Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
600s -
max time network
504s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
13/04/2023, 21:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ncv.microsoft.com/ipVjKQScTK
Resource
win10v2004-20230221-en
General
-
Target
https://ncv.microsoft.com/ipVjKQScTK
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133259007493790726" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4100 chrome.exe 4100 chrome.exe 1536 chrome.exe 1536 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4100 chrome.exe 4100 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe Token: SeShutdownPrivilege 4100 chrome.exe Token: SeCreatePagefilePrivilege 4100 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe 4100 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4100 wrote to memory of 2576 4100 chrome.exe 85 PID 4100 wrote to memory of 2576 4100 chrome.exe 85 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 3496 4100 chrome.exe 86 PID 4100 wrote to memory of 4608 4100 chrome.exe 87 PID 4100 wrote to memory of 4608 4100 chrome.exe 87 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88 PID 4100 wrote to memory of 4876 4100 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://ncv.microsoft.com/ipVjKQScTK1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4100 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd04a39758,0x7ffd04a39768,0x7ffd04a397782⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1916,i,6815139592074386091,15543411761197990224,131072 /prefetch:22⤵PID:3496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1916,i,6815139592074386091,15543411761197990224,131072 /prefetch:82⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1916,i,6815139592074386091,15543411761197990224,131072 /prefetch:82⤵PID:4876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3212 --field-trial-handle=1916,i,6815139592074386091,15543411761197990224,131072 /prefetch:12⤵PID:4668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3220 --field-trial-handle=1916,i,6815139592074386091,15543411761197990224,131072 /prefetch:12⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5064 --field-trial-handle=1916,i,6815139592074386091,15543411761197990224,131072 /prefetch:82⤵PID:3528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1916,i,6815139592074386091,15543411761197990224,131072 /prefetch:82⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1916,i,6815139592074386091,15543411761197990224,131072 /prefetch:82⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4984 --field-trial-handle=1916,i,6815139592074386091,15543411761197990224,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1536
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:848
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
264B
MD58ee77973da3b87c82863479b0386ad79
SHA16f62720ebf5bba8428429be680122f6b51ac075c
SHA256566e9cb5db2df9983c5e3d68b655319c43353975e07597416acb6c265516c9f3
SHA512f928bc0785ef21904c480ac1e41ce424ca2d9aa8327b328e21837a485fe86c5a5557a7121b63964c06073983933988ab2aaa8b797383502be5917af6af1381bf
-
Filesize
288B
MD5541959d5bf0c8f855887190bd0a46f5f
SHA119b2d7b598f31d3324541f20b6265bed8d8017ca
SHA256f403b7bdb4fb04dd2da1206a1b7e183f0844c465eb2c87ce2e8969dac62fb9a4
SHA51293ad4d5f928026b7e43539314a956972de2c1df71b9bf8bb72816528ac8406007bffdee553267d9f9fbac26082343778d83c6fb2584a3e5f7d188e12d06708ef
-
Filesize
1KB
MD5dead7818340bbb94d4f8764253a0274e
SHA1eafcabc992cdac623b84cbc5de2f30303c14e3df
SHA256b6525798eb1c70b27c10bc324b6a03fdc3d8de1596645367558803ef276ce821
SHA512415f88467b9c50e11740f81c63598764e6fabf3f21ba2a1244ca466a73dce8674183ce09bb567d8322334e4ba90bb7ce658114cbe88fa841d68d2d6ad9f90286
-
Filesize
873B
MD56b517898a01d38c6030cc3847bf97597
SHA19ccce38f3099ceb6ea97737cc1fe49257cebdbc5
SHA2566dcf8b7c774ec3a70f0ec11cf55d2af211d143c24e1d79fbcb13fbd3a67babc5
SHA51217277f0847a8d74403be9bc468f0b2755232f6366aa0fbb4006560c75baded0927adc7aed5861f549a020828254b9fd32fd2dca810b06f1db1792bbd2e61aa62
-
Filesize
869B
MD5d6c17e52ef07f104c87d12a8e120b65b
SHA140cc7e564a29bb80522ae601a03ae6bf25df484e
SHA2569a09771b0f3fbf8e7090f79b58209eb4dda9c6d227e146a0f0bc76b4239d4e6f
SHA512a7efe9eb245b8de5668a87b22b10b798df6368ae9fdf6a6695e160489d4f2c328db737392f45d823b053fdfc8c0f6662306ae0e100730c89d09f640f66d8b3b4
-
Filesize
6KB
MD52b470c4abe265ce0a85a1d22e872d923
SHA18dbbbabf5be8fb05f26d7591487b5cc52ba04ab2
SHA256b6385f83f36d3cc232ba5909e74441cfe3cc10c05c05a2f1dff3caaff6b724d2
SHA512d47090897d1922c8f69845136083095c21825fa00a727e07541efdbb3dde12d07a96539497c6fbe01b374f7e3261ee8bf51acecc48fda1283eecdda6c231850d
-
Filesize
15KB
MD5024da76e5f960408885bec335f7d0e73
SHA1a73a755837b200bce0e68c13726994e5bb06ec8c
SHA256aa8f9bccab2daa275a500066bfdc60348acdab78c7a6e04b7780c920717625a7
SHA5120b80b8a977ec25b338a6c58e46de2c703ad416de437f6257f7830179c97367e9096ae9bda4d65b753f72a6fcb760489308371342efccc8efbbb18c38878a1e75
-
Filesize
199KB
MD5851e355f0076b07c476acdb02a28a2a2
SHA1b87f008677bc1c50f1fa921000e98b9513593e76
SHA2563fba923e938e500646d5f660ac4f887c115a2e40416b8b8f1c1d306ed0da2b35
SHA512cc06c3ec26ad17b0df61ed6969b66eee969409d7a654b225a483adffbae7fd40b81f7179424958884944e6b36dda57ee077e42b747ea79dee13f3edadcd63947
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd