Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
13/05/2024, 20:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.moonshadowsmalibu.com
Resource
win10v2004-20240226-en
General
-
Target
http://www.moonshadowsmalibu.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601074524382231" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2916 chrome.exe 2916 chrome.exe 4512 chrome.exe 4512 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe Token: SeShutdownPrivilege 2916 chrome.exe Token: SeCreatePagefilePrivilege 2916 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe 2916 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2916 wrote to memory of 4452 2916 chrome.exe 90 PID 2916 wrote to memory of 4452 2916 chrome.exe 90 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 3776 2916 chrome.exe 92 PID 2916 wrote to memory of 4524 2916 chrome.exe 93 PID 2916 wrote to memory of 4524 2916 chrome.exe 93 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94 PID 2916 wrote to memory of 4628 2916 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.moonshadowsmalibu.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2916 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa45ee9758,0x7ffa45ee9768,0x7ffa45ee97782⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:22⤵PID:3776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:82⤵PID:4524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:82⤵PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3152 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:12⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3288 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:12⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4384 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:82⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:82⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5116 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:12⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3300 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:12⤵PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4580 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:12⤵PID:4188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3936 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:12⤵PID:4268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4988 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:12⤵PID:4868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5040 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4940 --field-trial-handle=1732,i,4798053056540691709,8515305632873847764,131072 /prefetch:12⤵PID:2100
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4860
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1328 --field-trial-handle=3060,i,1774866140584649235,8085848018931772189,262144 --variations-seed-version /prefetch:81⤵PID:3464
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5190e976531ac07ef71e0d11335b7f241
SHA1a0848fa26dcdf6761245fd07d9a7aa234e8e3ca9
SHA256e7993a76a58b886edf4d6f22f6e41dcafe29f6cbde5189d89c9c50f6277d9e7c
SHA5126aaae1c0ffaf87cc8736b0f7472635bd654b6c26816fa8c6f52b1780de7f06c75d14c157ab0ed34df4af48b556139296fc1f2338b8f31cec96985762be86fc7d
-
Filesize
5KB
MD58867c209b757f4f0ba2ade8374dc7ca8
SHA157cafcfc542d1ac60856a9a6f2fd4b9bb8f751a3
SHA2560c9f5ca68434f1082da5853b3cf8e0036cd8fb2db4e918d560d7779a876bbf19
SHA51248cd50a15be8d6c71f89e0b908e54ac99d707575b3d7180046d8d8031c365a84b8040f752ad4ae891865074fce32f94d8c50d810482834275287ff2d7ca2449e
-
Filesize
5KB
MD56c588d397f50d468615837bd800f20b5
SHA10ea381dd427422faf564a675c09ba5ac51b38e95
SHA256b5e473f6f4dd81ab4e42435498349730a7304eabda173e2d35922a926723bb46
SHA51200f26a5ab7c6d0e59bb34197b1b29420cc3d693656a13310e20110137c0ab2fca47fe8f10d95d5aab66509fd501fba034bc21532b1e51c11309787dcd59e25cf
-
Filesize
5KB
MD50768b9d4fa8610bbdb867a06e10033df
SHA161b599a528470783da2dd84938e439ee007c6c16
SHA2564a09834dd785ca6437f68e8e31f8b102769ec039b163ad3c6989cf1cb699f002
SHA5127208cccaaa60e5161379aefb8599352b4ec8d3c40be45b6ac8600e95de66c76d4a7dc3ea4916c98309948245eb541d73031a41bc28a621f7ebbef98577d3e09a
-
Filesize
128KB
MD5cd21903a4a2595ea087a1c0ce075cd2f
SHA104536b62b6c6a25d98a6249a251bdde32952eb90
SHA2564ed2f5db0d20a11c829d3462913ea7fcebc38d3263b5d2358dc66ff6dcb0f604
SHA512d5c37d9ade5b15df668a76fd6459b7627faeed91e99d3651f3315b65a094f7c9a5df59b1333da03205d96d568e8a38a8751ade4db16532e69d0499f69fcb2fa7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd