Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
06/06/2024, 09:48
240606-lsvjqace9z 1Analysis
-
max time kernel
1799s -
max time network
1691s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
06/06/2024, 09:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.wemod.com/
Resource
win10-20240404-en
General
-
Target
https://www.wemod.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133621474964810946" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2512 chrome.exe 2512 chrome.exe 3736 chrome.exe 3736 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2512 chrome.exe 2512 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe Token: SeShutdownPrivilege 2512 chrome.exe Token: SeCreatePagefilePrivilege 2512 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe 2512 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2512 wrote to memory of 4348 2512 chrome.exe 71 PID 2512 wrote to memory of 4348 2512 chrome.exe 71 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 3208 2512 chrome.exe 73 PID 2512 wrote to memory of 4716 2512 chrome.exe 74 PID 2512 wrote to memory of 4716 2512 chrome.exe 74 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75 PID 2512 wrote to memory of 1868 2512 chrome.exe 75
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.wemod.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2512 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe8ace9758,0x7ffe8ace9768,0x7ffe8ace97782⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:22⤵PID:3208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:82⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2008 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:82⤵PID:1868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2860 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:12⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:12⤵PID:672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:82⤵PID:2388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:82⤵PID:3260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3228 --field-trial-handle=1792,i,13309417843051669367,17592447140697721167,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3736
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
535KB
MD55189afe2ed7972ac220c67e700d26ab7
SHA13a5504b829bc8f361c70aeca507fc4ced2f87e22
SHA2563dfc1763ffbb24ad2d2ab1588c3652894a13446828b51e39e97139324c5674ad
SHA5120e2ca4511c7c7f15b023cb06f37d20a08cca73dbaf5d5bde4be116f84196b25314cd30ad4d7e1ce676391db0a0383fc026107f6be1cd3a5df96479db32e33a8e
-
Filesize
264B
MD544c00a7ac4a8a85469cccd5445d08ed9
SHA1cb1aefef9f1f5227fd0d33d0cd8ede50be85ae66
SHA2561b4a972985bb3e507e8244a01c7f20810ed1e214214c88617ad4977e6a5e8417
SHA51259ec76fd8577ab4eee83e086d129d3f8b9d160ef2f872eb5a60524bf46dbabaaa9cf59fe5b857563d328c41b29908c9740f9a186ef1de54141a8803c4accaab4
-
Filesize
2KB
MD52b3b88643b35b056ec87cdbc9db6f54e
SHA1d02da7b0793ac9209d60bb4d0c6e5089f240c3ec
SHA2569c62eb7bcff5089ce8e322c982d3dd2599c1b9f63cdc362f9c83acfcb2be3ae3
SHA5120b9453c98dc402079465f75b18bcf37036001dd1e7d8e847bf31865f6532a942bbc43ef174aa51e9d30a03b6abe3984f41fa9f42c60f517c43e3173c40a2b9ce
-
Filesize
2KB
MD51ebebc52d7a75f1a8b7117e11ad4f18b
SHA18b8c88e8bb9fab206ad74487e2c3fa69fc3c96b6
SHA2568929da807cba1384f92fa97edda390987b2ee7b045299bab4c3281cb9d471792
SHA51223c54ba616b0abe9ef862edfd7dc89f344495a85bafa88a567ee4cef5089efa62866a9faf84f0ad5ef330beabba2a2b6bc2cc85dea960bb9bdb7883c30f53680
-
Filesize
1KB
MD500908322bc2cce83bd8dc3d943da5013
SHA1098718922f39e4c137101bf4bf5e1d86299817b9
SHA2566b9ecf4ad8a78ce77334f89c87ba5820a2eb3f5c647e238fc7965ce08cf31584
SHA5123e88abbafeed353d18dd06941ead22be692448896c31bbef64a399f9a5435b9d1a747a0c9f3bb47d66d9813d867470441c5517ac3d4deb90c98ee42719baf048
-
Filesize
5KB
MD5aa68b9127dae9db2bf797b08f5b172af
SHA18edadc22d7944b5dfd698ada8e601a1ebc76d58a
SHA2566f32eba30a3ce7350cca328e026dc52f8c8fbfac9ee88bdbc50ee85e02c1422b
SHA51224a96743567aa695921acb01c4a00ebdb092798e6a68391a7ee33d431ffadf35b2ef0f9b917cca23a1bd0398859d3c3c361ec40b06471ab2c96d90847984bf0b
-
Filesize
6KB
MD5aee28464e967e1f5e716677b5f0270fc
SHA1049f208e09bf92171b04d4b1533d1d8a6bd117a0
SHA2563b6713e96e4a883e45618a3bcad43b9b3589426c8e87ca2ef94adedcc97c63f5
SHA5122a3d84e4faccf79bf9d317f45538af91105364384688571debd7c6f37f7cd327c7aa48105aaa6eeb6b88c16c97e6318817c4a447379be0c614de9a0946a58ebc
-
Filesize
5KB
MD563dd757de365290ed2b248c504af41f5
SHA1677d215d0f391e1f65ddf0059292beee967b8bf1
SHA256c938deaf56118dba7dba21afd13726c0a4b16a4027d96c008869fc2dd369c1a5
SHA512e68674c1809c1c7d697884be312df1aac55fca342c25674369f9e4a5a319460677d8113b035afac493fe8b7f15ae201c8b5160898440fe49fb6a4435a99d95a3
-
Filesize
6KB
MD5d23bf90004ad14d2c6a6a33e108d5943
SHA1bd9fa81159ed5a5a89b1e8ad5d43a9a178dec1a4
SHA25654a968455f86872bd8098c719b9c054b8361b9a746d3979c3dd1f65d41bba665
SHA512b15084c3ef998f8a68372b548643013a8c02d32d17eb28d4e5197e1d0d75a325cf9cf8015ed1138cfdf291225182440e4b00553bbc25bee4358b6f8a8abf7f6d
-
Filesize
136KB
MD56c77f2a2e687dcf548ab3760328b85db
SHA1908bae4260d46f401e2a982b69c602c03e1e57f1
SHA2567620e6e39f8dfcf199c7e65095e15038cc762b3c4dab4a2c2601302542f1ff79
SHA5123457377d116a525370b95607694f0488a180749cd86072b2fa5f5dca00e8a60228418de50aa64f8c818939a48640924a166991d53f3181d3af1785f4e148a73e
-
Filesize
98KB
MD57c2f3a1ccce88e1efba4c19db198e466
SHA17d1b8e6a418e4dc1d95510bcf83cfdf1deb87f82
SHA256446973e71afb08e0f4fda8f194568e695ff2327882b2b6fd69b8eb64bb9f0fe9
SHA512283e251ae90369e161556190aa0b54041a5e6cf32eff1740d56554f0a5e59046273c460b859eed787a5bc5b255e1fc530a9d9e53c576aec500c0038c82faa99e
-
Filesize
62KB
MD56a0266e67349de1d50ec1ae0057b64c5
SHA1b63bd214f57f7b83802d8eac7c904035d5f10474
SHA256d61d274f9d6a134d8f9f09bca07c8f97621f710018d045780b9b940e742850d2
SHA5124dbc7e036b0c22bb0bb25b50c9612d61d9881a87e663f5b78fcdc1fc13ccabebd74635f018a734703436f4a480b2f5f875f0f775d1f262f2e4090f799721d137
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd