Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/03/2024, 08:12
240312-j3w47acd4t 812/03/2024, 07:57
240312-jtdw9aea76 812/03/2024, 07:56
240312-js35raea72 812/03/2024, 07:51
240312-jp9s5aca5t 8Analysis
-
max time kernel
600s -
max time network
597s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
12/03/2024, 08:12
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bafybeihog4kdcv6u7qpf5mt3zirrdjmanxqsehbx5xxarsugpzzybnhzr4.ipfs.cf-ipfs.com/don.html#[email protected]
Resource
win11-20240221-en
General
-
Target
https://bafybeihog4kdcv6u7qpf5mt3zirrdjmanxqsehbx5xxarsugpzzybnhzr4.ipfs.cf-ipfs.com/don.html#[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133550666092792912" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2496 chrome.exe 2496 chrome.exe 4992 chrome.exe 4992 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2496 chrome.exe 2496 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe Token: SeShutdownPrivilege 2496 chrome.exe Token: SeCreatePagefilePrivilege 2496 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe 2496 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2496 wrote to memory of 4576 2496 chrome.exe 80 PID 2496 wrote to memory of 4576 2496 chrome.exe 80 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 2280 2496 chrome.exe 83 PID 2496 wrote to memory of 4736 2496 chrome.exe 84 PID 2496 wrote to memory of 4736 2496 chrome.exe 84 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85 PID 2496 wrote to memory of 3148 2496 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bafybeihog4kdcv6u7qpf5mt3zirrdjmanxqsehbx5xxarsugpzzybnhzr4.ipfs.cf-ipfs.com/don.html#[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff893429758,0x7ff893429768,0x7ff8934297782⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1796,i,9408755487077485031,7547722980398119825,131072 /prefetch:22⤵PID:2280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2076 --field-trial-handle=1796,i,9408755487077485031,7547722980398119825,131072 /prefetch:82⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2124 --field-trial-handle=1796,i,9408755487077485031,7547722980398119825,131072 /prefetch:82⤵PID:3148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1796,i,9408755487077485031,7547722980398119825,131072 /prefetch:12⤵PID:1168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2932 --field-trial-handle=1796,i,9408755487077485031,7547722980398119825,131072 /prefetch:12⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1796,i,9408755487077485031,7547722980398119825,131072 /prefetch:82⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1796,i,9408755487077485031,7547722980398119825,131072 /prefetch:82⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2652 --field-trial-handle=1796,i,9408755487077485031,7547722980398119825,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD576d4391744809d5a6572480d763ec0ea
SHA108638a250a8cb64808574428a3182e30999198bc
SHA256a862d2820a84345a1d2f80cb9bafc509583c4234ede23c3198887bf8069ac460
SHA512485a6294c786f19febd743bec5243f1fe1e26933097f20aa367a02f8c57629011022632faf7b5516bcdd2a883b1ec1a57fcd8f62eac061e1b4358eb30eefa7c6
-
Filesize
3KB
MD5902e78ad2a677a8ee1e9ce8eb2aed805
SHA155c1e50a22ea3adb942dcdcc312f78d7d5205c35
SHA25640e6fb772e2197f6b3b055f403a086c6a7a05ff1646149360717d3a93bb2bb1c
SHA512f944d772093f082eee658609eefb706aaf9c21a08d13f3c88500154dbfdfc5a5836fb21d7cca60e1a024b7c25aeaefb0e904ffd3807a2423fee5d92e9da63ff2
-
Filesize
1KB
MD5898837a512b0683944c2928f1f448b5b
SHA12743efc2eff6dc0a35297f22efb15ed5224f9119
SHA256ac8f5044870e42a641b0acf15713c9f4c1b0c3d467138d0afaaa65434740907e
SHA5125f345d5b772f1c63c19e6e2a8004bbd3a6ca75a74d8b26264ec590ba9c1bf1c25373585a1595dff15742116dcf59fed97aa3cf8c3283622e41646d725ee3a44e
-
Filesize
6KB
MD52c9784a02297460655d893f279bfa5b9
SHA1dff219a75e49cb2296fb3d53a04dbec905c22f0a
SHA2560f8f1b585afbebbfed1a55ccac72866181f451e843655816bab3a05fdc3524ee
SHA512677555b76520e4e45eb2afbaac2e46bf487b4bb093692e5473c3c34a9bd2458b691b158dc8bb00a7bb4021799bece6727795ae11d15e98a265db1200acfbff24
-
Filesize
130KB
MD55750cfa6f9305603e99cc285264a2392
SHA1473cc29c37213f26d0ce7bf7803d1dfb196e3a25
SHA256eca223920eb24556a8896d60804e8375b5428cac7f5c7b3789ac92bbfa6d3f0d
SHA512b19a4075b26fa7073d860a7e042d86c58bcf055f209f369ede9e54849916f8f0b3d2eb40e37fa3d5c6e7be4e8f4b85fd526103688c4e933851fff94403b5b30c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd