Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
31s -
max time network
32s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250128-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20250128-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
01/02/2025, 20:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/Da2dalus/The-MALWARE-Repo
Resource
win10ltsc2021-20250128-en
windows10-ltsc 2021-x64
10 signatures
150 seconds
General
-
Target
https://github.com/Da2dalus/The-MALWARE-Repo
Score
4/10
Malware Config
Signatures
-
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133829154455568974" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2896 chrome.exe 2896 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2896 chrome.exe 2896 chrome.exe -
Suspicious use of AdjustPrivilegeToken 62 IoCs
description pid Process Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe Token: SeShutdownPrivilege 2896 chrome.exe Token: SeCreatePagefilePrivilege 2896 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe 2896 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2896 wrote to memory of 2384 2896 chrome.exe 83 PID 2896 wrote to memory of 2384 2896 chrome.exe 83 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 2156 2896 chrome.exe 84 PID 2896 wrote to memory of 5020 2896 chrome.exe 85 PID 2896 wrote to memory of 5020 2896 chrome.exe 85 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86 PID 2896 wrote to memory of 2572 2896 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/Da2dalus/The-MALWARE-Repo1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x21c,0x220,0x224,0x1f8,0x228,0x7ffe5776cc40,0x7ffe5776cc4c,0x7ffe5776cc582⤵PID:2384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1920,i,15520603841462024223,5635587875133227841,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=1916 /prefetch:22⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1864,i,15520603841462024223,5635587875133227841,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=1960 /prefetch:32⤵PID:5020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2248,i,15520603841462024223,5635587875133227841,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=2276 /prefetch:82⤵PID:2572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3132,i,15520603841462024223,5635587875133227841,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=3152 /prefetch:12⤵PID:568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3140,i,15520603841462024223,5635587875133227841,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=3308 /prefetch:12⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4596,i,15520603841462024223,5635587875133227841,262144 --variations-seed-version=20250127-050148.939000 --mojo-platform-channel-handle=4776 /prefetch:82⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"1⤵PID:2072
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:3044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d168c42f1270d94e4d1b8f2c5e76b2bc
SHA118c39865000e3a599f7565cfa6872435f4383482
SHA256b65dec028a00e3d1a7b320206ba1b164ac0bfcfeac2ad07a06767bd6896ffc02
SHA5128c41ed59e8b9f5b956b6714036df5b2068db5bbbee253344035e89958361cf3fc8b33e4f4382f4b23465eb27881e399eef116ef401a1100ac0e17f27799758dd
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD566ac615b2da4e17eae9eea406c0788dc
SHA1d652abcb7d1866af54938e28ab1eacf679364c3c
SHA256a06ed8938f89ae95f32248bb0e3a5a4f6c4f4900f054a82f706195527aa2ccbd
SHA5121df27c0387a439aa7d6ef66175761e292f598242c20c58d12ecbc4f02335fc23b142b63fae24969acb760eb5b686e5d06452cc3ee1a242f58ee1e1606c12a049
-
Filesize
9KB
MD59eea68aff7abb5518c41a3fdc87c6eee
SHA1919ca8d0774afd13896dfa29312b1ef4fe00ad69
SHA2566cbb45ce3260d31715abc555751693f7fc55ae710a8b92cd99e63bdfd86a1247
SHA512c894802c78f683c94a4dff51cbc630ec38d294417e4cbf57efb600c295eb14132deafac113f4d76a8a06beb68e70a9d450ae06af6ac03300a5cb6b6ee178001e
-
Filesize
9KB
MD56310ca846a5f63f13f1876f807e256c1
SHA1a4807773c2626ee4fd9b777f64de470d7d4ebe82
SHA256d3ea760db43843dfc86b2ee800e7a9a2dbc0483a74b25405a9369bd4a1f62d7f
SHA512d912ab9e22289d9ce4fd5cf5f9ab35e6d62fafb687700bb83807d259e5716aa2998ad8d15dca0baac1873eb4fd6644c4a3fa616e794bbca8d10ed7fb3f6f5e05
-
Filesize
121KB
MD534e477f111e6cdb1106d5f87ae81b72c
SHA116b790c105f02b3b340aae96a25397d38c864688
SHA256baaa8abb8d92e48f7bffafac2e4f3843fd3cf6d4e09bb1137904f7678e2be24f
SHA512ba5737af2bc61c052271df7e7b8c980ccc51fa6bd2632a44eaade6f5a23b1a5363e0857a093e54e085daf5ab2649341e26b6abd85f05ed03e4c0d6c12c93e587