Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1688s -
platform
windows11-21h2_x64 -
resource
win11-20240704-en -
resource tags
arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system -
submitted
06/07/2024, 08:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/MalwareStudio/Rover-The-Desktop-Assistant
Resource
win11-20240704-en
windows11-21h2-x64
8 signatures
1800 seconds
General
-
Target
https://github.com/MalwareStudio/Rover-The-Desktop-Assistant
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133647276227101759" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3988 chrome.exe 3988 chrome.exe 3324 chrome.exe 3324 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3988 chrome.exe 3988 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe Token: SeShutdownPrivilege 3988 chrome.exe Token: SeCreatePagefilePrivilege 3988 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe 3988 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3988 wrote to memory of 424 3988 chrome.exe 78 PID 3988 wrote to memory of 424 3988 chrome.exe 78 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 3364 3988 chrome.exe 79 PID 3988 wrote to memory of 4540 3988 chrome.exe 80 PID 3988 wrote to memory of 4540 3988 chrome.exe 80 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81 PID 3988 wrote to memory of 2484 3988 chrome.exe 81
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/MalwareStudio/Rover-The-Desktop-Assistant1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3988 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc53ddab58,0x7ffc53ddab68,0x7ffc53ddab782⤵PID:424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1580 --field-trial-handle=1832,i,11612161072005479066,6880443660374045958,131072 /prefetch:22⤵PID:3364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1832,i,11612161072005479066,6880443660374045958,131072 /prefetch:82⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2136 --field-trial-handle=1832,i,11612161072005479066,6880443660374045958,131072 /prefetch:82⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1832,i,11612161072005479066,6880443660374045958,131072 /prefetch:12⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1832,i,11612161072005479066,6880443660374045958,131072 /prefetch:12⤵PID:1944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4512 --field-trial-handle=1832,i,11612161072005479066,6880443660374045958,131072 /prefetch:82⤵PID:4000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4288 --field-trial-handle=1832,i,11612161072005479066,6880443660374045958,131072 /prefetch:82⤵PID:1336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=988 --field-trial-handle=1832,i,11612161072005479066,6880443660374045958,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3324
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5c4ec608d507cbd1bee0679ce77358495
SHA14033659636bbfbe803ccb29d159faecdbfd275db
SHA256f22577081a0d264e09e6d335c5a53c4417a1101ec97a4207f6afbc1e8ff3ffcc
SHA51238ec5793820f93e75a1b16a1b5f64024f4b744d16cacd76f01b1d653f13137715dff9f3e6ce4c2f606ef4f16195beecbce6e326e054fbcfaf369c6999abae17a
-
Filesize
1KB
MD5acdddd6f91f6286fa957b28bb80e4012
SHA18aa2a1618bca4e48229c0c21a88ccb0252e71c6a
SHA2560e76c177d57d6f52c7a74bb50b870ad1b4ddbab4fc05d2a82cf88b30a7cd4a81
SHA5123bdbb49bb58d57ef4e1c5e0d94c94786388b3e7caa02ebc4d7b390a707cbe0856d2ce235b0082d85dfc07357d8082196335c4102c37d0ad2c3210e9dee0c27ff
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5163235971c3ddb706dbd2fd635d096cd
SHA1ef724fc535fc055890a55f37a07e669d5577aa78
SHA256840f90d4a18e3e598136bd62f1aca50d50b107af21dcf3d1390016f9d710ffe8
SHA51249bdb20e1553d925efd7c40b6e2bed9201af670e75c8fccaa9156d2eaa14bbcb19f220d684fc68ef2c3b62aff8c40e3181f3c4e50e879f9062a883ca1767fd16
-
Filesize
7KB
MD55634f101c8989588d0c048c4323ae5ab
SHA1f51e7a6d193909280fd24a02337fe2fa088f5587
SHA2566a1f31568789ec9a1f7778dd2138656db0cdba4a754866b7db6bc66a9accd438
SHA512ef589432ffb2b15cdb94b95c4dbcef28f4bf99fef8c4b4aca2241fc94390f70f0cca1de97d245624acee00b86fdd0141e245f48bb16063c8c413a67aaf3166bd
-
Filesize
144KB
MD5d5ca0cca6a6c5bf47953c6c0d0536d1b
SHA12bd7ca16576f1cd6c32a4ef60231e5cdb861454b
SHA256351a9a3e21c21fa3a0c4519ab8d6784e11149ba35004b55533b4484b2bc37853
SHA512c74f1bb7dab1119ea948a8b3eb9c7dc00b04700442ed8247c324d4d7f9183821e4f38aca1339b68d65bd63c12055ab7ec3529a5bc0a1211be978f8563ad874e2