Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
10/07/2024, 17:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://file:///C:/Users/SHADYVVX/Downloads/Mercurial.Grabber.v1.03%20(1)/Mercurial.Grabber.v1.03/Mercurial.Grabber.v1.03/MERCURIAL%20GRABBR.exe
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
http://file:///C:/Users/SHADYVVX/Downloads/Mercurial.Grabber.v1.03%20(1)/Mercurial.Grabber.v1.03/Mercurial.Grabber.v1.03/MERCURIAL%20GRABBR.exe
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133651054112310555" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4880 chrome.exe 4880 chrome.exe 1076 chrome.exe 1076 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe Token: SeShutdownPrivilege 4880 chrome.exe Token: SeCreatePagefilePrivilege 4880 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe 4880 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4880 wrote to memory of 4588 4880 chrome.exe 73 PID 4880 wrote to memory of 4588 4880 chrome.exe 73 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 604 4880 chrome.exe 75 PID 4880 wrote to memory of 4272 4880 chrome.exe 76 PID 4880 wrote to memory of 4272 4880 chrome.exe 76 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77 PID 4880 wrote to memory of 2308 4880 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://file:///C:/Users/SHADYVVX/Downloads/Mercurial.Grabber.v1.03%20(1)/Mercurial.Grabber.v1.03/Mercurial.Grabber.v1.03/MERCURIAL%20GRABBR.exe1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffa74989758,0x7ffa74989768,0x7ffa749897782⤵PID:4588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1524 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:22⤵PID:604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2012 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:82⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:82⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2624 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:12⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2632 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:12⤵PID:3260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3784 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:12⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2892 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:12⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4444 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:82⤵PID:516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3128 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:82⤵PID:2784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3920 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:12⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4284 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:12⤵PID:2024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3692 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:12⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4448 --field-trial-handle=1748,i,2790832259769946485,6811711572985664337,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1076
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\852d85f0-458d-4b6c-8fd2-7a80eff2fa1c.tmp
Filesize5KB
MD5f530d969e1af11f594cfd995cde550c1
SHA1381ed0e9a6e742df4479cf806f6f9b611dbc1a57
SHA25614815e9267743d8913c6691c9778513ca8e982f83ec9169044841477e3fac9a8
SHA51255dacfe824c52bd561eef3a402abf3ab3f940c79b10972a52c80441d884f8542852fd97bd754a2b67103481912b7b558577533ed9bd49e8384a8f5be7cea5cd5
-
Filesize
5KB
MD593736d7024b64d7a64c1f7bccf224164
SHA1b334458fdc0f07b388909b6d457df8b90f9d2681
SHA25692e0a81c4f825bc3bb522c9a9c93963b1018d27bfad7f0f9d4de63486306e63b
SHA5125fec1ad42cfa5137b6c1bdd5df1217a4e2e8b7c5032b43ebc225e0f4fc09d330df4847d2310184f55bc48885212a898271cfa4a9d8f878c667ea39a58ab8a98d
-
Filesize
5KB
MD5ed0cb36e0e5bb997ea928da1fcb67607
SHA1032a714714551f3fc34c9361fb10066462609788
SHA256c75d770544baf8cd7de7cd495423d912b701de3bb542dac1279cf34217dcd541
SHA512a521bdb3c8357aaedf79ca74430234539f4f1617b6a8418ae61acc4dceedcb0de3389558fc88b88b932110f868ff2a10494e226b851bce4e8eedd3c0f25979cd
-
Filesize
136KB
MD5e4f566a9b355fa91adb9123e7ad4d79a
SHA17b6e2d3c4d10e1d164f1b7976f8929d6e14bd5b0
SHA256871db3777d9298e582be99074a0e2dcd6a52ecc1b7f00a83227d5a78d7c5606a
SHA512a482a8c90c7eb6214c307e8ffc8d61adb7d2e8b20c2619bef536916d18cadef2c264883368645b34ea4177b8ba31bff81bec5d03a76e515e5da9b1e1a74df224
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd