Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
299s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system -
submitted
08/08/2024, 09:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/mstfknn/malware-sample-library/blob/master/Stuxnet%20Malware/malware.ex_
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
https://github.com/mstfknn/malware-sample-library/blob/master/Stuxnet%20Malware/malware.ex_
Resource
win10-20240611-en
Behavioral task
behavioral3
Sample
https://github.com/mstfknn/malware-sample-library/blob/master/Stuxnet%20Malware/malware.ex_
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
https://github.com/mstfknn/malware-sample-library/blob/master/Stuxnet%20Malware/malware.ex_
Resource
win11-20240802-en
General
-
Target
https://github.com/mstfknn/malware-sample-library/blob/master/Stuxnet%20Malware/malware.ex_
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133675827704834805" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 4776 chrome.exe 4776 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3220 chrome.exe 3220 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe Token: SeShutdownPrivilege 3220 chrome.exe Token: SeCreatePagefilePrivilege 3220 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe 3220 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3220 wrote to memory of 2688 3220 chrome.exe 70 PID 3220 wrote to memory of 2688 3220 chrome.exe 70 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2152 3220 chrome.exe 72 PID 3220 wrote to memory of 2456 3220 chrome.exe 73 PID 3220 wrote to memory of 2456 3220 chrome.exe 73 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74 PID 3220 wrote to memory of 4688 3220 chrome.exe 74
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/mstfknn/malware-sample-library/blob/master/Stuxnet%20Malware/malware.ex_1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3220 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb6d119758,0x7ffb6d119768,0x7ffb6d1197782⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1548 --field-trial-handle=1864,i,1388393377493850256,16308431113035015933,131072 /prefetch:22⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 --field-trial-handle=1864,i,1388393377493850256,16308431113035015933,131072 /prefetch:82⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1864,i,1388393377493850256,16308431113035015933,131072 /prefetch:82⤵PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2864 --field-trial-handle=1864,i,1388393377493850256,16308431113035015933,131072 /prefetch:12⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2872 --field-trial-handle=1864,i,1388393377493850256,16308431113035015933,131072 /prefetch:12⤵PID:3644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1864,i,1388393377493850256,16308431113035015933,131072 /prefetch:82⤵PID:2580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1864,i,1388393377493850256,16308431113035015933,131072 /prefetch:82⤵PID:3344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4868 --field-trial-handle=1864,i,1388393377493850256,16308431113035015933,131072 /prefetch:82⤵PID:4196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4856 --field-trial-handle=1864,i,1388393377493850256,16308431113035015933,131072 /prefetch:82⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5236 --field-trial-handle=1864,i,1388393377493850256,16308431113035015933,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4776
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1484
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d814fda57854accc072edd7ba779c2b0
SHA15bf5a63d861e98b286d5f4eac6e619455a49a4b7
SHA256e547c54ba5d405234852e2df5b783b9f1024388880e8940c32a5bde9f1090da8
SHA5125426c6c136d72cb41aecf2bb0d0c08840095950f175f8bc7456a8bc3553eef497b452c28e9459e21f2f1fccc054b33705c5f1eb19f757cd433fecaa4855035d4
-
Filesize
997B
MD54d57685b493767dda368c0ffab371ce5
SHA178a9ef6895c9f9b15acf4606606e012d5d618f95
SHA25630a9fa21566b22ba36e91635c4a032d254dec0e6bff96c84799b37bd804858b9
SHA5121eade8acd9aeceb6bd3c8fff62302d53f1d57f8554e79d1aad4fb18f8cbf43c0e35207879a4bf24b6eff40c131ecd2fc6c4fe8ff6b3715b5384d4023f83f47b7
-
Filesize
874B
MD5757f594a6a2d63e12318665e44c5c03e
SHA1e86e33822a8421be6dc240e283d721c33f73181d
SHA256243e1e2f0a940033e16643856a91646e8e444574f7f64261d73a95ae464dd584
SHA5125e5952d3c9de16df1aaccef1ff354197725cdb7b093a6b0c401f4384117395401d7fcd6540b6c990a7e5f43e1c9add7b3ad386440250ee404b560a96686eea90
-
Filesize
5KB
MD50e8a1565c278c52c637c2d7d45153a0a
SHA1aeddda379478b8539d8374053f2a6c5da77cc0c7
SHA2564a5a3423417b1d76de22d814d28c18bef4c5e35dd9e5926e2841857c6d636d8e
SHA512e07b97524fd6692ee2cd8c0d966200f9c73f3f0ad3850ec3739b80981ac9debb376240eccdbd484f5875f8105f97f15c56de826749372c3a52ccbf5cc2872fda
-
Filesize
6KB
MD518b2dc4139cfb1c33d626d4f9b597c17
SHA16fe67489c2c6922055152cd183bbda884649c8bd
SHA256ec28c10e1456d5a8f0f9a0013d68c6241c70caa061d57c53d528d0074491fd00
SHA5126287823ca6c5ffed46a72bc30ede3c1c10416799deb2ad5186f1c4b03756439db21a085821ea5064f3d6f56088fef50cd02755ec171feb5f4bbc8f3b298b66e5
-
Filesize
5KB
MD5fc2d4a882e70db373e3c4aebcb7c2adc
SHA160add2ec4ff656e54585f55687b477a9629ce1a7
SHA256d2ab5fa711a551b8033dd037b031e897862d0ac570e42edb0c43b3cfb81f603b
SHA5120a8e77492cc918c07eae261639e4f8166d14d67222e070975cb63665a21a08b9b54088de389313fc80694e08dd712744e8fb09b2ecd34c006341cc7acc155f64
-
Filesize
150KB
MD5476267a977a94eab155bce21f8c4da67
SHA176c3ac477557e827934dc0b6328176f87263db1c
SHA256ba2a0c12f576d1c464d6369af3e8bb5a0859e887cf666db9636d096a33d6d7ea
SHA512aa15929ac78e0915bbc5d4de8f4ed366fb64945d766e12d59dce9ea7df496b07c4025edeaeccef836740d27788f4307d0d71706d3b04174c5cc5ffe231a422a3
-
Filesize
150KB
MD5ce2bc7a9900ffc13cf4dc10bc1c542ef
SHA117465013220a0f379d85e2d7021d1aaafde68b9e
SHA2567272b70a02b5b155d4ccba0a61c7e421ffa033e23de5ca2157c295ae62ca0c91
SHA5120dd0993ccc07ef6388fb010308cc009cf9fcdd6d92cd4725a6c04c33b8d94712b222b7ee0e0164699790d9f830ab7f88a776d53e4f750b59453949b97d94e74d
-
Filesize
150KB
MD5c9ea2490a55d1dc94fc395f26aff0db3
SHA120eee2360475179295b12876e3dc835279fd89ba
SHA2569663c97f714b342993324aead8fcf9ff656db1ae0f3f7871ba4c889284738be5
SHA512b75c82d008326a42f9caa0a70fd826cb13ae73cc216a145df4311692d81fcec0a4c5d995fdc8f8fcf9672dd9cb5c50856f3cfbf67920b2a28f5fb65cf0041099
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd