Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
20/09/2022, 18:48
220920-xf2m2sebf8 120/09/2022, 18:48
220920-xfqksahgej 120/09/2022, 18:29
220920-w5en5sebe9 8Analysis
-
max time kernel
186s -
max time network
201s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/09/2022, 18:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.audiovisualeffects.com/
Resource
win10v2004-20220901-en
6 signatures
150 seconds
General
-
Target
http://www.audiovisualeffects.com/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1092 chrome.exe 1092 chrome.exe 2056 chrome.exe 2056 chrome.exe 4268 chrome.exe 4268 chrome.exe 3068 chrome.exe 3068 chrome.exe 3128 chrome.exe 3128 chrome.exe 2728 chrome.exe 2728 chrome.exe 2596 chrome.exe 2596 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 4352 chrome.exe 8 chrome.exe 8 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe 2056 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2056 wrote to memory of 3708 2056 chrome.exe 83 PID 2056 wrote to memory of 3708 2056 chrome.exe 83 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1440 2056 chrome.exe 86 PID 2056 wrote to memory of 1092 2056 chrome.exe 87 PID 2056 wrote to memory of 1092 2056 chrome.exe 87 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88 PID 2056 wrote to memory of 4764 2056 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" http://www.audiovisualeffects.com/1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c9534f50,0x7ff9c9534f60,0x7ff9c9534f702⤵PID:3708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1688 /prefetch:22⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1992 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2284 /prefetch:82⤵PID:4764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3020 /prefetch:12⤵PID:3364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:12⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4324 /prefetch:82⤵PID:1360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4328 /prefetch:12⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3292 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:4268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5336 /prefetch:82⤵PID:2956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5084 /prefetch:82⤵PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4944 /prefetch:82⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5344 /prefetch:82⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3724 /prefetch:12⤵PID:4148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1572 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:3128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:12⤵PID:536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:12⤵PID:2712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3016 /prefetch:12⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4368 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1148 /prefetch:82⤵PID:952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5864 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4476 /prefetch:82⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5716 /prefetch:82⤵PID:1384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5876 /prefetch:82⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4708 /prefetch:82⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4688 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4352
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2672 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:8
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:82⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1656,16303211321186934703,2067148163067686752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1572 /prefetch:82⤵PID:1008
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:1744