Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2023, 16:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.google.com/complete/search?client=help&hl=en&gs_rn=55&gs_ri=help&requiredfields=productId:410864&ds=help&cp=6&gs_id=o&q=disbal&callback=google.sbox.p50&gs_gbg=DAuIs84QAyYjFKB39"
Resource
win10v2004-20230220-en
General
-
Target
http://www.google.com/complete/search?client=help&hl=en&gs_rn=55&gs_ri=help&requiredfields=productId:410864&ds=help&cp=6&gs_id=o&q=disbal&callback=google.sbox.p50&gs_gbg=DAuIs84QAyYjFKB39"
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133227688169522704" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1224 chrome.exe 1224 chrome.exe 2644 chrome.exe 2644 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1224 chrome.exe 1224 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe Token: SeShutdownPrivilege 1224 chrome.exe Token: SeCreatePagefilePrivilege 1224 chrome.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe 1224 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1224 wrote to memory of 1784 1224 chrome.exe 87 PID 1224 wrote to memory of 1784 1224 chrome.exe 87 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 3880 1224 chrome.exe 88 PID 1224 wrote to memory of 4900 1224 chrome.exe 89 PID 1224 wrote to memory of 4900 1224 chrome.exe 89 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90 PID 1224 wrote to memory of 4652 1224 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://www.google.com/complete/search?client=help&hl=en&gs_rn=55&gs_ri=help&requiredfields=productId:410864&ds=help&cp=6&gs_id=o&q=disbal&callback=google.sbox.p50&gs_gbg=DAuIs84QAyYjFKB39"1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab5c29758,0x7ffab5c29768,0x7ffab5c297782⤵PID:1784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1820,i,9814531910928625245,9203156337397010709,131072 /prefetch:22⤵PID:3880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1820,i,9814531910928625245,9203156337397010709,131072 /prefetch:82⤵PID:4900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1820,i,9814531910928625245,9203156337397010709,131072 /prefetch:82⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1820,i,9814531910928625245,9203156337397010709,131072 /prefetch:12⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1820,i,9814531910928625245,9203156337397010709,131072 /prefetch:12⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1820,i,9814531910928625245,9203156337397010709,131072 /prefetch:82⤵PID:3776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1820,i,9814531910928625245,9203156337397010709,131072 /prefetch:82⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4988 --field-trial-handle=1820,i,9814531910928625245,9203156337397010709,131072 /prefetch:82⤵PID:4272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1820,i,9814531910928625245,9203156337397010709,131072 /prefetch:82⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1820,i,9814531910928625245,9203156337397010709,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2644
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2908
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5c0239ac0ced6c0d355deff7e680673f1
SHA11499fcd3c0eaad33393e156511618c5f5e7cdea1
SHA25603273bc077cdf25c829aea997501bad929a86b9c9eb517fc104a1814222a5a9e
SHA5121a712947cc96bfeffc31fe12e96b3c77e594abbb1881490b75073214ff638fb265e85a7055f02f742a4a35b11c095df7a85014d4faaaaad49bbb36a6241f264a
-
Filesize
6KB
MD50413fd50f45c8c557a94a6fa6841dc66
SHA173a9cec6946284a3c9d8d02866350fbe7a4ebd43
SHA25686cd0c8271333c961a2a56dc196cbfa07712884430bc30bf83d1ce7f750779cd
SHA512ff8cf0c8121344b49414b09ab88729c1d484ad59a1b5a1b7538bcc57fe9b4544c4343c082cf3200e5f4cfa3ada6cd5eb39e3fdaaae71083b8a87652c3f0dab98
-
Filesize
15KB
MD55e9c04318e601384b1c9068789d04ff2
SHA13992eaacca024f9e5c8e7a75435254b843d37ac8
SHA2560c6d4dbf25d0c019f302b98798c3c93cd2d512c71cd5cd89539ddcd3478f1e0f
SHA51276c0b89dff6f18f2f08a87c3bada0fcae6dcf96e57bd59b998e06c94e6b2975edd13b30f29e1c76151851e6a7b170525cf405c1a36fe3c9369229eb7e0290bb5
-
Filesize
143KB
MD53f4829fa45cf125ef6e2a3bcede27c4c
SHA19b2d7c27a0e35f9d09728494c1fb65f4acce2eba
SHA2562b7f190bf0ba1be9f951b5e2295014dd0efde3c8d23493d846fabd1577c1793d
SHA512612a8c0866530bafaa333130f35826f6e8cc69ff3b61d05e38d8a3596b67ce6ed22219e0afe20cfd18ee0411bd5b3f75153a5358cb7947019ab4e605ecc4271c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd