Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
25/04/2024, 02:21
240425-cta22ade63 825/04/2024, 02:17
240425-cq5ggade43 825/04/2024, 01:54
240425-cbrbasdd5z 8Analysis
-
max time kernel
299s -
max time network
274s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 01:54
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://seoulsecure.vercel.app/[email protected]
Resource
win10v2004-20240412-en
General
-
Target
http://seoulsecure.vercel.app/[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133584836799680766" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 844 chrome.exe 844 chrome.exe 4584 chrome.exe 4584 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 844 chrome.exe 844 chrome.exe 844 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 1604 844 chrome.exe 86 PID 844 wrote to memory of 1604 844 chrome.exe 86 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2020 844 chrome.exe 87 PID 844 wrote to memory of 2440 844 chrome.exe 88 PID 844 wrote to memory of 2440 844 chrome.exe 88 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89 PID 844 wrote to memory of 5052 844 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://seoulsecure.vercel.app/[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffc824eab58,0x7ffc824eab68,0x7ffc824eab782⤵PID:1604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1892,i,11763728451822369606,8233150312847567967,131072 /prefetch:22⤵PID:2020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1892,i,11763728451822369606,8233150312847567967,131072 /prefetch:82⤵PID:2440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2240 --field-trial-handle=1892,i,11763728451822369606,8233150312847567967,131072 /prefetch:82⤵PID:5052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1892,i,11763728451822369606,8233150312847567967,131072 /prefetch:12⤵PID:2624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2972 --field-trial-handle=1892,i,11763728451822369606,8233150312847567967,131072 /prefetch:12⤵PID:2256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4268 --field-trial-handle=1892,i,11763728451822369606,8233150312847567967,131072 /prefetch:12⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4400 --field-trial-handle=1892,i,11763728451822369606,8233150312847567967,131072 /prefetch:82⤵PID:3336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3248 --field-trial-handle=1892,i,11763728451822369606,8233150312847567967,131072 /prefetch:82⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 --field-trial-handle=1892,i,11763728451822369606,8233150312847567967,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4584
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5c8c51e530a023ba729a60fcd2788862f
SHA1afec0be7345272c5c88f5729085ddc7ba8861989
SHA2568691a01d93f40e8b787d7214479d4651a5eb51b5d0d03cd250a187b18057edb3
SHA512c8eb59e96d7a8a699d0ad42a31c051b71c501c0c82a06604f72e1a39fbbd3414de532c919f18864473078687449f82f49579a6fd529a6eacf073213dc420d99f
-
Filesize
2KB
MD5264beb4cf7ec4eb745d6fda14d42dd4f
SHA1302f7f7d3b1398a3f1c24fff5ae972a23ce90e61
SHA256c4976b222497586b3c1608a936defba5d11814dad1fc1038f31088f4c8f04f97
SHA5128f08ff14dd33786ec0b1f8a94ee8ed9f1d67eef6dfa70c599a5194171b6ee054fc1eeb68c81b88907501d6b0278b58671bf7f0754a9e9e45bdb557138df90750
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
691B
MD5ba22ce3e8570b41ee4e56bb65e74a0da
SHA142f264027d820576e3e87af2baf975f7c4767e41
SHA25623df50d36dd50602d20cba142066dc895989e142e7f66bc0af53fb4481d9eab2
SHA512300cd615435c443db7e6830bae69b6db28b83e9e764208b24b8dacee8b78ade45f93d48fd36ac2009240be75eb4153fb4b738f360b89934a43a1ecf487644062
-
Filesize
858B
MD523a0ad39f8c54fdbe05222ab7c718d17
SHA106b7a4112450fd5f5b1bcf8be37ef1ae59eddd55
SHA2566084e78e4cf03b44b4096bc2d79a8718ae0721263cce80294ef45194a1356f41
SHA51242af788ab08e20e95deec62d0c878975f973bdadd72a4de4eaee7b6dd2e1a085f9c2a78b69b172e15b3a59ecdf7d6a4a91a4cc8c9125039f4f0928177d932265
-
Filesize
691B
MD50263847135e2e2fa53377df998701385
SHA1be1e7ee207be3383d6a9f95cc26029b18bdbac39
SHA2564eff2ab29b63791914bb5058d7a8b99626480ce9458e76e619eeb9797f0d8745
SHA512b068f4b7fa99a6565061e3a0c6112f606159610b2053885b0579a4dcb2d21fd8baf3ebbb3c634c48361e0745576cfc1d6133f3a91871108c0e410ed8d77f9b64
-
Filesize
7KB
MD5b9a4459bc15e24997ef3fbbc01a1b357
SHA1648ac0ed89d9040df548d67b77fdbabd8e68a8b8
SHA2564c5f6ccc5a77a5fedb43db978a937bdb251aa9860f271418d880164d907c2659
SHA51270c1c5e61507a65e3c5f33ef5e014646996fdb6c09e88262a1809a1b97d541b1a295a3e6cd47c1ab1199b64d0b8fb103e17607d7369966f21bf7e406a998a73b
-
Filesize
7KB
MD5a412f572ca6e5e956c7d48d000303247
SHA14aa066df9e6d247c1a374320e10a9d0bf272ee88
SHA256e4d04ecff9e0870207942f6c59807092fb6ccf9e0511899f962bf5780162a63b
SHA512b26b40cd65203a431f064ff12b03e7a9bc3119eef6e1cbd1b52e29df5842ce9e58b406d3f1e6352826ffddf3943639d6b8480a7ea1d2a3e57aac9c0e884423bf
-
Filesize
7KB
MD5ed85775bef19d58b240efb33d3b1df6a
SHA18cac90df52f9d72d527cf6f3b5ba47bf477c916b
SHA256306d633e7899712c339a3c59e705657bd4831a4c91ee01171ecf6643a6362c80
SHA512fd88dfa1c6b9a21eab73a231340f82fd5e838719fcc848a537ecbcb52f0b4ba22cb3365fbfa7ad929b68cff345c85d0e264b5c65ac9a681ad3b9ad7d94cf8f1b
-
Filesize
7KB
MD55230cbb4cd6faff676214f4213473713
SHA1089109bffdf372b218ad7bc276a1b529c6bd99c0
SHA256fdf9b78f234f523088d7f91238530de933d7b4904012ab50d1b1a2d0a2c6b5df
SHA5121b460f00ba39dfee2358e8122c1584974e24f5d04a429845c04203001cea23ea54703bd7fd46b7eb87749877256357d5f156ad4651b2f91c7f5ad87dc7873cfc
-
Filesize
7KB
MD55ab338f414f07dfd3ba8c618e9443a4b
SHA16cec895b9c45286778e314f231e6c3a844266383
SHA256da280a07e875ce486cd494e9580f6c7db193a36d2710dbdd36ece5a10edbb60f
SHA5123c5b7eeae0658a091797965e303adb090fa1923b063d8497527d7b9b31b2e8c556da71a4581fd9220574910bb69f1bfafe02c2c0eccd10fe0ba382eeaf25d346
-
Filesize
127KB
MD53faea1be49f2b3f139b0f0cffb96a9da
SHA1ea694a8f914cd858cf459091fd8b6577ca93bfd2
SHA2561e9b460603bcae5d7b050f06bbeac3d9f31945cff256c2b1f0146508b2f29b3d
SHA512337eecdfe9abb4633546132774657bb6f483580e1482e6cabb08b8c3a9875bd36629056ff4208e22ea3a233e36a7efa60062e92d19bdc66eeafda708e24545dc