Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28/03/2024, 10:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://mub.me/MijnicsID
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://mub.me/MijnicsID
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133560954816531369" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4140 chrome.exe 4140 chrome.exe 624 chrome.exe 624 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe Token: SeShutdownPrivilege 4140 chrome.exe Token: SeCreatePagefilePrivilege 4140 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe 4140 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4140 wrote to memory of 5008 4140 chrome.exe 85 PID 4140 wrote to memory of 5008 4140 chrome.exe 85 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 4816 4140 chrome.exe 88 PID 4140 wrote to memory of 3256 4140 chrome.exe 89 PID 4140 wrote to memory of 3256 4140 chrome.exe 89 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90 PID 4140 wrote to memory of 440 4140 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://mub.me/MijnicsID1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4140 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe133f9758,0x7ffe133f9768,0x7ffe133f97782⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1868,i,13206331635463393423,4808560891670355084,131072 /prefetch:22⤵PID:4816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1868,i,13206331635463393423,4808560891670355084,131072 /prefetch:82⤵PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1868,i,13206331635463393423,4808560891670355084,131072 /prefetch:82⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1868,i,13206331635463393423,4808560891670355084,131072 /prefetch:12⤵PID:4308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1868,i,13206331635463393423,4808560891670355084,131072 /prefetch:12⤵PID:4768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4916 --field-trial-handle=1868,i,13206331635463393423,4808560891670355084,131072 /prefetch:12⤵PID:3964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1868,i,13206331635463393423,4808560891670355084,131072 /prefetch:82⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1868,i,13206331635463393423,4808560891670355084,131072 /prefetch:82⤵PID:4336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3224 --field-trial-handle=1868,i,13206331635463393423,4808560891670355084,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:624
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:376
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
859B
MD58d9d89df8f4ad5c8b5b33f47ff34254e
SHA131502db1132135703bdc5dc4bd6f442e6e49959e
SHA2569a9546602c0f6b6c7b4e3ed5e69a4d31ea4bc04e29f62b09d80c94e7627a21ed
SHA51206629693f52d8a5ff15287200b2911b4423b9ba937c6d838826ddd4f6206ae66f81075cd3a11e089aadf3036322689bb5e162998df9c5e8373fdc3c7b98de651
-
Filesize
6KB
MD55d2ab864dd4f502056491cbc5465c561
SHA1f3f23078ad10712ec324a480e5024bf8e59b2fd0
SHA2568a14457932d7c9338bfe161b10aa05fc94cdd06774e2f08e8e0f5175f39ad741
SHA5128c3a49193f4593d3c74069230ce27915674d6897fc4f6f4d8e0fe0aac9f010302cea1bff8a21ff6c214e64f0b8170416cc166cd33d58147fad3b99a8b1974e8c
-
Filesize
6KB
MD5296aaff06d776ca14e2ee8e91dc8233e
SHA1bb46e0bc6c11b69e5d34c296cdb7794ee20df446
SHA25621574cf775d84bfb86b79660fffc0b8d426be852dd1a9a9c6916db2f7576988a
SHA512350afb9850000829f23bd5f3068378b930c68e4ede88e741dfaeca189c418fe9c94a9ca16ab04e657befc6997eed70405178d988c8e14f00fff45a4b695289c0
-
Filesize
128KB
MD5450a88729b0c4f8a37395ca64295b109
SHA102e6191647a10d687955017f693d44477df9b1ad
SHA256e1f011713a66bb84da7377e3bc81aaaffd16d6a33da8f02347d80bfdab805082
SHA5120974771f48c40151280075f662deb78f76d22cccd52b57951b60aaca8056ec2003e9ef1fd4255da30de216e7f899a28e5cdb765a3b84d36572bcad5d520c6d27
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd