Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
22s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
17/04/2024, 14:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://bunny1.straw.page/
Resource
win10v2004-20240412-en
windows10-2004-x64
8 signatures
30 seconds
General
-
Target
https://bunny1.straw.page/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133578393448690015" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2268 chrome.exe 2268 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2268 chrome.exe 2268 chrome.exe -
Suspicious use of AdjustPrivilegeToken 58 IoCs
description pid Process Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe Token: SeShutdownPrivilege 2268 chrome.exe Token: SeCreatePagefilePrivilege 2268 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe 2268 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2268 wrote to memory of 3296 2268 chrome.exe 88 PID 2268 wrote to memory of 3296 2268 chrome.exe 88 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3380 2268 chrome.exe 89 PID 2268 wrote to memory of 3800 2268 chrome.exe 90 PID 2268 wrote to memory of 3800 2268 chrome.exe 90 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91 PID 2268 wrote to memory of 932 2268 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bunny1.straw.page/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1797ab58,0x7ffb1797ab68,0x7ffb1797ab782⤵PID:3296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1912,i,1756594944139179291,7778102980053586089,131072 /prefetch:22⤵PID:3380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1912,i,1756594944139179291,7778102980053586089,131072 /prefetch:82⤵PID:3800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2240 --field-trial-handle=1912,i,1756594944139179291,7778102980053586089,131072 /prefetch:82⤵PID:932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1912,i,1756594944139179291,7778102980053586089,131072 /prefetch:12⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1912,i,1756594944139179291,7778102980053586089,131072 /prefetch:12⤵PID:3268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 --field-trial-handle=1912,i,1756594944139179291,7778102980053586089,131072 /prefetch:82⤵PID:1144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4220 --field-trial-handle=1912,i,1756594944139179291,7778102980053586089,131072 /prefetch:82⤵PID:1408
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4612
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD53765b1c3356566c692a584424b518d91
SHA18bfb683421bea82ff74ba60f834511ef2285222d
SHA256c3c3cd57afc7ca8e169f3181eaa75a8251d9e0d117ce6bd79937e299d35fd8e9
SHA512eebeb30d49c0c002f0b435e2e22ba3db8609cc6b476d4f8ecae0ad9e7c8afedebdbecf9c21980c5b5219db9f780a5afa780be83f4e6bb32d4f3c4af869990853
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5a386b1a834d6c92ea318570eb8d5a146
SHA1e9b0d6b8cc1079894e5aede4ebdd6a21d20be1fb
SHA2565a9d022dce193dddbc35934c5e916ece534bfaa6e7cea1823f4484dbf52e71ed
SHA51227f350f1a868b83bc97b8bb60687c4f8a9c67115a929c5585338994f2473def5166fba44cc343754feacb5ec6085c1095e030a250f06656b966950b1592cc654
-
Filesize
7KB
MD553da4f0ff0858a64272428bf3f9ae29f
SHA1950310f9b217ba87f7a35e52d4cde5e286b1c553
SHA256c4f24f741820c1c9fca167bdaa63fbb61ab90b32810e64dd707076a0d14dd32c
SHA512df9d6e788c7ce6a775128f683e07b5e2bb1aa9dc39b77142b5e806d70d64c061d2ec2fbd4f1ad5937e183633559b380f61248dc3e180fab3a776cc7579a5daa1
-
Filesize
127KB
MD5b6d07d122022c834fec0a68cc890d2f0
SHA1568b62f311628655b47c12c8c776ebb68f59440d
SHA2567043ec49f3bb1e19e5d4154f4322eb859cf282e6acff53510fd95f3914d19268
SHA512d8254e76c336ada9ca7298f61a90812c47ef51c16ed1ca48735dd9154580ac21e81c55b8f2671b15012d5deb787be0b7e273557f33516e90179adf31f33d8650