Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
61s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
06/08/2024, 21:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://dwrobotics.co.za/sjjsy
Resource
win10v2004-20240802-en
General
-
Target
https://dwrobotics.co.za/sjjsy
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133674529005194823" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 844 chrome.exe 844 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe Token: SeShutdownPrivilege 844 chrome.exe Token: SeCreatePagefilePrivilege 844 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe 844 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 844 wrote to memory of 3900 844 chrome.exe 85 PID 844 wrote to memory of 3900 844 chrome.exe 85 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 640 844 chrome.exe 86 PID 844 wrote to memory of 2452 844 chrome.exe 87 PID 844 wrote to memory of 2452 844 chrome.exe 87 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88 PID 844 wrote to memory of 2680 844 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dwrobotics.co.za/sjjsy1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:844 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0x40,0x104,0x7fff3dd6cc40,0x7fff3dd6cc4c,0x7fff3dd6cc582⤵PID:3900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1900,i,6664767878950686611,11090801267461445234,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1896 /prefetch:22⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2136,i,6664767878950686611,11090801267461445234,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2172 /prefetch:32⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2208,i,6664767878950686611,11090801267461445234,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2344 /prefetch:82⤵PID:2680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3100,i,6664767878950686611,11090801267461445234,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3108,i,6664767878950686611,11090801267461445234,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:12⤵PID:1144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4580,i,6664767878950686611,11090801267461445234,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4592 /prefetch:82⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4604,i,6664767878950686611,11090801267461445234,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4852 /prefetch:12⤵PID:3872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=5052,i,6664767878950686611,11090801267461445234,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4976 /prefetch:12⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3180,i,6664767878950686611,11090801267461445234,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5136 /prefetch:12⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5184,i,6664767878950686611,11090801267461445234,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=5156 /prefetch:12⤵PID:744
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2088
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD58fb1635ee82065e7cf936cc2211c000c
SHA1296131ef46c59809ae6b94b656432937b7b42469
SHA256ecabacc6bf0bc8c138b2a59f5c9dbb49b44130f68c7ff89747b33a42b2bda740
SHA5127740adb25c0a589a2f18147973793e3d374cc48a343c41b55116d1193860b712c22a3826d4ffeaef5a67a1be3c89209f7c2952e92ce5800fa3cc0b9a058d7637
-
Filesize
1KB
MD51edee86f619ae69cd3f9bef2b65f9c60
SHA1cfaa14595d5cf98eaa4569aa0f963428dcd7afe7
SHA25607400bb0dc6a379e90cfdfd941c8a884eaf62b4839d92ed434615058de26249d
SHA512b80b5445c0b232cb1eb3e16e65c30a23b7c03a6f2d4df9c96cb1a1a473ce644a897810af11b1da016c7a267ca3579f522e013a5fb32fd46b059e1cfe77614800
-
Filesize
1KB
MD5c67255f969f1eb56a9263d5c9ae6a18c
SHA144e567c9d032906b979641279ce8327ec9807a55
SHA2563eebd856f162a5ef7d9acb0a135a867d5c9dff069624e252d4480fd520f1f0c5
SHA5122e4d6cb88b068eabca1b060859b2cf75e490ab63a43306206bc2cbe04fd57e13358b527410c847a713ca79fa0f250da16a70ab7146dc251f44024fcd8a6f3907
-
Filesize
524B
MD5ab776d9b7597f515b3134d8445fe900c
SHA1b525291332d8945e8add3a4cc9afcb133a1878fd
SHA256a8b0385fb2c00d44f6012d33a870195aa9b0c88472e76fa9f88227f63d008cb8
SHA5126b990660ca285b94656ad9665301901c4a48b033bfaaa28c0f2db89483cae5ef326b9a8fe0ec3972a63ba4752543179ec369a8f0b1b65597b80332a312b2c50e
-
Filesize
8KB
MD5f6dd59310845d4a0300ae88cb8eed649
SHA18368026f33fdc1db23ca8022c50bb48c03683e8a
SHA25688b3ff0ddab314ff2cc670158ded7635e96e6a06acb80dce9880067b3a0eafa1
SHA5122f40822d1a536a121492c86d32954173fd8e5ed1b2919bc406b09295846275254a6655f93a158f31a49c0f2d596d3598a35d63168679d5b9c9e85bf783136045
-
Filesize
8KB
MD54701f24635096054a70e9aa4a5477b2c
SHA1857dbba464c98354d150be12c3236954db42629d
SHA25695deb077b05d9d63d661584549ff02f4214670e3337603082256afd8fac3b029
SHA5127d9787c9ec1883c2503915307c6ddff8e547c593178ead3c3860193d5c6abdfe46b403a4e3045d216159b784d6bdbda0900dae127bcf57d562e5b7e5bbf793b0
-
Filesize
9KB
MD579bad2dd4c7e2059d7ad49d3d1ce5aa4
SHA1ff5021f8acbefef4c40e95445aff9ed87318e09d
SHA256650a3f9c6a717ff8f7ba4574c472737c54366eb19a987fb03b654a88616702fd
SHA51229156cae952d13436bea9ca1454b23620847c1e41fde286db332b9f37408219eca07faf09907bf6a2c662aac058adc1f8b1294634066f4959d050fd0382eb575
-
Filesize
9KB
MD586021c0f5c3865e78b192ba1828ef0b2
SHA12386e47318fd473e16dc3062e710340f9eed7ede
SHA25640dbba5ea941ca777248096804aa34f7f0889567ba915620d0747eee065b5492
SHA512343494a9ff6c99ab38f4b752c619702632752c300d75281e99b63de8640bfcafe78e51dc509a609da58d5d80d547f36a68bd0527c1b3fe494c3c17fdd349df97
-
Filesize
99KB
MD5a311569c2ce880f468c6c53a2a314df3
SHA177d33d2528efa9bc1b4bf276a95f39c9313d9f2b
SHA256d47e45d114ef6c805b670ff678f1da8f6d47236dd3fb133e7216eeb9b0535b16
SHA512ea2b8252ed90a708991b03336c9795ced0daca6e5c5a542cf6a7eeefc3e87a735afe2778c5aaa6e111dea3817feda9e1432239bd503b64e2cd0b2d14e758547c
-
Filesize
99KB
MD546530d844f653b29d4cfa7ca65f18241
SHA1344fd457029455ec955e646e671b7e2fbd4f6e13
SHA256f20b1f52d2e04b60067475f44f0f8288e39ab71ff96cdba570a28ed6a50e3ea9
SHA51277e4fe52721076f39fe6d6d8d59edf1c8dc9c8ddfe8039e0f14015d318501512e6719d5b1041e87fae1b3f94674fbed593bff7aeba0485d70362d6cfd47dc6b9