Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
159s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31/03/2023, 23:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamunlocked.net/who-wants-to-be-a-millionaire-free-download/
Resource
win10v2004-20230220-en
General
-
Target
https://steamunlocked.net/who-wants-to-be-a-millionaire-free-download/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133247876577672218" chrome.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1028 chrome.exe 1028 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1284 chrome.exe 1284 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe Token: SeShutdownPrivilege 1284 chrome.exe Token: SeCreatePagefilePrivilege 1284 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe 1284 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1284 wrote to memory of 2008 1284 chrome.exe 79 PID 1284 wrote to memory of 2008 1284 chrome.exe 79 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 2508 1284 chrome.exe 85 PID 1284 wrote to memory of 3028 1284 chrome.exe 86 PID 1284 wrote to memory of 3028 1284 chrome.exe 86 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87 PID 1284 wrote to memory of 2988 1284 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://steamunlocked.net/who-wants-to-be-a-millionaire-free-download/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffded819758,0x7ffded819768,0x7ffded8197782⤵PID:2008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1820,i,9971137683542286631,900733167046936907,131072 /prefetch:22⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1820,i,9971137683542286631,900733167046936907,131072 /prefetch:82⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1820,i,9971137683542286631,900733167046936907,131072 /prefetch:82⤵PID:2988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3024 --field-trial-handle=1820,i,9971137683542286631,900733167046936907,131072 /prefetch:12⤵PID:340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1820,i,9971137683542286631,900733167046936907,131072 /prefetch:12⤵PID:1376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4652 --field-trial-handle=1820,i,9971137683542286631,900733167046936907,131072 /prefetch:82⤵PID:2608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1820,i,9971137683542286631,900733167046936907,131072 /prefetch:82⤵PID:3756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1820,i,9971137683542286631,900733167046936907,131072 /prefetch:82⤵PID:5064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1032 --field-trial-handle=1820,i,9971137683542286631,900733167046936907,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1028
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1780
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5d8852d6e63c64bdd82b376aadfb85e98
SHA1378569ef6dad45eb1c20997ef98b1984713e324d
SHA256d7749a69ca903105c5d7356312877e36977b5243f544b78256cf7c4bf4fe356a
SHA512604ffc5e7d2a5764b65a7dcfc7efab0ec470b491849289c4acc392827766a608e6e16958fcd49efca88be75e9c02b28d068bdb27f81ab1b68ee5b7ee127f2016
-
Filesize
1KB
MD588f9fd19fca3a0d5942ffa99faca1b4f
SHA1eb9de1024c02835d65b393c29ad188ce7001146c
SHA256add5335d279db19bf344f7f26be64a3edf34f884ffb3677bbaba30ffb57c17aa
SHA512b54063ab4a5ceb943013f0d8dfd62127f688e49a2b1f62199d2bb08ad606f9b7a436674f45e90b7ab9d703a0a646f73d8d11aef2c26e2083dca509680768dada
-
Filesize
873B
MD5a82f987eef84373e83fbf2130b42b19d
SHA1348dbb2386158d32088ee2863e2022a18752c304
SHA256c7959dba5daa0a614e081f302dae13323f91b2095d4669d6728d74e91d333b32
SHA5124463acbfce2c6b8e66fee93651007c80b35578f95e53521f489fd6ef280a939b3d054f38ea849029146edd508cb5891a219e72467f85f155fb62b07c6bacbabc
-
Filesize
6KB
MD574c8a1fc3a40b3b68b7743b0bfb76542
SHA14ded0cba5660c291ab2960b5ab2628040273e308
SHA25629dfb93576ba63efc8e46ac1bc628e06a2101aea80d708f8c993842fa762c30a
SHA51234af62ea73bc8133e83e502eb75ef91dabc2f1110d2a3320dd06bac726b9b9af5b166127455c6239a27bdb736b7ea249433aeed5f864ad72d8bc29b956265966
-
Filesize
6KB
MD5fe7a7329454ef4bef393c2510d2f7c03
SHA1c75755e2fbbc443386651e59d1fc4a7ecdad7d1d
SHA256fca12a844077ad07f27767fab76f184d5ee04216220075ec63ab73c03bf4bafe
SHA5128822eaefa592e71a483de86265a92caf7c0460b698c786fdfe40f8e760bc06e3a7b976f33bd68d3c484411a46bc66a2e04e4d38fd9499b264c9c2e40256de156
-
Filesize
15KB
MD55dea5e1587f78c295e4d2df1bd27da74
SHA1a508affbec2ed5989a361b6ab8fc29ab44579582
SHA256f358a91f95497eb9685da7b79608dca91477a2963a14f16076e8229cd7f4bee1
SHA512a39f37404a266f4eb4be42b0208a9091262af44fe7c3379139f340b0919a22be333c84b411dcc34d2a60eb78c354621abf933a328c9c47f6d1be8b184bc1e0ec
-
Filesize
173KB
MD5299c62544d4ce86b60a8929ddfd591b0
SHA13327765dc8ad1d768b380dc3a4912960bdf8c79f
SHA25694c2e2b94c883068c8af50f8168bf7e5c9d1834bf6ec3d8ebe9b1ca73830bc79
SHA512c578f7437b5ff0bd3c788742c01384aaa3270ea52a0847090d8156646e7c5427b07d1747f3c08130dcba46a13003c4f7479e00a7c340870ed4ecc0084ee42317
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd