Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
38s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
05/06/2024, 00:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://matias.me/nsfw/
Resource
win10v2004-20240508-en
General
-
Target
https://matias.me/nsfw/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133620223282482631" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 548 chrome.exe 548 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 548 chrome.exe 548 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: 33 2840 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 2840 AUDIODG.EXE Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe Token: SeShutdownPrivilege 548 chrome.exe Token: SeCreatePagefilePrivilege 548 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe 548 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 548 wrote to memory of 2004 548 chrome.exe 82 PID 548 wrote to memory of 2004 548 chrome.exe 82 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 2892 548 chrome.exe 83 PID 548 wrote to memory of 1740 548 chrome.exe 84 PID 548 wrote to memory of 1740 548 chrome.exe 84 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85 PID 548 wrote to memory of 2240 548 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://matias.me/nsfw/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedb2cab58,0x7ffedb2cab68,0x7ffedb2cab782⤵PID:2004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1940,i,16347427727413154974,18083365520044043988,131072 /prefetch:22⤵PID:2892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1852 --field-trial-handle=1940,i,16347427727413154974,18083365520044043988,131072 /prefetch:82⤵PID:1740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2288 --field-trial-handle=1940,i,16347427727413154974,18083365520044043988,131072 /prefetch:82⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1940,i,16347427727413154974,18083365520044043988,131072 /prefetch:12⤵PID:3604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3044 --field-trial-handle=1940,i,16347427727413154974,18083365520044043988,131072 /prefetch:12⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4228 --field-trial-handle=1940,i,16347427727413154974,18083365520044043988,131072 /prefetch:82⤵PID:3504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4520 --field-trial-handle=1940,i,16347427727413154974,18083365520044043988,131072 /prefetch:82⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 --field-trial-handle=1940,i,16347427727413154974,18083365520044043988,131072 /prefetch:82⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4736 --field-trial-handle=1940,i,16347427727413154974,18083365520044043988,131072 /prefetch:82⤵PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4712 --field-trial-handle=1940,i,16347427727413154974,18083365520044043988,131072 /prefetch:82⤵PID:2264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3916 --field-trial-handle=1940,i,16347427727413154974,18083365520044043988,131072 /prefetch:82⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1940,i,16347427727413154974,18083365520044043988,131072 /prefetch:82⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3084
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4bc 0x4241⤵
- Suspicious use of AdjustPrivilegeToken
PID:2840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD5f2b14cfc664eb3cef2f0a42befea7155
SHA13da66284cde8abeed5995c76f8bcc64265854459
SHA256ae9ddc304f7f1e7e2c7b0290c33947f7ddccec05dd6bef9ae07cfe3123e1e247
SHA512fb96e9cbd60a31d4bba8d9ce798fc35f3d687b033ec5b4f0aa783c1f6edc3520958bd0240119c2e0efc6b01367d91cd4eabb48e9678340b27d165ebf3f998ce7
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5dc527220e06d042e5d0f67b9fab51be9
SHA1e600301cf8d6348e99ebbc0397191125d2d2b433
SHA256366051e3074655f73fbdc5a320e3335b0253ae1afec8c19acb1641c9cfe7d2e8
SHA5124120d042743b215968019e494698fa5ef8ff03bf3b6eebee9b5a392c2062199c588d0faeebe0ceb4bec378e5124e14863a7e0dfc7ad355b5575310a4a329090e
-
Filesize
257KB
MD5a5e9383b8c1067aa1b059e041e1de81c
SHA13d71852e356585c57878d0ff469305b936e12502
SHA2569a2bb9ee21a6d0711a6945c3eed3d7d1c1bf47f2e3db57f093926352a04f1b17
SHA512216bdb211a72f78c32873de29386fd0575892854d63c73b96746be92dd97d70c3658fc5e75133938e77627194d01e574632a6d5693b28a85599abb63a485b856
-
Filesize
257KB
MD511f6d48655dd6cf7021c62ce3f7a571f
SHA1e984a2fe726545b0b1ebe78906292fb16ef240e5
SHA256929bcd25b6e8a036e79eab65cef14aae1d174b6cd63deaaeb195f7cc3d03b062
SHA512e60b41447f26171b3254718f25715a32d4c05ab5ad95dbe471eb9a7af8c4762c01d2bd665d10ede0a7d95830292339c03e4635665c8cd9dca17e254f57ea6d0e
-
Filesize
89KB
MD547b751f7d08104e66041a7882fc735e1
SHA1761e00076aab818b71bf36746457b6741b00c242
SHA25660c3f6bafe76c1da6edd4b24b8de7af1854743e9cc7169b56306b5168f340dbc
SHA512d2a531f7ba760f99846e7c367e03379d3263ccd6391e05d7980b60a1b318a22ba961eb45036a8b08f1194b74d9f07b871a2cb166b75bed768a87650003cb44df
-
Filesize
88KB
MD5374836bb11b2a051eeb5eae277f1ce5c
SHA11d890a3cc2f916fc75ce565e3e4c6b011e268408
SHA256b9d2012e11ed6fbce8337db0473e4996cc932f38a09afa1fab2cac2653ec4218
SHA512626b785a0edd3ffbb58af00dc733732a800b61d1de631509afc1700f02058ca5d60dcffdb4ba8993c797cd4a2426802b83bc18260659c33302ba1ac31080dab3