Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2023, 13:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://vk.com/away.php?to=http%3A%2F%2F19.platinumdistributors.co.za/daniel.hagmann/[email protected]/%2FVerizon&txid=B20200331_1488798683&lid=18207&tid=121811&vno=5<id=498307
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://vk.com/away.php?to=http%3A%2F%2F19.platinumdistributors.co.za/daniel.hagmann/[email protected]/%2FVerizon&txid=B20200331_1488798683&lid=18207&tid=121811&vno=5<id=498307
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133248357736845567" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1752 chrome.exe 1752 chrome.exe 2096 chrome.exe 2096 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe Token: SeShutdownPrivilege 1752 chrome.exe Token: SeCreatePagefilePrivilege 1752 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe 1752 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1752 wrote to memory of 4736 1752 chrome.exe 83 PID 1752 wrote to memory of 4736 1752 chrome.exe 83 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 3836 1752 chrome.exe 84 PID 1752 wrote to memory of 1336 1752 chrome.exe 85 PID 1752 wrote to memory of 1336 1752 chrome.exe 85 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86 PID 1752 wrote to memory of 4672 1752 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://vk.com/away.php?to=http%3A%2F%2F19.platinumdistributors.co.za/daniel.hagmann/[email protected]/%2FVerizon&txid=B20200331_1488798683&lid=18207&tid=121811&vno=5<id=4983071⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb01689758,0x7ffb01689768,0x7ffb016897782⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:22⤵PID:3836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:82⤵PID:1336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2148 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:82⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:12⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:12⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4452 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:12⤵PID:3068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3148 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:12⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4620 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:12⤵PID:4788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4004 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:12⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5836 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:82⤵PID:1480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3128 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:82⤵PID:3908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5068 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:12⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4464 --field-trial-handle=1872,i,18408258497632866189,12212614750711667389,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2096
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2772
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD532cfd92223ddd11564ab20959ecc8acc
SHA140be74240a4723d319887a11ef5afab0bccd27bb
SHA256f9ef76b2929e2bceb3db6b0dadd8ef518c78f59c9d855e8175cb67a21644cfa1
SHA512d044f2a546d4050ab1d47768fb4836d98b8edd94e5ea1bd4be4a757ac823a570149bc9197b7753f0abca1ffe960d106df6dad913aa2804cd5dda309af98944ec
-
Filesize
1KB
MD548932889c1366a37952d82c83e3e4401
SHA19177b1e4f1e94a7d797a4bce97be8c4882eaba9a
SHA2563d8e5e6af964fac96307ec0e68cc699d3f94cb366b8ff9480c3cea95f15a1bcd
SHA51238fb60944e8429edbad636627a5f909af27d1794a09e1b7d417d175e76df9496a755c6bc8e27c9bf7b4bccc52ecfec945fa7732dbe4081a908c262b0f98c33c4
-
Filesize
539B
MD5ac27ffff9cddc349cc2ff38c979eb341
SHA1e85447098f9f1d7121cff6424ee7ffc41258c72b
SHA256570fd199da6b05123b29046df41d1521b047ba6538ea0bbd26368d4afe5e051f
SHA512711642610c32a5f9be85b983f046e573c013dad98ade35aac59ab8e702318615a49e735ea0c9c470576b97ea6eebe781403e55ea784d2bab8706a136bb8f8a56
-
Filesize
706B
MD5b8d02bf73e0d00d260a72b1a2e9de900
SHA1fc2fa2a0e07982e13673770ee20221476ae6f0ec
SHA2562eb7e6238844c214ed2ca283ea9e3a6c2b5f403c36fa4958ca116a6e80e9e1af
SHA512a58b6e5cdc229d8c704389945ce497b574bfa05e6037360e38e3402cf84046c28b8228a51fb40545766d0f53b699eaad9fd8211a81059beaaff04ecc8180e891
-
Filesize
4KB
MD5c55bc1d810e7b6b2efdcf29bf01227c9
SHA11a2bd72c2d123163d0f89277fa2d477715ef2d03
SHA256887cfaeb1337f59762c1c63308bf56be3db7f3009e21ae1721230887a13c0755
SHA512cb5e21af7de4a994d3c4144014358c36e80055105f1eeb4040597469df6f0e6ce8750e6fc0a6e5be4b88b0865f2bb9b3e38d11f694a0b721bbbc3d00afb5c7b4
-
Filesize
173KB
MD5a4e3f425db6d8d52875b18f9afcdbd2d
SHA1791c08696af94f44d5cb7aea405482999a117a43
SHA25682af8555eb88d1f9f02a346c7019a862a4a408f9fbde67eaf19539015f50d6fa
SHA512b63dc229d832dbe187a3f939269627088cd960e04256abcc08ae01a6e3b4fc7e14856a676ec540db9a9b928dcc6cdd064c389e5874179758b34590e7aa7dc30f