Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1685s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
04/06/2024, 02:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://archive.org/details/WinXP.Horror.DestructiveCreatedByWobbyChip_201903
Resource
win10-20240404-en
General
-
Target
http://archive.org/details/WinXP.Horror.DestructiveCreatedByWobbyChip_201903
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133619439476443540" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2752 chrome.exe 2752 chrome.exe 4196 chrome.exe 4196 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe Token: SeShutdownPrivilege 2752 chrome.exe Token: SeCreatePagefilePrivilege 2752 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe 2752 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2752 wrote to memory of 1464 2752 chrome.exe 73 PID 2752 wrote to memory of 1464 2752 chrome.exe 73 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 800 2752 chrome.exe 75 PID 2752 wrote to memory of 4304 2752 chrome.exe 76 PID 2752 wrote to memory of 4304 2752 chrome.exe 76 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77 PID 2752 wrote to memory of 4584 2752 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://archive.org/details/WinXP.Horror.DestructiveCreatedByWobbyChip_2019031⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7fffe2289758,0x7fffe2289768,0x7fffe22897782⤵PID:1464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1852,i,10330836287160698469,6536901999854487174,131072 /prefetch:22⤵PID:800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1768 --field-trial-handle=1852,i,10330836287160698469,6536901999854487174,131072 /prefetch:82⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1984 --field-trial-handle=1852,i,10330836287160698469,6536901999854487174,131072 /prefetch:82⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2512 --field-trial-handle=1852,i,10330836287160698469,6536901999854487174,131072 /prefetch:12⤵PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2520 --field-trial-handle=1852,i,10330836287160698469,6536901999854487174,131072 /prefetch:12⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4408 --field-trial-handle=1852,i,10330836287160698469,6536901999854487174,131072 /prefetch:12⤵PID:3860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4768 --field-trial-handle=1852,i,10330836287160698469,6536901999854487174,131072 /prefetch:82⤵PID:1824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4764 --field-trial-handle=1852,i,10330836287160698469,6536901999854487174,131072 /prefetch:82⤵PID:1868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 --field-trial-handle=1852,i,10330836287160698469,6536901999854487174,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4196
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4920
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5fccda9a4c5522e2605f31b5af9d5a680
SHA1808ef8ca59340312ae8ac6db9b6762d5818d484f
SHA256adb361b48ce40f8a95cc0e369a9a0d56736f40df86f8c555e1dd0fd9ad8c7b41
SHA5129c06421bf81baae67a033c8269645ae87e918be2f8650b2ee13423db327b111ef9e40169741ee76b31eb743c37b6ab8ce88f60b4f18f13310197ac7258ad32ad
-
Filesize
917B
MD58b14455c4bd4ebffbf425e9b0d8ff715
SHA1779c378166b0d5f58e69c96b4f0b0a9ce66191de
SHA256741734f4acb62d2748eff4d3d8d53e8d5dedad52b2b17347bc400d6d7482afb1
SHA5124a6a7d11bfb3fb2b92f2bc3b7eb42c9f8d999022e7f118337adf8fe42648220691173f2e6b7a578b06ce46f9e3dca47aacc72a9576bf08da73ff289de1f5910c
-
Filesize
707B
MD5a033b9b127756e7ce8179d1a9329556c
SHA121295bf2971c665759b3820045a61161b7aa3c05
SHA25685fb783d66d4003737f1e8e98f6fce7d65bae7a9ef31e22cefd6cc69c2f6ec0c
SHA51275f9bf21f6267720ebc3ef631b9f52a41ea3ed50056787ffd0aff3b1028a0555fa88e53a574b42b3d69b762fa6760d67223727b4310409979db00131e2eb4d86
-
Filesize
6KB
MD5c1cbe290f5474a486824d45a4f7aaf87
SHA15637d56b9f0ab9085b22df729c60c7e967f88f4d
SHA2560660ec7f461dead961be8328cc773fb4d96f50e5a780f6c5a2c1b2147225c092
SHA512818c457accd5ae83a1daae5a7250e0e1aefa1761269df458982678c672e4178cc8fd16a0c69472074b4639045091e0efcce7ffe99baa851bf742c6f14ddf2a4c
-
Filesize
6KB
MD56053ce630a408df9326951674e4915ba
SHA174154088f0a3cb11587ced8c6642456aa57d03a0
SHA256d32679c76450ada2f969c10e762cd225446dc3a3c77c944650f181c50e370e10
SHA512ea6f871054dae0598fc72eca61600c7af610e9259aa851d5a42e5e10ccdcd21ea42ecf0b1fbf4d9c08f6a36977e83203e8d74847f435c6c15dc9ffde3424fb5f
-
Filesize
6KB
MD509605323074f617fccc999b12a66b4df
SHA106fa33ea285d223295108e2ce2b9a7affa8e1d52
SHA256cfb4f70afbff99a48ccba56326070ddf5dac206837a32e4f3ff78f82fa815dbe
SHA512ec0eefc0438aec8f777f0d80fa3c6e0569bd89d990c6735ce22c0469ece1712c0d7a5d614b2d3849f1e59ef89b3d134f687004f50a0b503610a1e17b9b78be59
-
Filesize
136KB
MD5af1ccd62c3d472eb3152f1981c030938
SHA1410ae0e303dfaec8891f63724bf4a5be7aae316d
SHA25637b4bbcf6b9daaf96f22b19cd202ff184b6e41ed66e8d926ea425348d50bf46d
SHA512506fb0a7afb0cfcd85123270d88d7058a38cb4a636030bdaad5a9bfd1406baecd24d7e6db2d37c3de49c84d1e4456d35b90bacedfcb94676b03877e7c71d329d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd