Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
277s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2024, 20:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://mkto-sjn0059.com
Resource
win7-20231215-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
http://mkto-sjn0059.com
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
http://mkto-sjn0059.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133504281877722662" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1912 chrome.exe 1912 chrome.exe 1268 chrome.exe 1268 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1912 chrome.exe 1912 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe Token: SeShutdownPrivilege 1912 chrome.exe Token: SeCreatePagefilePrivilege 1912 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe 1912 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1912 wrote to memory of 4280 1912 chrome.exe 73 PID 1912 wrote to memory of 4280 1912 chrome.exe 73 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 2784 1912 chrome.exe 87 PID 1912 wrote to memory of 4176 1912 chrome.exe 88 PID 1912 wrote to memory of 4176 1912 chrome.exe 88 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91 PID 1912 wrote to memory of 2908 1912 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mkto-sjn0059.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae43f9758,0x7ffae43f9768,0x7ffae43f97782⤵PID:4280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1904,i,15409799248182198514,15945641736903824316,131072 /prefetch:22⤵PID:2784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1904,i,15409799248182198514,15945641736903824316,131072 /prefetch:82⤵PID:4176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1904,i,15409799248182198514,15945641736903824316,131072 /prefetch:12⤵PID:820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1904,i,15409799248182198514,15945641736903824316,131072 /prefetch:12⤵PID:4744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2276 --field-trial-handle=1904,i,15409799248182198514,15945641736903824316,131072 /prefetch:82⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3956 --field-trial-handle=1904,i,15409799248182198514,15945641736903824316,131072 /prefetch:82⤵PID:3392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1904,i,15409799248182198514,15945641736903824316,131072 /prefetch:82⤵PID:1340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3108 --field-trial-handle=1904,i,15409799248182198514,15945641736903824316,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1268
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824B
MD5f1e522318aa3c314278f0dd666cc58fe
SHA1ec2ccaee9884b46167fb15cf85be16c205703ffe
SHA2564614a0b9baf0d71d798d79ba143fce719456430e78942e3a583d6f33438008aa
SHA5123a6a64c6ea5dc41ed8c565dd8d8db04288aae9b65cb4b24a73d048e3d06ab4a8aebdb9a9be4563d1952fee3cbfb7f12b86cc438b79d1c503186e2152df2218c3
-
Filesize
6KB
MD5e989197afd09154ec85c0016a32e6b91
SHA155be91e7fa98cc45b382b18e71e1625bc0ac7711
SHA256057b3c94d29dcee283b199716986b5a8f2b2662a3762ad0b474d01421f9eb625
SHA512454d3f9e60c9e5d97c13d7ea10b3c6786cfdcabd203c65f2cb49f0c1769d07da77170e8b0d95e04494b433063eeb5304f52e9380976d3b1c8e43b3d76a1ea670
-
Filesize
114KB
MD58d997428b22b0234f9537ae4974115ff
SHA139a529533bde955f11602fdb21dbaef88bbcc802
SHA256082483f24eaff1fd8ab102b2e812cf2bac9353204d49d3f7a32e0d665ac96c72
SHA512efbcb79048d4372a3dfd6c97287928fc2cdc7158d202e8f0a7d7129175cef4131c0f1f5e708c04c04edea43aa796dd93f01fdd30150becc61646c67051bd09d3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd