Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
22s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01/03/2023, 15:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.surveymonkey.com/tr/v1/te/ec5G0fyXAQDEmlco4uwlc7fCEzxcLKJKda8gn1wjqMdH3x9ablGC_2BspXx9dJiamc.png
Resource
win10v2004-20230220-en
General
-
Target
https://www.surveymonkey.com/tr/v1/te/ec5G0fyXAQDEmlco4uwlc7fCEzxcLKJKda8gn1wjqMdH3x9ablGC_2BspXx9dJiamc.png
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133221616448545008" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 744 chrome.exe 744 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 744 chrome.exe 744 chrome.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe Token: SeShutdownPrivilege 744 chrome.exe Token: SeCreatePagefilePrivilege 744 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe 744 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 744 wrote to memory of 652 744 chrome.exe 86 PID 744 wrote to memory of 652 744 chrome.exe 86 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 3924 744 chrome.exe 87 PID 744 wrote to memory of 5048 744 chrome.exe 88 PID 744 wrote to memory of 5048 744 chrome.exe 88 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89 PID 744 wrote to memory of 5112 744 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.surveymonkey.com/tr/v1/te/ec5G0fyXAQDEmlco4uwlc7fCEzxcLKJKda8gn1wjqMdH3x9ablGC_2BspXx9dJiamc.png1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:744 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeba369758,0x7ffeba369768,0x7ffeba3697782⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1832,i,2516227508420080412,12211858540498322962,131072 /prefetch:22⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 --field-trial-handle=1832,i,2516227508420080412,12211858540498322962,131072 /prefetch:82⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1832,i,2516227508420080412,12211858540498322962,131072 /prefetch:82⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1832,i,2516227508420080412,12211858540498322962,131072 /prefetch:12⤵PID:4120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1832,i,2516227508420080412,12211858540498322962,131072 /prefetch:12⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5008 --field-trial-handle=1832,i,2516227508420080412,12211858540498322962,131072 /prefetch:82⤵PID:3220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1832,i,2516227508420080412,12211858540498322962,131072 /prefetch:82⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5180 --field-trial-handle=1832,i,2516227508420080412,12211858540498322962,131072 /prefetch:82⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4080
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538B
MD56e26dd867e004de00b63bc776a8d60e3
SHA1c63525ad91b92278620173fef5be0809cf9d9154
SHA256b42cd29f51a150fa105de8d691143d0f0dde7359aa881c60695980d2918a0fdb
SHA5126f625027cf2201475f217288cfbaa0cd322d69cee2a1e8dcae5d9d4b4c3d05e7fa05ccfbe8eeebc73ecf49f5aa96a1a02f066881b26e21ce58ac6a7f4ab014a9
-
Filesize
6KB
MD5748dacd0a9f155431c46f82ed78e0b5b
SHA1db2f2cb059629f15564b80721c33570d674d9fa8
SHA2560c00999fd8b53c48ec2503002919e64f073822f660dd1693045963b246f878c8
SHA512431ab0708c5941e8ddb7a8e1cbb834dcf05342b588d3566fc79b788354361f464fe10a3dba6c78a4586d91d3eb47ad041e9eb671ca81b6b8d2c33981619c7996
-
Filesize
15KB
MD5b71aab57f39058169d846c39384ae004
SHA1e79e70b39057204f854625e38929517790b5c7d0
SHA2564b4ac7d072b48c5a8dffd610d05d5e14cf045b3733cf04bb31d3d1a74e52dff5
SHA51254dd92b9cf521c4461576995e2f15e4f9692d43415bf678ecedda2e0d9f499e45c3a83c933d12711a840a23d6b496efa7cbe7ebc78a62af8c1a8d4649e4c6218
-
Filesize
72KB
MD5ffca120765af4bd256f59250f9bfca5e
SHA1aea724208c6f672243479122ccb241d8d5b3f4a9
SHA2563cc837d36e686db24d98a9fe394dbc2906d015270636dc2bb6efe544ffd26726
SHA512e5bb35d609c03a2033135cbae06e894769825244ff529325e8614dfa7d5f9da3ee34d484df0bef1cc5e919a0da3c0ef77779e0f353c7a027b43d3cbfdb844e78
-
Filesize
143KB
MD5b661cdc66e95b85794d7c9e3826ae043
SHA1d585fbd4c49566751893e44dc8f392376eb5b063
SHA2563d4b88b8a46fb06363d630fe091f2f97b78d08abbba3cf5f8627c25e74f44359
SHA51235e5e0cb0b444b6ced8f472b4ebc623bb4d227736f358b66329c5047fbe04f93425bb9b1ca92271235192afe72c91248674036d03feb130416cf13942ba77f92
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd