Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
31/03/2023, 07:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.joyclub.de/event/1373331.fesselnde_nacht_karlsruhe.html
Resource
win10v2004-20230220-en
General
-
Target
https://www.joyclub.de/event/1373331.fesselnde_nacht_karlsruhe.html
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133247272372391077" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4080 chrome.exe 4080 chrome.exe 2824 chrome.exe 2824 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4080 chrome.exe 4080 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe Token: SeShutdownPrivilege 4080 chrome.exe Token: SeCreatePagefilePrivilege 4080 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe 4080 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4080 wrote to memory of 2296 4080 chrome.exe 84 PID 4080 wrote to memory of 2296 4080 chrome.exe 84 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 1332 4080 chrome.exe 85 PID 4080 wrote to memory of 3244 4080 chrome.exe 86 PID 4080 wrote to memory of 3244 4080 chrome.exe 86 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87 PID 4080 wrote to memory of 2172 4080 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.joyclub.de/event/1373331.fesselnde_nacht_karlsruhe.html1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4080 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffac5609758,0x7ffac5609768,0x7ffac56097782⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1908,i,5556922702356217368,15670742475652774086,131072 /prefetch:22⤵PID:1332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1908,i,5556922702356217368,15670742475652774086,131072 /prefetch:82⤵PID:3244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1908,i,5556922702356217368,15670742475652774086,131072 /prefetch:82⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3176 --field-trial-handle=1908,i,5556922702356217368,15670742475652774086,131072 /prefetch:12⤵PID:4288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1908,i,5556922702356217368,15670742475652774086,131072 /prefetch:12⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5408 --field-trial-handle=1908,i,5556922702356217368,15670742475652774086,131072 /prefetch:82⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5508 --field-trial-handle=1908,i,5556922702356217368,15670742475652774086,131072 /prefetch:82⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4944 --field-trial-handle=1908,i,5556922702356217368,15670742475652774086,131072 /prefetch:82⤵PID:4504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2808 --field-trial-handle=1908,i,5556922702356217368,15670742475652774086,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2824
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1892
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59358739bffde42d5ef1ee5be5798545c
SHA151e3a240e8a8af02d346c9f1753c37a59df90585
SHA256e34e3d7b971ff739d8157bff0f92dc78fe44d0212793ce9f9f605e92fec5c4cb
SHA5125ce579934af41e1abb72a90fda0888706cf3668e8ebaefceaa6adb8ee8596e359f7b7ae35bc4efb6f0ea76a9d9b27f1a6f5713e8a3bd304648d2d9d1a6cb359a
-
Filesize
1KB
MD50b177a5a91676e48cd83071ab9f0d97d
SHA1fdb2b0a6033afb74f05013e34aaf8ca4fbc0df95
SHA2566b7848059f90a1c4303932c0f2427160f18a166a2551c34f9a8b31d6b1c0d834
SHA512ca74c999a4879cdd78205196453081d84122f5e68bc226405027e5695581460ba994beab7663073e068aab5a1159745c8e585c7f9547bf4fd0b4ca3d5fc3a4c2
-
Filesize
2KB
MD5c38d4d55766cf19669e30a6c9023776f
SHA186c32f3ca461a6fd63a63a3609949047ad4aedfb
SHA25691a07794eeabe9573c0a3ec3da340e65fbfab16d7a819c2e2e60df628cac58a3
SHA512b595b2beaa4119d089bdb46029e8e8dab42096b126a8ff7cea5eec709e7cc5000f71778f0e1240ebc680f57cc8eccdf727c7947af7db641b4161e3168a98c1b6
-
Filesize
1KB
MD5993863ffed4c1b8d6176ccacdd34f708
SHA112e680bf99c5452bf399503d29da49fed20e43f6
SHA2565981e2ac6ff34c7e672611929dff97ea21fc084bf15617081f3c0a592dc5ada0
SHA512622bcab75cbb375b54576518579e4d35ab1f1b17811a03e1bb6d37a6bb9d4f026ca6ee54e279aecfa363a7e04b897f4a66f39899e7372568eb6921c0c33a5d78
-
Filesize
866B
MD57c7ece8df435cf5a02b66e52b0d80026
SHA1557036dbb6564f540fa1f1a26a64c635029ed739
SHA2563db6f9a0dd0e85774856c991c201a8e5448d223e2a19fb8e11d83750ddfa00b1
SHA5120b63e78a9b7b53fa1d01cba7949f7fd95826d2c9b4983a2d4821fc0878f981cc7b6e2e2e9863b148074fbf48bcd4bc3b8db9f9f01c9be105f671977fe46b8606
-
Filesize
1KB
MD58825d7b5dca39b34fdddbbb4f847df1a
SHA1b5a30ee1b2512459b3222d02776ef6576f007862
SHA256ef63cc8994e343943a9aaad833db847ae9f28ac5f8de9deb4dc886c28a7879a0
SHA512b91707696de432ec07e01a83bd34f731a3912864b238be73d6360a5303fec7637946b420dfbbec0059354464717f2b777eb0249ad6b78123ebf9d606fd42cbcd
-
Filesize
6KB
MD5247d7ea52fcdebf897790749732c6546
SHA169a7e55ca800254ec28e292a525de64b230c24f7
SHA25653325cee75c0baf5b9b93a16c8b6578d78b9d5af5dc7e3ffeba1777bec607551
SHA512ee33c3b4f408272253b63ae43db2cf1c012067b7325d85243587ceb084b53bba1e393c593a7845a932cdf7878b230141085214a90e5e95a8179d11455a42e0f1
-
Filesize
15KB
MD5b8572be53b8533e086a3718de020c553
SHA148a2aadaf170d9cf1fe480632d8d8171f84350f0
SHA256e56122a5ede0f8e9e6c03d520a4385c210708fac83f9064b56effa511771c319
SHA512a975b2619a1f8b243f284baedb1106ca94c32b643587f0419059ce19366b5ba0290330602b80fe5f313d13a32a5a37ca7eb081b10d21ba9373fdcaa44b5b03d0
-
Filesize
15KB
MD56cf34f499e151228dd1ee825c8e1144d
SHA1dfea12eecb4c589bc3197e3b7e03f02e315ef431
SHA256e0c0d195f5c6a17dfc064ea6c9fb050e662b0b25c1b7e0acac67c7bb32d00eeb
SHA5121d845ba6af5b3c0814dec5ba8744fd210bd28172beb6c8661bd7379f61dcaaf58f52e3ff8e2aebe2207643aa70588d3831650de9d9390bf0f00a937dfa857e58
-
Filesize
173KB
MD5c689735c5e15c205413e53354fa65d4a
SHA19062fcde09b245143271626c79199bb96c9c26e3
SHA2565b0f267d61a579da9b66b280660740f50a181d661616c769cee8ecd188c21b8c
SHA5121ce56d932f9a8ab9ab38e44eed3b8540d27e0599b0626de079c2007e2670fc6a34defaf372624e35644e7a1de86e06f25d2abb1af8f0d2482ec1e42b8aa3bcd3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd