Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
28/06/2024, 10:49
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://kymuch.github.io/The-North
Resource
win10v2004-20240508-en
General
-
Target
https://kymuch.github.io/The-North
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133640453733931481" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 3256 chrome.exe 3256 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe Token: SeShutdownPrivilege 2492 chrome.exe Token: SeCreatePagefilePrivilege 2492 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe 2492 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2492 wrote to memory of 4564 2492 chrome.exe 81 PID 2492 wrote to memory of 4564 2492 chrome.exe 81 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 2484 2492 chrome.exe 82 PID 2492 wrote to memory of 4600 2492 chrome.exe 83 PID 2492 wrote to memory of 4600 2492 chrome.exe 83 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84 PID 2492 wrote to memory of 1516 2492 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://kymuch.github.io/The-North1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd6b7cab58,0x7ffd6b7cab68,0x7ffd6b7cab782⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:22⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:82⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2168 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:82⤵PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2908 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:12⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:12⤵PID:1268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4300 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:82⤵PID:4792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4016 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:82⤵PID:4036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4364 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:12⤵PID:3428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3280 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:12⤵PID:1768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:82⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4524 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:82⤵PID:3152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4424 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:82⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3720 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:12⤵PID:4100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1608 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:12⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4596 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --mojo-platform-channel-handle=1632 --field-trial-handle=1896,i,7053613622034372127,4010414897041381719,131072 /prefetch:12⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3092
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD544799b477b805a9be112b2d89217fafa
SHA121d735a48e6ca9f1b2f86bfebe2024b5fd9b537a
SHA2562882856dea41c81e9698c1e8546b3bf8199585218528fd15f2dfe1fe557edf4a
SHA512fba5cedc334d0714dd23ff64368f79b3cbb202e1e29bdea50d9b9eab24c6b9b5dc778fe75ff0b4bdb1d6e533389de578820b5e3513221e6136bf30a7882ae408
-
Filesize
257KB
MD56d5503028f469446fc33513642e8836d
SHA18838c6b02b69902e4094515c4ebee598fb97bbf9
SHA2566d034adf49c76071b765490a5c2005b8df45c2e7fb675d7d486c7cb8c2476f76
SHA512dfc4ef1b6be9094f3c29014ab5baf1ede0b98656ad41e978a8f4322f3b48e997c689bbfb8ebcd9c22bce83efc958178dc43cc5db7d65f7e4d5f4a7255b7edba1
-
Filesize
257KB
MD5e31102ca1797ae42a24e5e779590d6c9
SHA1284e36e018fe4e77b6a06bc944e0409b05844e6a
SHA2562a5955b7179b3b4f019c57da329e030c8448569b2005a99c1d4a57694fca8b38
SHA512099568acd6f96a8adacf605c370eccc73e10c95a844f7698bf8058444979f106b4df604fa0e8ae8e94a66d5d0e48f69a2b83f2cbca41ec5abe4b4a3017d46dda
-
Filesize
91KB
MD5b6e51e45f7a81aa9dcb041bba51a803e
SHA1de9d6b7de587ce629187758d52153cad86bea6dd
SHA2569fce60a38502f45c5359725ecb544858cd8198eac1382e974b80148f2c1b4be2
SHA512a7e9cda9bd5e695d0602d434597d0512cccf2c6d4ad5910c6aff7d21c191f33c87ef747a324a83e6b8d3712cc854ca727f76d9ff55686fbc987b84e7f9db78fe
-
Filesize
88KB
MD59f129ce0d20769e10017c562cb1751bc
SHA1d87a3250963e052acdf3c59f663a0aeeca7f8e26
SHA25610f2c1cab75e98c37e896026590ca2b70ffde1acf0767cd35d859a535d255db5
SHA512cc7a45c66335657cf71356f28104b9fd5cdadb6331fb62ec6aa9730924be261f6b57a0a6b61ff318a41e4ad92790b1262c51fe3be0f97d6fa469a78ef964d862