Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
13s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
12/05/2024, 21:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://motorway.co.uk/?utm_source=lovemoney&utm_medium=affiliate&utm_campaign=motorwayinnewsletter
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
http://motorway.co.uk/?utm_source=lovemoney&utm_medium=affiliate&utm_campaign=motorwayinnewsletter
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133600240026734979" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3428 chrome.exe 3428 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
description pid Process Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe Token: SeShutdownPrivilege 3428 chrome.exe Token: SeCreatePagefilePrivilege 3428 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe 3428 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3428 wrote to memory of 2528 3428 chrome.exe 73 PID 3428 wrote to memory of 2528 3428 chrome.exe 73 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 4132 3428 chrome.exe 75 PID 3428 wrote to memory of 1528 3428 chrome.exe 76 PID 3428 wrote to memory of 1528 3428 chrome.exe 76 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77 PID 3428 wrote to memory of 4624 3428 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://motorway.co.uk/?utm_source=lovemoney&utm_medium=affiliate&utm_campaign=motorwayinnewsletter1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe88119758,0x7ffe88119768,0x7ffe881197782⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1820,i,5617862600717169614,2846892571651162822,131072 /prefetch:22⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1792 --field-trial-handle=1820,i,5617862600717169614,2846892571651162822,131072 /prefetch:82⤵PID:1528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2100 --field-trial-handle=1820,i,5617862600717169614,2846892571651162822,131072 /prefetch:82⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2628 --field-trial-handle=1820,i,5617862600717169614,2846892571651162822,131072 /prefetch:12⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2640 --field-trial-handle=1820,i,5617862600717169614,2846892571651162822,131072 /prefetch:12⤵PID:484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4464 --field-trial-handle=1820,i,5617862600717169614,2846892571651162822,131072 /prefetch:12⤵PID:2892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4992 --field-trial-handle=1820,i,5617862600717169614,2846892571651162822,131072 /prefetch:12⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1820,i,5617862600717169614,2846892571651162822,131072 /prefetch:82⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2804 --field-trial-handle=1820,i,5617862600717169614,2846892571651162822,131072 /prefetch:82⤵PID:4480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5476 --field-trial-handle=1820,i,5617862600717169614,2846892571651162822,131072 /prefetch:12⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4680
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5439b547ce8f92aebdbf32162ff10fa29
SHA1375d3451c49a97314f057dbef9a6a9308be7a964
SHA256d70f6b0af8ed626be67fbba9689337d52b5673619b4fcab9bd2db0886fb3691a
SHA512a927719b14220c43a86ddfcbeeeee09a5f751da199490e9f1291627bf659ff7b29efafc59a6381b4a64b68ab2463c3f4e8bda1f618e24fbefffed1ad80fea777
-
Filesize
6KB
MD5a1a52ab34642b49ab58b5c3a671feb2d
SHA1dedfade6aa90eeca52ac1e265f4ad1fffd12a25e
SHA256909ea1844799d5515bfbc26d900abe16bfad4c0355fe3dc76bda23898ccb3c8f
SHA512f8bf37f68749ae4bf2bc673987c362d50aba835d7c6f6b4e407d470d0a08ebd97fd6cd52cb67d26f3b6fdfc9a17120f5e44d7b2a2c85125fa004002a2b5f9c91
-
Filesize
136KB
MD53ce495e985434ce80af94150791d1521
SHA16fbe381357df55cbd48392fe00513f503cb2f266
SHA256947a4833ebe09c0a15d5b5ee098fd9a401ae38328ea2ce56e7c026675bbd3255
SHA5122031cca848755514332722308ee8671fb9fba60d91f7d63d9c627a2b69681f3761701fa032a43cd19688718de7e1db6af1fa6c220bfb6abf02db8331f0b9ba3b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd