Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1684s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
01/03/2024, 13:53
Static task
static1
Behavioral task
behavioral1
Sample
destroy-securly-main.zip
Resource
win11-20240221-en
windows11-21h2-x64
10 signatures
1800 seconds
Behavioral task
behavioral2
Sample
destroy-securly-main/index.html
Resource
win11-20240221-en
windows11-21h2-x64
8 signatures
1800 seconds
Behavioral task
behavioral3
Sample
destroy-securly-main/script.js
Resource
win11-20240221-en
windows11-21h2-x64
0 signatures
1800 seconds
Behavioral task
behavioral4
Sample
destroy-securly-main/style.css
Resource
win11-20240221-en
windows11-21h2-x64
3 signatures
1800 seconds
General
-
Target
destroy-securly-main/index.html
-
Size
758B
-
MD5
2b351b0dcb28b778cd18ff5888415c03
-
SHA1
faa9cdf1c49786c762969b673bfd8d4751d2f58e
-
SHA256
7ea2c19aecbdc8c8f3f1ca2774079ae72ef2524825bb9ceaa9604f49b4927bca
-
SHA512
b395fc4f3d8f0e87a5c57191073b4676367cd314a0a4d5c36fec80d8d766893653f14e49af95b781b7b820f8373cbe2338d52775cf95fcf0c9b5cd12b0f763e9
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133537748828635918" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 464 chrome.exe 464 chrome.exe 472 chrome.exe 472 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 464 chrome.exe 464 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe Token: SeShutdownPrivilege 464 chrome.exe Token: SeCreatePagefilePrivilege 464 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe 464 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 464 wrote to memory of 3992 464 chrome.exe 78 PID 464 wrote to memory of 3992 464 chrome.exe 78 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 5028 464 chrome.exe 80 PID 464 wrote to memory of 1568 464 chrome.exe 81 PID 464 wrote to memory of 1568 464 chrome.exe 81 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82 PID 464 wrote to memory of 3640 464 chrome.exe 82
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\destroy-securly-main\index.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:464 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd71659758,0x7ffd71659768,0x7ffd716597782⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1836,i,13999932128498755417,16501927584580728349,131072 /prefetch:22⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1836,i,13999932128498755417,16501927584580728349,131072 /prefetch:82⤵PID:1568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1836,i,13999932128498755417,16501927584580728349,131072 /prefetch:82⤵PID:3640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3068 --field-trial-handle=1836,i,13999932128498755417,16501927584580728349,131072 /prefetch:12⤵PID:4952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1836,i,13999932128498755417,16501927584580728349,131072 /prefetch:12⤵PID:1908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3916 --field-trial-handle=1836,i,13999932128498755417,16501927584580728349,131072 /prefetch:82⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1836,i,13999932128498755417,16501927584580728349,131072 /prefetch:82⤵PID:1548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2796 --field-trial-handle=1836,i,13999932128498755417,16501927584580728349,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:472
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD571ea4b577fe98645553d2c11ef65f82d
SHA105411741fc397e75fea0ef6456ffc21076a0acf2
SHA256515a7ecb0e8f2ba0778db8ee003f32c50c44c86b2358708b533cd252817a500b
SHA512861d9b80f700c2cb07e5bcf991fbccf7a4c94fe166c241bfdbda3796ea65306850262c470a14ba7c1e8fb929fb165d639c5e6ab843d8abcd6dd72cb6e6042dad
-
Filesize
6KB
MD5d644a5b8d082429f037ebc6dcb89b1a9
SHA1d73ab8233e23f40e91db0cb114df2512c669f716
SHA256fc37dc5282c8720f4d7b68826fc54345fce21eec8933ae13c0dbef904c7c5b1b
SHA512ce12a29be3e3ef34311e67ad6911e77643041f1844c72ae6e86ee15b69db806b2d5455ea07eb6a494f7426e4e4e863275e31a1e361f89f26b53071e056a0d7c1
-
Filesize
256KB
MD556b502853845f6dc15e18dd6c686a0ae
SHA1dd012b9b5dc2b074f9b715f916789d3da942c063
SHA2563f55f4318e66c45ada25197ba664830113e6b667f75aad3eab1e9dc4ba1b4a73
SHA5126e2852a1224691ee502021698ab4128ed225cce6842e09dcecc8e84bdacbf6e4401c31e9b460b669ccd912435d96293335689e954163ffcb16d41b7b6ad316a3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd