Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1775s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
01/04/2023, 14:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://tlauncher.org/en/
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
https://tlauncher.org/en/
Resource
win10v2004-20230220-en
General
-
Target
https://tlauncher.org/en/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133248386314359527" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2132 chrome.exe 2132 chrome.exe 2040 chrome.exe 2040 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe Token: SeShutdownPrivilege 2132 chrome.exe Token: SeCreatePagefilePrivilege 2132 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe 2132 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2132 wrote to memory of 4200 2132 chrome.exe 84 PID 2132 wrote to memory of 4200 2132 chrome.exe 84 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 5044 2132 chrome.exe 85 PID 2132 wrote to memory of 1472 2132 chrome.exe 86 PID 2132 wrote to memory of 1472 2132 chrome.exe 86 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87 PID 2132 wrote to memory of 1344 2132 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://tlauncher.org/en/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90d0b9758,0x7ff90d0b9768,0x7ff90d0b97782⤵PID:4200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1692,i,2298562202424998024,18173608852483630333,131072 /prefetch:22⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1692,i,2298562202424998024,18173608852483630333,131072 /prefetch:82⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1692,i,2298562202424998024,18173608852483630333,131072 /prefetch:82⤵PID:1344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3136 --field-trial-handle=1692,i,2298562202424998024,18173608852483630333,131072 /prefetch:12⤵PID:3244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3156 --field-trial-handle=1692,i,2298562202424998024,18173608852483630333,131072 /prefetch:12⤵PID:728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4796 --field-trial-handle=1692,i,2298562202424998024,18173608852483630333,131072 /prefetch:12⤵PID:1048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 --field-trial-handle=1692,i,2298562202424998024,18173608852483630333,131072 /prefetch:82⤵PID:1960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=1692,i,2298562202424998024,18173608852483630333,131072 /prefetch:82⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 --field-trial-handle=1692,i,2298562202424998024,18173608852483630333,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2040
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1796
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\2e6f338e-91d9-41b4-9451-00cbeb52a537.tmp
Filesize4KB
MD5727893378614506f6ba8394021e39652
SHA19ede07b9e1a69098418ce081932e10542a322a20
SHA2562d9d37a4c1647a0539e53e10cb45155f295e4df1552b48410ea9ca922182bed3
SHA512c7349037c6ab89259dccc8f3163467a1a277128bc838988392b038e3d1ac6204d6bf845b0ff23838922004612b19479f3d2aebb72be783a4fecb756704bbbdea
-
Filesize
384B
MD5d6ec33c9cbf0b9292121bc4514babb20
SHA1ab5b37d4d6011b7c434962a790af8bd5b6b3adc6
SHA256beb14c5ea783aa7d7e1a00e3405943d450de90160326321bd788b311a8d17599
SHA5121c8df3ad8850b50de7bf91faac456082674a758b5298545ade43a8442ccf7a904bd6fced9692d541faf18edae1fb1e97b810407714d6a9c0ebd3745747abdf79
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
2KB
MD5873a36bb4a5d88fe7de1416184d25843
SHA1bffd10cac22e196942cdb369e83323229fbd7095
SHA2562be22fa284fe01dac469f03f56d9482510b4ef5b7c95895195425f3b35a935b2
SHA512a9ee45319f87f0fcfbcbfe1474147958af7b98158480f4ac436c6345e12b7c3d4734a0e6a920527dbba41b24ffee6511ab28e5067f7d6fc683c56794f39b8fab
-
Filesize
1KB
MD586c6b83491a6274a6a84646ca328888e
SHA15d2e3ce5d678a1b37fdade6995accc8027bd443b
SHA2565a496257e3ba7eb71691f7ac117486414d85688ed0cc0df2691faf21bee6b713
SHA5127aa69ae61c0ac45712166148f4442cbd5271bdfc4a0d7cc00b37260f9a9d35fc3a20038706dc85b9e7194c222bc35b27e308b13944a2d9226fc80cdcd551ca9d
-
Filesize
1KB
MD5565a12e12856445cf18bbd0e9893d562
SHA1a242d638c9c549d46b4b3619dd65b24c485e8580
SHA2568303eea0ab92b1d2b70eb10808338df7868ff49ef5c8787e865835f4e5af8142
SHA512d7d6ef279a2cfcc6b361eb204e17025e054cd512f60e01583e4e6489ca761f9c368b2c4d624911ef340bae9c88fc4eafca16f1933ef9256d2a7d372b0ba64040
-
Filesize
4KB
MD567e35dde4cdb82de9c9d9cdb25de0bfe
SHA1573a9aa29dc6de8a827d5bde83af1520c99cf20e
SHA25605e84ab624ab324776f32f0792e5bf52edd86db93a06d4a571e871fb24b6d300
SHA5120be098ee66a227e8e4240b7e004ab3bba0c1763b43f44c62c0ea196c4114add7aa79bbb8875462de6e5f23402cebd1c6b4bcd539283eddd4b047acb1a7a6fe6e
-
Filesize
4KB
MD5ee28e67ff182737fdab35076db66012b
SHA1ed568a667dc5e11235cf0448b85c8ecc22a49db9
SHA2566fdb175370eecaefd0cfb89526a396fd83858737cc8e30f565b51007e1035aed
SHA512a43ff2a817e428ce7655547e32508e64fe9d00e9e6220f8c5cf8f8d361b507323bd698839d5827c5222e10ca5f5aa0742de7cb6af75a0a22f862dc9bf74f5999
-
Filesize
173KB
MD5346ab68be680efaf355de750822cbc3d
SHA14cd889e8a0251c0309fc46a13aa1f2872892e692
SHA2569ded0c8a8600d48550fdb912108ece2d9eb68991a1f3b08bf78dcc87bac2ee9b
SHA512a921904e3959f70f3e0c50337dbd83a0e361d34e91bfe9719d22b85d3224de545ef4ff4a96f734f2129c60ec2d8ad1e480b7529e9a244e7fb0683c78b1fc113d