7cbd0e464212512b9b5ddc29ae50cc31da822e5d8a3d889a29fc5b2313f3069f6127a0c14504b6c425c850fdea6e40b95
-
Filesize
6KB
MD5d0e9009bea43cdf5fa296aee4e9880b8
SHA1324d898b28671d17ea14f8e455d2fb4b5c82345d
SHA256c8919c8bc2983debe6bd97c53f7313811d458befab5ccab9d8bf11a7630efd4e
SHA51283dc0d36a3dc935ade24984330ef85ed97283d57eb3162379ca3a8bffc3f85293344e5e53d0632b0a020ba6c9255c14a79d642b71b1950d2bc95d928de8a7449
-
Filesize
109KB
MD527eeec36838b366e9a7466fb8543285c
SHA1c7bb65b8543f1565cdca49c1cba1b9e57d493775
SHA2567e641783f4c7a7841ef9e271724a027521bc1a02d02a3a30c59b7833f884553d
SHA51265a1a981913d9184e9bd8cc103d0e67bb18d0d4169e188a905faa9c92bdff454b139db56795c6474ad4b0a35a39070f0eaf28b289c5d0f82f05775205576eb28
-
Filesize
99KB
MD51ea8ddcb0e3bf23f79d46ecf364c7141
SHA1376cd741cb2faabeb46b49c8ca6ffc0b445bc7a1
SHA2568bf9258e585a485976f47d3410396640e0aa28864ba0f3bef8cd8848097ff12f
SHA51271f3f7888da738747f03f3a6c767ea5b1e8a3a9db5e44d405e45cd9ea7603e471f87a3b1d9cc82a0f5fb85a49ad5ffc4e8c8641accf06cb06ec2a091bc880632
-
Filesize
98KB
MD5fe07dafac611a08b4725fee2f8ac2b85
SHA10ddaceaf0067243ccb2fd0e8dd5854a698b90a5f
SHA256630269ca9195bb555fb4f16ecfc84ae90ed38e78a1b93597ec5bb6c22173fcd7
SHA51279fd1ff2891e7ae99025e23d3a47be3520037807364d1ac98502072e9a8d91ae398e5677290b38286a230c9b009c7cc3edd6002cda39b4de2f69c5f912f5f3cb
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd