Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
296s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
14/04/2023, 17:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.ps3cfw.com/cool.php?item=91144933
Resource
win10-20230220-en
General
-
Target
https://www.ps3cfw.com/cool.php?item=91144933
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133259665404211843" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1060 chrome.exe 1060 chrome.exe 2032 chrome.exe 2032 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe Token: SeShutdownPrivilege 1060 chrome.exe Token: SeCreatePagefilePrivilege 1060 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe 1060 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1060 wrote to memory of 1128 1060 chrome.exe 66 PID 1060 wrote to memory of 1128 1060 chrome.exe 66 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4192 1060 chrome.exe 69 PID 1060 wrote to memory of 4252 1060 chrome.exe 68 PID 1060 wrote to memory of 4252 1060 chrome.exe 68 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70 PID 1060 wrote to memory of 3300 1060 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.ps3cfw.com/cool.php?item=911449331⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9b7ac9758,0x7ff9b7ac9768,0x7ff9b7ac97782⤵PID:1128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1940 --field-trial-handle=1736,i,7788617347595013442,13423988431950653957,131072 /prefetch:82⤵PID:4252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1736,i,7788617347595013442,13423988431950653957,131072 /prefetch:22⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1596 --field-trial-handle=1736,i,7788617347595013442,13423988431950653957,131072 /prefetch:82⤵PID:3300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1736,i,7788617347595013442,13423988431950653957,131072 /prefetch:12⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3004 --field-trial-handle=1736,i,7788617347595013442,13423988431950653957,131072 /prefetch:12⤵PID:3092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4360 --field-trial-handle=1736,i,7788617347595013442,13423988431950653957,131072 /prefetch:12⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1736,i,7788617347595013442,13423988431950653957,131072 /prefetch:82⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4536 --field-trial-handle=1736,i,7788617347595013442,13423988431950653957,131072 /prefetch:82⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=944 --field-trial-handle=1736,i,7788617347595013442,13423988431950653957,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2032
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4644
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288B
MD5e7d323942bb15eacc97559fbddfcf1fe
SHA1fef599f78bf3b3ace78f31d321a16f9846ab5c50
SHA256b37c8940eb3ee73464d33ae305e0bc64c91f355cf32ad43ae3a422e850bf1be0
SHA512dacf2a926643715894b1a8677e8f73c639aed8bc09eb4fc6e6c44ca82512915c5713f12ab0e3b9d6b298bcc3830cef33e9d1662338e092aa576a582e4989a4d6
-
Filesize
2KB
MD591e53242aa912ec0971bb8278d4c61cc
SHA17ca2f2f415abf36a0b0122f3b5bb9bdf81e35ff2
SHA25656c97ab9ae0db8143f19f3f99141bb47f3c72b6d58d9f7b7a30ed72740870b01
SHA5122ca2d0495301c2a730442818ce7fed22a23211e58ba16fe5a18e3ed129d868c096ddb3bd8363b6b140b1db52b2b570ab3aeff6d6f7c36185774bd65254c4eb7f
-
Filesize
2KB
MD55c3e9832e8decd726448ac2d0a9785da
SHA1f1febd9aea0e26aa9d8cd37670d34f13e0bc5ac1
SHA256b4a2d12c6439cc0931b6e07fe1216a61b8e6aadf5a2ff5258a03c4331c508b75
SHA512ac680397ddb935556ecdf985f7d5afe6c8f60b3d4c29a0205368c028fd8e14e0812c979c06ba977b76508cb720baf40622d5beda06e5038ff8b6f42f94d58f88
-
Filesize
2KB
MD545b334881ae998c48fc7436c8054f8df
SHA1958d6fa2764090601c7738063376183b7ce565df
SHA25636b0a2ab5421ce0dd20f31b8b80af4a8625bea0411618cedb46d10b507904376
SHA5122f289849d684e37220ca75f66c41e8f32aa3c06bd3dfe59f53b91b5f39cfc9689b76b5c907e57e628e9eab376f25e5a6fb0e1b4f253cd74d3d5627046bea5ab5
-
Filesize
539B
MD5a87bf4ef8242ce8208eb8bae345ac4f9
SHA108528e71e3c39aded7a42dc71c99c946f931ffbe
SHA256d94182b3e42b3f12f6cbd98579367a02907d201db5532de96f158b78035507a8
SHA5121c2a717b07effde0d89442a499b5beece5ef8f70e567fd259bb51f33639380244edb6f63ad15de324d14ed2607b12ba57d0192725dab915dc09b2b80ff32d83c
-
Filesize
5KB
MD523779ef7235f9716b86485c320d30075
SHA1fd6f35d541062e2c38e04e790378f18d352cec6d
SHA256f86cb2b479de48ad7d7164aad8a76c0e4f99f623e0822831b81fb394af611b25
SHA512afb901c361d3d49713771c74a7eda4c547be5acae1b19da47ae061099450e2093f83f2a2b37eb562010a152569740665d46d380f4b13a12e5aebf19b8af6c788
-
Filesize
5KB
MD57c4e1997347b1ef73c3dcc6b64fb2aa3
SHA1ed866060efb4ca35731c7dec7341e02980f08750
SHA256f02e02992c5db77b173aa7ddc78d41a0d5fd617f34a5a65f50896269f0392053
SHA512a819cc1b33593f430a46d5350125f1dd4f9aa1b4d9f1c746a00f2ff3d593da65826a46ef5cd23778ed0be71850beedbcbd159ae855a885750b7d285e1c143bb2
-
Filesize
5KB
MD545e8a1436c85e51e239836c2b30628e2
SHA189b02b5e5e1cc69d4706d299a612b74aed92403b
SHA256a35dc16a4c87c4100cdb5ea027a40c54554d47622c7eb9092142396b8c3dbb54
SHA5120046c56f6cf3befa58b516270910ea827aa0b9d7e1082b885570d1dbadee44faa05a7a5014da06235b0c9119a356d6415709e4f4235cac9a69765a3b848f31e8
-
Filesize
199KB
MD57dfd8ab3ea6412d4ca0ce3ffcc6bebbe
SHA146185deb1133424c54031dc6345ed6458dece9b0
SHA256c67ca771d140104ec911cd0f23f284750a32f543e89ec2cc5fc093e17ee1f137
SHA512ca2fbea6c9efc48fc48c55719fb475ee9ad4feafb7b87afdfc02b2d876bcd611452f311ff5ae4e790a809edc57880a6b4b62a119c573baac1853dda4dbc03cd0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd