Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
22/02/2024, 20:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://burgs.io
Resource
win10-20240221-en
Behavioral task
behavioral2
Sample
http://burgs.io
Resource
win10v2004-20240221-en
Behavioral task
behavioral3
Sample
http://burgs.io
Resource
win11-20240221-en
General
-
Target
http://burgs.io
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133531071462925113" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4144 chrome.exe 4144 chrome.exe 1508 chrome.exe 1508 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe Token: SeShutdownPrivilege 4144 chrome.exe Token: SeCreatePagefilePrivilege 4144 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe 4144 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4144 wrote to memory of 4512 4144 chrome.exe 74 PID 4144 wrote to memory of 4512 4144 chrome.exe 74 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 3344 4144 chrome.exe 78 PID 4144 wrote to memory of 1328 4144 chrome.exe 76 PID 4144 wrote to memory of 1328 4144 chrome.exe 76 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77 PID 4144 wrote to memory of 4472 4144 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://burgs.io1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe77e79758,0x7ffe77e79768,0x7ffe77e797782⤵PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:82⤵PID:1328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2060 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:82⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:22⤵PID:3344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2712 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:12⤵PID:2228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2704 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:12⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3808 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:12⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3124 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:12⤵PID:700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:82⤵PID:3168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3752 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:82⤵PID:4828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3808 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:12⤵PID:4720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2604 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:12⤵PID:1320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=164 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:12⤵PID:1404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3560 --field-trial-handle=1808,i,10570128192651293598,16772197217340007848,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1508
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3380
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5ec62749028290afe7b817df2ff1c159d
SHA1f061671aa7e064e180790b751428f4dbd3b207b3
SHA25614d51a9bd818d6b2b558455a5898179ffc98ae015f2c20b17c644103c2535a0d
SHA512eb196e2784c8d8d410f4c765e4435c0d923c5fc67235baa3fee591bc7db4d4e46eead276a88775d0703f7e85aa50e809900e9a30e45597fc060580454677e2d9
-
Filesize
5KB
MD50c54504596b35b1017a02072addd1ce6
SHA191163359bf25a1c5f004114ab7abd87521d92e8f
SHA256095fc574adb4a039762d935579bab881ed1e74b4c93667d63a3fea0e2bbf9080
SHA5121b613c9b0be9405e509cc80c555816d49fe8bcfd4f456cd42426dcacd68884d2bc943c5a5b24c6a58a485d8b434fd0d6cd94e575b3c14c54399267e5cc2aa5a7
-
Filesize
5KB
MD5090965f51bf890f742d11b4b6d0c3ed3
SHA1e1c6031daea023943e3be2c5cf769d613928578b
SHA256959ffbc7a20ba2a0bd7752ebb734829de210b367fde92e5fd509cedba582393b
SHA512729761b35e817c012290515a472f83ef13160107bc60ea692ab4b4e2bb8e884a4f8e8c69cf1dd02176089d631f8d9d0c53589b07d52c00bf26c56c1e4cd579a2
-
Filesize
130KB
MD5e937c6eff94dbe61c81dcf08983fba29
SHA169bdbf8861c429891141da2bdd34340021bbf65c
SHA256a214700b6649da2e42ec911f3dbcf4728044513a2400448a677a31c3ecc5b987
SHA512d4d5943c9ca7f2ec1a6ab6ceb9d9af16155ddc858bc21fc10fba6de95bc11810f8882cb000a2620a0b37023b0d02dfa8f12857f4e03368b456b17ecfd71a0201
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd