Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
29/03/2023, 15:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://cdc-aims.com
Resource
win10v2004-20230220-en
General
-
Target
http://cdc-aims.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133245847856090833" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3816 chrome.exe 3816 chrome.exe 4860 chrome.exe 4860 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe Token: SeShutdownPrivilege 3816 chrome.exe Token: SeCreatePagefilePrivilege 3816 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe 3816 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3816 wrote to memory of 3656 3816 chrome.exe 87 PID 3816 wrote to memory of 3656 3816 chrome.exe 87 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 4356 3816 chrome.exe 88 PID 3816 wrote to memory of 5072 3816 chrome.exe 89 PID 3816 wrote to memory of 5072 3816 chrome.exe 89 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90 PID 3816 wrote to memory of 3836 3816 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://cdc-aims.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc83739758,0x7ffc83739768,0x7ffc837397782⤵PID:3656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1768 --field-trial-handle=1876,i,14882663989266120237,8980176441263482085,131072 /prefetch:22⤵PID:4356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1876,i,14882663989266120237,8980176441263482085,131072 /prefetch:82⤵PID:5072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1876,i,14882663989266120237,8980176441263482085,131072 /prefetch:82⤵PID:3836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1876,i,14882663989266120237,8980176441263482085,131072 /prefetch:12⤵PID:3644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1876,i,14882663989266120237,8980176441263482085,131072 /prefetch:12⤵PID:656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4668 --field-trial-handle=1876,i,14882663989266120237,8980176441263482085,131072 /prefetch:12⤵PID:492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4936 --field-trial-handle=1876,i,14882663989266120237,8980176441263482085,131072 /prefetch:82⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1876,i,14882663989266120237,8980176441263482085,131072 /prefetch:82⤵PID:3452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1876,i,14882663989266120237,8980176441263482085,131072 /prefetch:82⤵PID:876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2784 --field-trial-handle=1876,i,14882663989266120237,8980176441263482085,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4860
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1180
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
882B
MD53d34e9922423e69c90c2c1cef4e26482
SHA1dd39df0bb7940fc5823998c54160cd70d2660f28
SHA256ff9e17b49216a884aa0b8808a266c92aaa226eddd917e164dae244ac3a220953
SHA5122399fec138676917b494d5a79f06196bd883fed6983bfc5211d0481beccb40706a54b3e0a3dfa5d5a3f6593ed458505557a1a7ba6b29e0a2c13cc2d1a5ff6c3f
-
Filesize
6KB
MD5d433c2145faee8fa8d2eb04138eec021
SHA1135edb20e2a67f901d40e40b4287e230ccf491a2
SHA2568cff9c5f4020eba09c6a4ee54f235a196e2b6fe92dd613bff4eb45c4d951ce54
SHA512f4ce262a6f294c89c03e7ff7e453726b7ce448ab8704dd609b5aac75783bf80c98f4d50c343a5ba6b21d0f2ee6a5e1d2b813436771e205e0546645e29294123c
-
Filesize
15KB
MD5b38d733a8e8eb131140d7f23d645d93c
SHA1f1787a3ea2dad157ad297106a4829e261815d3f0
SHA25686c1bf610c98397ee36b48e9683c0a4110e1a6d42d9d597e4b369cc60b55cf21
SHA51295cd3544bc4744dc52325bf382fc7ce3b02d5157d4d98cc679f04e91a231b4b8ecdfd62db75ed04c681c91e42690932edc8cd497661c13c8c73115078eb21962
-
Filesize
144KB
MD5569c97d9eaf970df805a93c2f3b8dde8
SHA1ff5a90184ee7bea0aaf951c2082836fb5492bb1b
SHA2564bdffc849fed5e693999c276b67871bf64632772fdf25fc92290cbf9b98b8937
SHA512357a013cde872f6629c6af22979ab28c442f0101d273dfdab931dcb9b0572fdbc4b6a4bc7778e237bf0338fda620ed303deaa4fdbdb49c2ad645e9a4a8fd21bd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd