Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
81s -
max time network
82s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 02:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://gofund.me/c6ed37a0
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
https://gofund.me/c6ed37a0
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133571881144763459" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3196 chrome.exe 3196 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe Token: SeShutdownPrivilege 3196 chrome.exe Token: SeCreatePagefilePrivilege 3196 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe 3196 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3196 wrote to memory of 708 3196 chrome.exe 85 PID 3196 wrote to memory of 708 3196 chrome.exe 85 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1020 3196 chrome.exe 87 PID 3196 wrote to memory of 1512 3196 chrome.exe 88 PID 3196 wrote to memory of 1512 3196 chrome.exe 88 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89 PID 3196 wrote to memory of 1340 3196 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gofund.me/c6ed37a01⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3196 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7ee49758,0x7ffa7ee49768,0x7ffa7ee497782⤵PID:708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1876,i,14136114770340221143,3522206494289551246,131072 /prefetch:22⤵PID:1020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1876,i,14136114770340221143,3522206494289551246,131072 /prefetch:82⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1876,i,14136114770340221143,3522206494289551246,131072 /prefetch:82⤵PID:1340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2892 --field-trial-handle=1876,i,14136114770340221143,3522206494289551246,131072 /prefetch:12⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2900 --field-trial-handle=1876,i,14136114770340221143,3522206494289551246,131072 /prefetch:12⤵PID:4368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4708 --field-trial-handle=1876,i,14136114770340221143,3522206494289551246,131072 /prefetch:12⤵PID:880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5320 --field-trial-handle=1876,i,14136114770340221143,3522206494289551246,131072 /prefetch:82⤵PID:508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1876,i,14136114770340221143,3522206494289551246,131072 /prefetch:82⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d6d7fe7e1cc883308ec9e2dcebd13017
SHA1ffaba736f24c2194f2c2b111da92c4b7a01b7c92
SHA256da9108026d0bca313628ac0b0c131cd560eb66ab6a374aff405b02a6481da1db
SHA512d8b3292971b5d7bb2d1be31b42afdce98970d32cc8151f19c27ef9d0981eaf9aa551f1af45d73a233a8501eb46d090cdd92957f22767e3338707c83d379b8bbe
-
Filesize
2KB
MD59287e1bd76d9d19a331c535999e5a50d
SHA1e0cf5ce8d1a24b362cfacf6d85c4d98eeefe27ad
SHA2560c01414c7c4966ddb3eae480bdd0474da204e60cbb751a81572933d9c98a09aa
SHA5129ef8a0a06156daef666f36869519c613085c2a511fbf44be0f3d02af2e42a0f2e2246aaeeba5ebebe704c4f1f243f82281a83cc86ddaa74229e6b964a1aa7207
-
Filesize
1KB
MD501374b2133515c8900035e86f6a74d93
SHA194e6dfa3b6aa1c57a217d45d10bb2b65068e92ee
SHA256a42e99938f34c6ebd099ff165b551e75c6d2562a1915d237a83603d7ca3904f8
SHA5120b3f85e865aed78a3edf41829473e386943eaa5b081b7e915c2a8ae84278c0ebcc11aaa57a38775df3c8ea5355104ee0d8a4073f06eaf895af94c5cca4f718e7
-
Filesize
6KB
MD50ee661c13fe4bfea2bb3894a5ca1d5df
SHA100e629cc674899969a9839281f663b55b3c352d1
SHA256c9e04d39e7acad0591a811ebec200a753a1de9b6c525e5c30ef9e223801e0d99
SHA5123799b0c457fa1bb39fd7e855288e0ed76e8e49b94815bc536cf4dcf4ac87bee3e8dd53937c4eea882a8544dad0cf6736cbf8a4d09c59c6e89a920f20a5a1eea4
-
Filesize
128KB
MD5d37e9d76ae55af0ec6b3f4b766cae905
SHA17ece064437b4d97221d3c73c94d273c251093cf4
SHA2564b999dfe566ed8f3e51ce5921dcf4ce4c84be7e7a13337422767ccc76b696978
SHA5120ab591bebb55e7e6d1702e12dc841eb7c8dcd1013b7fd477eb87f74ea59c5f42e1df377a7b78287f57abf5cc16fbeacefdfe232eefb5802fc400a9eac1f8e80e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd