Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
599s -
max time network
589s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
10/06/2024, 08:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://puregarry.weebly.com/windows-serial-terminal-arduino.html
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
http://puregarry.weebly.com/windows-serial-terminal-arduino.html
Resource
win11-20240508-en
General
-
Target
http://puregarry.weebly.com/windows-serial-terminal-arduino.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133624809447620925" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4800 chrome.exe 4800 chrome.exe 1108 chrome.exe 1108 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe Token: SeShutdownPrivilege 4800 chrome.exe Token: SeCreatePagefilePrivilege 4800 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4800 wrote to memory of 4160 4800 chrome.exe 82 PID 4800 wrote to memory of 4160 4800 chrome.exe 82 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3276 4800 chrome.exe 83 PID 4800 wrote to memory of 3368 4800 chrome.exe 84 PID 4800 wrote to memory of 3368 4800 chrome.exe 84 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85 PID 4800 wrote to memory of 960 4800 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://puregarry.weebly.com/windows-serial-terminal-arduino.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe40a9ab58,0x7ffe40a9ab68,0x7ffe40a9ab782⤵PID:4160
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1608 --field-trial-handle=1908,i,3286710348493998923,10379495402515856993,131072 /prefetch:22⤵PID:3276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1908,i,3286710348493998923,10379495402515856993,131072 /prefetch:82⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2240 --field-trial-handle=1908,i,3286710348493998923,10379495402515856993,131072 /prefetch:82⤵PID:960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2964 --field-trial-handle=1908,i,3286710348493998923,10379495402515856993,131072 /prefetch:12⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1908,i,3286710348493998923,10379495402515856993,131072 /prefetch:12⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4260 --field-trial-handle=1908,i,3286710348493998923,10379495402515856993,131072 /prefetch:12⤵PID:1924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 --field-trial-handle=1908,i,3286710348493998923,10379495402515856993,131072 /prefetch:82⤵PID:3912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4528 --field-trial-handle=1908,i,3286710348493998923,10379495402515856993,131072 /prefetch:82⤵PID:3632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1908,i,3286710348493998923,10379495402515856993,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1108
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336B
MD591d90f1cb64e6f80f275aecb96573edc
SHA1972fd7f499a268b87e82b6697eb19130c2b115f2
SHA256202b6be84b474ce65de46d71dface0507024549e9d393dc4026bc2f802979caa
SHA512bea17b544ca5656a5b47127302463bc36530bdd9dc8cd91b0acf2760e325a6a9eb101209d1fa9f3945f874c3a00f86d987ed406ff7e288b8cbcdb9d94fde89a1
-
Filesize
2KB
MD51c8f2317396542f0e7550915a61ef563
SHA1942b6386369dc2477c8c4fa8dfa4a0f6bb245899
SHA25631ece25cb3c368be45008abfbeaf4123b4b25f69331c84e8cd2c6bc25b3e3e9f
SHA512bf11f266e83ec523c9fed485761c10a362360175f810394b17464366e5e2c6055e19aee13be2a492c90fe14e7fd3cf3491627f379e5f3309c315d092c336fa2a
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5fc8aae727ae98d783b5e4fbc859331aa
SHA1e09e64365adb7bc9766b80138b5368546f043328
SHA2566b498693e28748e67d22142b03c43f479ffed60a4fbb1163bdc4e2bb96a9ee47
SHA5121c6fed755ce84659d26d473588728844e5880afd8573ac2cf9aaad876301bbff5ed9102454b5ae05a349fdc552e206ebcdcae3c02c2582f70015b61ce4baa592
-
Filesize
7KB
MD5a167daa13a45df1b1cd503781c1b66a0
SHA19e63a228669bc5f1b1515fdf758e1023f4dbd2bb
SHA256c9460ab61be2f9cc903c80fd2805e55c375864a9cc61e7423304aeb1c7e11dd4
SHA5127bb9a0c27bb608f2a033ac4622ad7018de412a659f9949dd9a7269bbc7bbe074d2de8c4d91d73ed7b1798ad741da62c659d8abad94c6e6b0a7904685e6093e7e
-
Filesize
255KB
MD57fa58a3b4bf6e72a7ffef75d3f3eb00f
SHA1e093f024726987d9e0db0b7154e832c6a8b5a34b
SHA2560b9bc67409387f51c23272ee6057c5985de1ca5c75fc1dbcb03e67d0574f2061
SHA512f4432cbec4b8c7ef97920d1fb61b157140f48f8f9bb5a8998c4507b400383acad128d1808047f3e865570154be0d4d594bc88471238b1d905d4ec55e50150b04