Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 00:10
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://mmmgoodfood.com/768r57d/#[email protected]
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://mmmgoodfood.com/768r57d/#[email protected]
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
https://mmmgoodfood.com/768r57d/#[email protected]
Resource
macos-20231201-en
macos-10.15-amd64
0 signatures
150 seconds
General
-
Target
https://mmmgoodfood.com/768r57d/#[email protected]
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506150204417989" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3000 chrome.exe 3000 chrome.exe 852 chrome.exe 852 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe Token: SeShutdownPrivilege 3000 chrome.exe Token: SeCreatePagefilePrivilege 3000 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe 3000 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3000 wrote to memory of 848 3000 chrome.exe 72 PID 3000 wrote to memory of 848 3000 chrome.exe 72 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 348 3000 chrome.exe 90 PID 3000 wrote to memory of 4052 3000 chrome.exe 91 PID 3000 wrote to memory of 4052 3000 chrome.exe 91 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94 PID 3000 wrote to memory of 436 3000 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mmmgoodfood.com/768r57d/#[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3000 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7ffe35d89758,0x7ffe35d89768,0x7ffe35d897782⤵PID:848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1556 --field-trial-handle=1812,i,13025400517066784432,1548836876359882468,131072 /prefetch:22⤵PID:348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1812,i,13025400517066784432,1548836876359882468,131072 /prefetch:82⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1812,i,13025400517066784432,1548836876359882468,131072 /prefetch:12⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2880 --field-trial-handle=1812,i,13025400517066784432,1548836876359882468,131072 /prefetch:12⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1812,i,13025400517066784432,1548836876359882468,131072 /prefetch:82⤵PID:436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3944 --field-trial-handle=1812,i,13025400517066784432,1548836876359882468,131072 /prefetch:12⤵PID:3096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1812,i,13025400517066784432,1548836876359882468,131072 /prefetch:82⤵PID:1088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 --field-trial-handle=1812,i,13025400517066784432,1548836876359882468,131072 /prefetch:82⤵PID:4064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3752 --field-trial-handle=1812,i,13025400517066784432,1548836876359882468,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:852
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4688
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD58acf2c7e4b9a59c54646bc6e0970888f
SHA13bad5a1e4c1398d9b1b31d75ee0c49882f56e56f
SHA25619c082d73927066fcd3571c7692f902b40b6c379131d40fd234b320120853096
SHA5121bfdd4e51890fc85d081c864bacd2e52bc374376af2d04a4d17952eeae6fe945029148a29a5a28eb2616edd2029edccf29685407c701e388d9a73327b05f6d4d
-
Filesize
6KB
MD5c8909ce23b05a51bf70e0bb4c12ce701
SHA118311a3dee6f9db235f2bc8b7f05080546561f45
SHA2566994e6e1611fa16afb3f10f078c8caab04568adfa7e243e3affb08b664ac1928
SHA512685a64515647c39212af855b803298801f4fbac5eaf39127eac9b29eaa5d590097211036f4c509d5ea122c00a483b8fd3b10bc8cd78e0c6b0e8a861dc7d18130
-
Filesize
6KB
MD5e3f5d2098856ea2a58b14aa9a195f896
SHA16e5327ef135d8ed4dbd44cb78c52d4e63d7b923b
SHA256dd2c72314db1ac658a829ce4755ffb5ce85e740ad965491619fb27362194f1df
SHA512c1239d24a0e65b9d173681f3bf56ec11d06d30220c541a6ab1c845619f4c2a84cd3fc0a567b1cf1200b25fda58d8c31270d578a1da78e511412c8183cbca779f
-
Filesize
114KB
MD54f10fb52bc160e643ecdef78fa99bb1a
SHA1bca15c4cefd3c5716cdb7228738e21aae8004f10
SHA256843fb27c5469850bb286ad787f939dfa1a55c3584a370f6aa840bb6387b6b53e
SHA512918a6062b9f47e010729d02a967cf3fccdc316cf81e888809e619e17925e88e91c6cc1cdadbd8b9d506c563fa8b00fcd057267599b64ea2848dff57f0a85a225
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd