Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1690s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
22/05/2024, 01:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://s2r.tn/cgi/
Resource
win7-20240221-en
windows7-x64
6 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://s2r.tn/cgi/
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
1800 seconds
Behavioral task
behavioral3
Sample
https://s2r.tn/cgi/
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
1800 seconds
General
-
Target
https://s2r.tn/cgi/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133608149356604684" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3508 chrome.exe 3508 chrome.exe 3220 chrome.exe 3220 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3508 chrome.exe 3508 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe Token: SeShutdownPrivilege 3508 chrome.exe Token: SeCreatePagefilePrivilege 3508 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe 3508 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3508 wrote to memory of 3524 3508 chrome.exe 72 PID 3508 wrote to memory of 3524 3508 chrome.exe 72 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 196 3508 chrome.exe 74 PID 3508 wrote to memory of 1632 3508 chrome.exe 75 PID 3508 wrote to memory of 1632 3508 chrome.exe 75 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76 PID 3508 wrote to memory of 1756 3508 chrome.exe 76
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://s2r.tn/cgi/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3508 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff994079758,0x7ff994079768,0x7ff9940797782⤵PID:3524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1856,i,17995539883275524015,3124316547447628309,131072 /prefetch:22⤵PID:196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1688 --field-trial-handle=1856,i,17995539883275524015,3124316547447628309,131072 /prefetch:82⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1856,i,17995539883275524015,3124316547447628309,131072 /prefetch:82⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1856,i,17995539883275524015,3124316547447628309,131072 /prefetch:12⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3080 --field-trial-handle=1856,i,17995539883275524015,3124316547447628309,131072 /prefetch:12⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4648 --field-trial-handle=1856,i,17995539883275524015,3124316547447628309,131072 /prefetch:82⤵PID:4416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4744 --field-trial-handle=1856,i,17995539883275524015,3124316547447628309,131072 /prefetch:82⤵PID:4396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3748 --field-trial-handle=1856,i,17995539883275524015,3124316547447628309,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3220
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4744
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
548B
MD5257b79401e2288a45a1d920447ee9392
SHA124a3dca945ad3a3b2fbbd82df763d5686595b1c5
SHA256cf3b336379a043fbc364e1e845b5497d55f8cc530cf091515feb7e20aafda1e7
SHA512496f43050d95c3a8e2bb25ee88d6f790c0afba1c693232b191f014c8b2bfc5d0352145c7c0764a5490ca8b3e4d4666c1edaf2ac1436d05de23736b1c6535aeb1
-
Filesize
6KB
MD5e8e94111fc7fcaf3ed73415340b3f979
SHA1307c26af77ca9f4f842267ba8a19ff253abdd1e5
SHA2564a90bb1083ca341bf3a3e9e60ef232a7b4f663324001ae2548186f0b2c78f09b
SHA5125805a6d3db712aea0ffa1def11b1f2485e018cad1e75a2326b75c7dadf12d7c0401a6020132840197f188c887c1b5f4364655920e40b923321550bcafb745a8d
-
Filesize
6KB
MD58a8be28dd3c70d48ff736c77bec78e75
SHA124d814056bf4a362ebcc38d647cd7d8a6f4e76df
SHA2560c6e910f7a84139c35555f437a4b8c7fd8a192a79f8c360dcd87d4751baea058
SHA5122fd749a921d9795710fc0e9dbd1451c0311d15c87ee9cabb42201274cbfe2e61f6d047d7b9382fe62b2fba020760a6422665617f069130acebdebbb0e9922e63
-
Filesize
6KB
MD506168eb21c711899ad3d845250042f89
SHA1fd9c2064ef8039c2c4084929795332f3746c54e6
SHA25618874aaf0acacabbcb3b414859b1eb4b1c8603abe1d78adea19648c0a7008df5
SHA512b97238f8973d039999f8e7bfa969e88251d0747cbc4c75a4e992fa63b2e49c9cd4dd0693fb518202991976c514425779b9dfd1f86c2a52157e0164c84714f8b9
-
Filesize
136KB
MD5b753776a321feb285e753614b0c29fbe
SHA10f3fe940c137cd7165696ec0b100440044a3659c
SHA2565a021d0d4ba4e88676f672b45750395d30c2d4afc8cd5f6987e67bfa050131ff
SHA512a16bf9ff255fb709eb3e4470d35ea662765d06176e8ee55db4fed6375c3887667d43f7ee6c91d61fa3e3feff4dc21efe8311a01a14f2bb1ecfe680523373f7e3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd