Analysis
-
max time kernel
93s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/03/2024, 18:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://tria.ge/240306-v87zesea32/
Resource
win7-20240221-en
windows7-x64
6 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://tria.ge/240306-v87zesea32/
Resource
win10-20240221-en
windows10-1703-x64
8 signatures
1800 seconds
Behavioral task
behavioral3
Sample
https://tria.ge/240306-v87zesea32/
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
1800 seconds
General
-
Target
https://tria.ge/240306-v87zesea32/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133542231034754354" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3680 chrome.exe 3680 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe Token: SeShutdownPrivilege 3680 chrome.exe Token: SeCreatePagefilePrivilege 3680 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe 3680 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3680 wrote to memory of 4876 3680 chrome.exe 88 PID 3680 wrote to memory of 4876 3680 chrome.exe 88 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 4816 3680 chrome.exe 90 PID 3680 wrote to memory of 2840 3680 chrome.exe 91 PID 3680 wrote to memory of 2840 3680 chrome.exe 91 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92 PID 3680 wrote to memory of 3712 3680 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tria.ge/240306-v87zesea32/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3680 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff859129758,0x7ff859129768,0x7ff8591297782⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1872,i,11672267724945031467,7199691672587781155,131072 /prefetch:22⤵PID:4816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1872,i,11672267724945031467,7199691672587781155,131072 /prefetch:82⤵PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1872,i,11672267724945031467,7199691672587781155,131072 /prefetch:82⤵PID:3712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1872,i,11672267724945031467,7199691672587781155,131072 /prefetch:12⤵PID:4040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1872,i,11672267724945031467,7199691672587781155,131072 /prefetch:12⤵PID:916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4528 --field-trial-handle=1872,i,11672267724945031467,7199691672587781155,131072 /prefetch:12⤵PID:4088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1872,i,11672267724945031467,7199691672587781155,131072 /prefetch:82⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1872,i,11672267724945031467,7199691672587781155,131072 /prefetch:82⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD5024d850d822748dcb1bca1c0fccf9c0d
SHA198898feccce1cef1ba4d1571dabade5f3fb8f791
SHA256b2afde827fbc582b86a655c8c4aa5ffa4100db621a82421701bc1f582b340ebd
SHA5125c1d8c47dcc1063afcec72664690f045fa0955acd2e99e0583d18706e4c2a22c4d55eed49964f19e5b777040c22200a600f9847792116954d1a5171f3db9003b
-
Filesize
1KB
MD5ce9b3e9950ff922c6dc70aa46eb4eb3a
SHA18ec1777041920c5dcd00dcf9d5c7c8a3fb4dc8f4
SHA256c401530e6b48f011cc8017ea7710f44c0531f2a0ee2522397f151ae955467685
SHA512eadd079c7c37c4559bc60cf63f742506580bef5967c189a0430b396cc887ba5521e139e1e34b2e2e06343d4aefd5397e19db6de0265b69b05c35baea2cce2cf6
-
Filesize
539B
MD5a35be62212a4985542ee1fc185f4d9da
SHA1bdc0dafdea42fb1757e71b9baa605629bf6249b4
SHA256e4c5470c7ac90e99de27f2ba834fd0c40a32821067d22a3bda6c246861f6075a
SHA51264848c79616f7116dc7a5d9e679f9cfa9342e811a48b42e800079b4f7c2cf3c7518dfe1533bc5ef324d21cb165b00a62d415280599376baea5c87f08396e32de
-
Filesize
6KB
MD531b96202a075ac1ff7c05660f1500a17
SHA1421cd6a09e2ab5bcb0900534a3dd9cae222da8fa
SHA256f82262b048a11b4e1e2d3d3e5d9b92d33535094c1c50e52ccaa03d5fc7cb9ae1
SHA512ae298a6c016de51839257d5dd28d7bd6aef1d41823c7ccfbf4a369de33f827e8184c44f28f20e60782625bcf6ddf9e560274ee72e02dd2a598032f3090dac3cb
-
Filesize
128KB
MD5e65186cb0a8cc01a8248850ab78fd800
SHA1a0d3b9495567c807a52645eb2272fd04f98b6d98
SHA256094e80187f2e36a1c2d4fcff17ee023f61bee99b25f3865c4c3ffbf9827bab2d
SHA512a4025870419039f53f0b57115f407bf2d8e3c0c58099f3dc3a4e9bbe2611ccaa42a1eecbf9c3d6e67b23052fd9ca188d217699757266a4378ccc4c0f10f05b20
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd