Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
10s -
max time network
9s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
15/10/2024, 06:07
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://y42r.mjt.lu/unsub2?m=AVcAAFICuCQAAAAAAAAAA8LYrHsAAYCrlhMAAAAAAAutMwBnDX2tREBZw4q_TauZk2Z0G7SNQgALxJU&b=88c11cc1&e=b90d653c&x=Zh3DEERRSkil8e_Bw5O8nIjQWUwq1OaaNDvxkEYDcDQ
Resource
win10v2004-20241007-en
General
-
Target
https://y42r.mjt.lu/unsub2?m=AVcAAFICuCQAAAAAAAAAA8LYrHsAAYCrlhMAAAAAAAutMwBnDX2tREBZw4q_TauZk2Z0G7SNQgALxJU&b=88c11cc1&e=b90d653c&x=Zh3DEERRSkil8e_Bw5O8nIjQWUwq1OaaNDvxkEYDcDQ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133734460872038647" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3452 chrome.exe 3452 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3452 chrome.exe 3452 chrome.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 3452 chrome.exe Token: SeCreatePagefilePrivilege 3452 chrome.exe Token: SeShutdownPrivilege 3452 chrome.exe Token: SeCreatePagefilePrivilege 3452 chrome.exe Token: SeShutdownPrivilege 3452 chrome.exe Token: SeCreatePagefilePrivilege 3452 chrome.exe Token: SeShutdownPrivilege 3452 chrome.exe Token: SeCreatePagefilePrivilege 3452 chrome.exe Token: SeShutdownPrivilege 3452 chrome.exe Token: SeCreatePagefilePrivilege 3452 chrome.exe Token: SeShutdownPrivilege 3452 chrome.exe Token: SeCreatePagefilePrivilege 3452 chrome.exe Token: SeShutdownPrivilege 3452 chrome.exe Token: SeCreatePagefilePrivilege 3452 chrome.exe Token: SeShutdownPrivilege 3452 chrome.exe Token: SeCreatePagefilePrivilege 3452 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe 3452 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3452 wrote to memory of 4132 3452 chrome.exe 84 PID 3452 wrote to memory of 4132 3452 chrome.exe 84 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 3228 3452 chrome.exe 85 PID 3452 wrote to memory of 1876 3452 chrome.exe 86 PID 3452 wrote to memory of 1876 3452 chrome.exe 86 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87 PID 3452 wrote to memory of 1812 3452 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://y42r.mjt.lu/unsub2?m=AVcAAFICuCQAAAAAAAAAA8LYrHsAAYCrlhMAAAAAAAutMwBnDX2tREBZw4q_TauZk2Z0G7SNQgALxJU&b=88c11cc1&e=b90d653c&x=Zh3DEERRSkil8e_Bw5O8nIjQWUwq1OaaNDvxkEYDcDQ1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3452 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ff92778cc40,0x7ff92778cc4c,0x7ff92778cc582⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1596,i,942245579020612988,1866143670689656735,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1592 /prefetch:22⤵PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2140,i,942245579020612988,1866143670689656735,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2180 /prefetch:32⤵PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2228,i,942245579020612988,1866143670689656735,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2444 /prefetch:82⤵PID:1812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3116,i,942245579020612988,1866143670689656735,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:2628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3124,i,942245579020612988,1866143670689656735,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3188 /prefetch:12⤵PID:4640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4572,i,942245579020612988,1866143670689656735,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4596 /prefetch:82⤵PID:664
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:1956
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:1260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\27afa49d-d612-47c0-b0da-6f58640f3387.tmp
Filesize649B
MD5bcb5a760de3ff2ee65d833dcf43dbb64
SHA16c0aa44243b68f5e9dd491168f45474e5e4a908f
SHA25603c248e34464f2e07b45f575735fdcea6597418e832ffd735bc84d7d24c7dbf2
SHA5124d610d0ff7ac1ff7c28f2e7ffc0b65efd42d938495d475439ca609edf7f8705bf4c6f264e11b39286139b71646044a9b9665a09a1f23eb1794f1cf075a742c20
-
Filesize
2KB
MD5db7d205a89596badcbcb428783a3bec9
SHA1c9343fa014f40dc63c2138144eecded059af144d
SHA256b8cb3ff2ad0409cad2d27c005264d9b0f53fb6272e0a40167ae3eff23dc37f0a
SHA512e68df91daa65f37b1d19182ac2c572a7e0ee44fbd659d25f5c79507b4aa22dbfb0591ec88e2352be6744a2402fd842e28542eedc530eed95d4c39be86b253ede
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD5fa68449f11fe9df85604f647b02cc58f
SHA1b6572d4445140c46c836018d4b6ccd1b4e05141a
SHA256095027e742caaa7855705018002cc0855f663bf54cafc3bc9e5e6390557d5db0
SHA512e1f7314982a2f984d902c37a6ecf7fb5773acf0fd5ae50fdcb44845dbd56a6fa51f7eb7bed02a255c96dcd8c0da1c82c4d3490d8754bb95ea4d67d0373d0c52f
-
Filesize
116KB
MD57c2bf23117372b4f4bcbcd04accc0627
SHA10af5f15304e0cf193f0611d8e741ff92290428b8
SHA256464d9e411843c284e9545e27d107e8a84b3ade41b3e5c7db86c1f0d9ceb472d1
SHA5127bbea6ddc9d8d52ea5167d6d6c76f51aff2af1955c4cd2f009af548e7ea048ff308818fad5f5bf95df8c3464301edcb4e2e54cdc876c741b70e8a3b19247692e
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58