Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 15:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/vxunderground/MalwareSourceCode/tree/main/Python
Resource
win10v2004-20240412-en
General
-
Target
https://github.com/vxunderground/MalwareSourceCode/tree/main/Python
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 65 raw.githubusercontent.com 66 raw.githubusercontent.com -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133576695399175011" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1292 chrome.exe 1292 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe Token: SeShutdownPrivilege 1292 chrome.exe Token: SeCreatePagefilePrivilege 1292 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe 1292 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1292 wrote to memory of 60 1292 chrome.exe 85 PID 1292 wrote to memory of 60 1292 chrome.exe 85 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 5044 1292 chrome.exe 86 PID 1292 wrote to memory of 2408 1292 chrome.exe 87 PID 1292 wrote to memory of 2408 1292 chrome.exe 87 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88 PID 1292 wrote to memory of 2664 1292 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/vxunderground/MalwareSourceCode/tree/main/Python1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ae5aab58,0x7ff8ae5aab68,0x7ff8ae5aab782⤵PID:60
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1888,i,9843680459352852432,8750340079968361486,131072 /prefetch:22⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1888,i,9843680459352852432,8750340079968361486,131072 /prefetch:82⤵PID:2408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=1888,i,9843680459352852432,8750340079968361486,131072 /prefetch:82⤵PID:2664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3064 --field-trial-handle=1888,i,9843680459352852432,8750340079968361486,131072 /prefetch:12⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1888,i,9843680459352852432,8750340079968361486,131072 /prefetch:12⤵PID:3152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4388 --field-trial-handle=1888,i,9843680459352852432,8750340079968361486,131072 /prefetch:82⤵PID:4040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4652 --field-trial-handle=1888,i,9843680459352852432,8750340079968361486,131072 /prefetch:82⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4672 --field-trial-handle=1888,i,9843680459352852432,8750340079968361486,131072 /prefetch:12⤵PID:4104
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:5088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\93f5523a-a094-4e52-aca8-f7824c7ea4d8.tmp
Filesize7KB
MD5488b60643634fb34c394f25f7bda392d
SHA1afc1c1b176f734bf09b8151d531b6bbbd7516db6
SHA2566af902a064a18a16c1d828de1efd57d80cbd2fdb5c5472b0876015856f44be3e
SHA5128a8e43a48d44e4f125927119ca9774fcaf2b399a15c7ceeebaaab3dc08d1d347e7ed4839ed269bd04dbe6493d0439240ddbf1818c02df9584132f6e5dcd7ed06
-
Filesize
2KB
MD5e63e426d6f69acd0c24c5233a7f826e2
SHA13a3aa4ebdfc37fb1a3b45ecb2eae2f4e66101159
SHA256c3c1a66158d75f2e24069d15c875025211cbc020b38e2330925777cd8ac596d1
SHA512ee153992f0c6509e0ad05b3436d9bc70391831ec5f13cb17343e0569664e8577de81fef2f0495db641b508e49123ae1e40301970d4562cee7aa90855c008b946
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
2KB
MD5ba8428843e188fde1493f1a6fd19fa55
SHA19e95a7b74e2761cb1003fab49393942fb918b2c1
SHA2566179c940a6fbcf6601a2a08bf2a322c262f32097efd00b3787ad466de3c4cb1c
SHA5120d8e12734e29c93772e45f618a585b2065c9a687fb7898d1c7c2ba31435066848cb211c230603d4b3f845855c25065bd5af462a1288c0ed2441345e91d86e1f5
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5910dd145e24adb8eacc42692c178ac8b
SHA1e84a994208840d12d59bb7b9f3085b657a2edff9
SHA256ff0c1601cdf2e18dc52f8dc7aa33ab8ec3a64c2bef86828259b3054429e8ec50
SHA5124687e4fdf3c3f0d3e55ce3c2837797d342ff9b738adc35d6e38a6084a83b5017848e3e3020769ec1cabbb558b203d7b74a04a3f394395fec8967b662dddeaede
-
Filesize
1KB
MD569a072ceda4b1eae47e573de1e69cc65
SHA1f84037cc91e385a6953fce736c2e9cae5b001b35
SHA2569f4b3c6170d91178cbc09796691d6eefaa556fe3685157e0365fe9206a639caf
SHA512b5558e9d2abc3980400dc0d5a95b355223a653b0c186fd8a06568abb79f92c3e8f518755d3162b50a7bceb7b8424f25181741d6ca1812d0211d41aca2b5a8e50
-
Filesize
7KB
MD5ea62fdefa9826e3ed574f072e8e8d97d
SHA1ebdd7de1ea87d1ea0573f9e8d5af174649edd458
SHA25609448488f0c5666c21988cff714bdae08c9e4d3fbcb0d40712bb8bbd28a172c5
SHA51222e209b4a693ba5a7ad5059a625fb888b9f9689f39c875d9729dab389d4287cbdb8797d52a5efc9f8acf80b843a368b121ed5f912d9d4a9c2d8b810b7a83ec45
-
Filesize
127KB
MD50f126f9d286a9b5b817c6139cbb2f41f
SHA12be9220831a0f40508722852b675431127a2f774
SHA256fdc38507d0cc30f704fc55dec35cbecb1b3bd191fe7858b91769e0f4430cfb82
SHA512f171cda42331d10183a1f62e752c596e5125d1abe12e9323e3a8602034e428b4b1576766b8052907bbecfc503943eaa1e984a8ce4ca1b29d243b074438f35054
-
Filesize
127KB
MD510470b668d72d190950c03dd0669ffe0
SHA15b0cd8447d3baa600a6fa0a4e184e8ca1a7cba77
SHA2567f2d89d26103ac63aa132dbb81f66b76394390ec064c35aaf28cef74c4aab8ef
SHA512e3191fed1334a23e799e4c0bca7691aa95221a8c52a25eb1b32b98bf31e3995adae807d982c5d6b5a338109f6fe7366f9a6fe88e803719e0eddb27f3731af8e6