Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
07/07/2024, 15:20
240707-sqxdvsxbka 606/07/2024, 11:20
240706-nfk6maxflr 804/07/2024, 08:53
240704-ktts5svhkg 304/07/2024, 08:51
240704-kr7bfsshmm 304/07/2024, 08:05
240704-jythhatfmb 804/07/2024, 07:32
240704-jde5dashlb 8Analysis
-
max time kernel
1799s -
max time network
1686s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
04/07/2024, 08:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://start-process PowerShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex
Resource
win11-20240611-en
windows11-21h2-x64
9 signatures
1800 seconds
General
-
Target
http://start-process PowerShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex
Score
3/10
Malware Config
Signatures
-
Access Token Manipulation: Create Process with Token 1 TTPs 1 IoCs
pid Process 1160 chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133645569381093097" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1160 chrome.exe 1160 chrome.exe 3088 chrome.exe 3088 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe Token: SeShutdownPrivilege 1160 chrome.exe Token: SeCreatePagefilePrivilege 1160 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe 1160 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1160 wrote to memory of 3080 1160 chrome.exe 80 PID 1160 wrote to memory of 3080 1160 chrome.exe 80 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 4564 1160 chrome.exe 81 PID 1160 wrote to memory of 3984 1160 chrome.exe 82 PID 1160 wrote to memory of 3984 1160 chrome.exe 82 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83 PID 1160 wrote to memory of 2596 1160 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://start-process PowerShell -verb runas irm https://raw.githubusercontent.com/Lachine1/xmrig-scripts/main/windows.ps1 | iex1⤵
- Access Token Manipulation: Create Process with Token
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffde4fcab58,0x7ffde4fcab68,0x7ffde4fcab782⤵PID:3080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:22⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:82⤵PID:3984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2172 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:82⤵PID:2596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:12⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:12⤵PID:4044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4036 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:12⤵PID:3480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3304 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:12⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4204 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:82⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4616 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:82⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3312 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:12⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1472 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:12⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4648 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:12⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4616 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4164 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:12⤵PID:2764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=4356 --field-trial-handle=1692,i,18367599867191693905,10652864557559132666,131072 /prefetch:12⤵PID:3556
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3192
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c2f589eb75f1b29ee3a4548569d3810b
SHA17eb1ff84bb357d462d6a64ff8d5041dbde7a91db
SHA256881569d492950208136441711b0cf61d973faa43eef9d2a511b0f73594d9411e
SHA512b03e53e3fc0daf61b59ba656707e0b089c5bd3eac7e3f6d6c44af02a595d6cfedf49d3ca269f89f48539f67998f6a2a9e9ba53040650678eae7835dc6757994e
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD53cd93eaed63cddb0b552dd3a169d6b40
SHA18671adf60a466c13164177e9cf0671fdcce15e04
SHA256da8b4afe800d418b7fd0e35d85f10c140f926948239d4e8d24535c7d0a43d8db
SHA51211b1ae2c3baf1565a16f97dd8bf5c0f828530afc5ad1f6e204505c9140e91df8b64602dafbc0773e478ead02a91c43e62381716f23da15f6b975d93165ac666b
-
Filesize
138KB
MD58f470e51ea54a46f90538f734cc48b3d
SHA1d902a7507a359c2ae98ba639f9085d58f1208f05
SHA2566252de729bef55bad590365ff4304d6bd8e1e8455854423c2c7fbe243b0a70a1
SHA512de42d20bbd4ab9d2071b8e80babf3499d06dcd892dcc99d7ff7eafe096b6020c842263418079196e8aba7d254199cc076d69a7160fe9edb8fedeba4cdd9a7f65