Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17/02/2024, 20:49
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ketuy.com/
Resource
win10v2004-20231215-en
General
-
Target
https://ketuy.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133526766116713926" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4936 chrome.exe 4936 chrome.exe 4792 chrome.exe 4792 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4936 wrote to memory of 3992 4936 chrome.exe 85 PID 4936 wrote to memory of 3992 4936 chrome.exe 85 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3180 4936 chrome.exe 87 PID 4936 wrote to memory of 3640 4936 chrome.exe 88 PID 4936 wrote to memory of 3640 4936 chrome.exe 88 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89 PID 4936 wrote to memory of 4240 4936 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ketuy.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce68a9758,0x7ffce68a9768,0x7ffce68a97782⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:22⤵PID:3180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:82⤵PID:3640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:82⤵PID:4240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:12⤵PID:4188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2940 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:12⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2816 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:12⤵PID:1644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5004 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:12⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5048 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:12⤵PID:1144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5384 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:82⤵PID:4412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:82⤵PID:3912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4988 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:12⤵PID:1476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4060 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:12⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5592 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:12⤵PID:2924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=5584 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:12⤵PID:1972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 --field-trial-handle=1884,i,14923699822203982533,4956917657355649106,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4792
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4888
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
792B
MD51746238678335523e1992eb577fa2124
SHA101fb93671368198f69c55a29d00d1e9d93672759
SHA256e5f85e76722fb4f9d1738c13d27eaf8a59d301e1181bee1a8d06687419bc877b
SHA512549153bbbe262fd8aff0163888dc4bc115091bf333764904d973cf8c8c7530d90d3ee9dfc501fe0fa2ed74dba0a9fd9e703456b7f44217d8cd31df2a3ca068f3
-
Filesize
4KB
MD5d1b0886b055027c046b0c94ac3490b9b
SHA1c3974c8fd2367224b7fd66f77d3a8ef8e20654b4
SHA25610055c4498b1c3f07913e255a4d23ea3c8bd437bb898ae66f99cbd19614d3dc1
SHA5120e47d96c272482e1cc9e82958bfe7d1446814b301b09a8a78f685534e5db57e99d1e9aaec189ced296eab33a543da598a253677c808ec69b86f2fd45a94e6233
-
Filesize
874B
MD5704f6cf96a73555da2cfc5fe4840ba96
SHA156a128a240e3f357696542d943999b29131b0c97
SHA256c0a216ae19fe5678857fc7deeb584e0544e06e9c47afa8ebd6fbe5f60c20c3c3
SHA512db1d89be9ca9134d1c93b56e05bbacb75aceef579f1b12252813fabf8c1dadd83c24270f35eb74facd0eb2efd313a39500cd88f191429037993e122bd3dad6c9
-
Filesize
6KB
MD54152a583c021c3f28898c4395682d32b
SHA1c2ece82a4f098734c43dc7f1cd38815f112d07ba
SHA256c66c358ef5f58f4d40454eb8224c48cc17dd3b8aaf162e1d5ef700167c55fabd
SHA512776410d4a278e723cab1cc658b3a2f27f71dc8e10a8627d03cb1efd147f54ac941d61037efa5578ae900da9969969c3606b31fd99028c917c06af616530234a3
-
Filesize
114KB
MD55fae41e54b311d02a97c0b69b24125d0
SHA1c8d0ab84fa4f67ac3204060402a362e8a4881240
SHA25686782e82105ed1fec231f5b3af2e2a3dfcad34dd7fbd8da73a65cd5d452183bc
SHA5129c174b2fc8b091e654294dfb2208198b5c2d3e6d010525b6ebae22cedce360549e55dc8788ec7fe6d3011a3952aa112e1634b5a5d287eb0d994bc784e8ebe4af
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd