Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
03/05/2023, 09:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://8924803779
Resource
win10v2004-20230220-en
General
-
Target
http://8924803779
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Software\Microsoft\Windows\CurrentVersion\Run chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133275864231977175" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4692 chrome.exe 4692 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe Token: SeShutdownPrivilege 4692 chrome.exe Token: SeCreatePagefilePrivilege 4692 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe 4692 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4692 wrote to memory of 3824 4692 chrome.exe 84 PID 4692 wrote to memory of 3824 4692 chrome.exe 84 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 4656 4692 chrome.exe 85 PID 4692 wrote to memory of 640 4692 chrome.exe 86 PID 4692 wrote to memory of 640 4692 chrome.exe 86 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87 PID 4692 wrote to memory of 2304 4692 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://89248037791⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4692 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa91569758,0x7ffa91569768,0x7ffa915697782⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:22⤵PID:4656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:82⤵PID:640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:82⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3136 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:12⤵PID:3896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:12⤵PID:464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4560 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:12⤵PID:3508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4832 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:82⤵PID:624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4548 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:82⤵PID:4760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3828 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:12⤵PID:4340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:82⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5544 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:12⤵PID:2904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=5736 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:12⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5840 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:82⤵PID:3208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5892 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:82⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 --field-trial-handle=1820,i,11878437298553512662,2535988036886651647,131072 /prefetch:82⤵PID:1512
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3632
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5519005befdbc6eedc73862996b59a9f7
SHA1e9bad4dc75c55f583747dbc4abd80a95d5796528
SHA256603abe3532b1cc1eb1c3da44f3679804dd463d07d4430d55c630aba986b17c44
SHA512b210b12a78c6134d66b14f46f924ebc95328c10f92bfed22a361b2554eca21ee7892f7d9718ae7415074d753026682903beba2bd40b35a4eeb60bf186dcdf589
-
Filesize
312B
MD5f2f641c4603250b7be438c799ae0b470
SHA1aa5ca285710032eba185e7d56eb394c5cefd9e2c
SHA256ae4e828a4d3e60703c7e8cb57bd0d56084d3d578aa16bafe5012141b48602e89
SHA512ac70e4afc6da63b9bebd7226d0db91c7a3fe5fafa28eb1b27192fbe5c41d115207dc3c62aba59a0c452fecae3f7241fa2191a54be8fd00cbef8484f6980dc126
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
1KB
MD58edd6b94350885d0561a88ca749bc19f
SHA1b4fa17748edc157955a4229155494d09b2ede1af
SHA256b9196b773c5e9907a01c68326c3efb44ab470f1f524312ab98663286462b2591
SHA51258a7042b0ab97684d50bc7bb39e476587f935086dfc9f2cabfce4688f29261b51703e6b6938f9879837fa75c06bdbe100d71d88b9bd4d7572723ebc4abec5af4
-
Filesize
371B
MD56ebaaf0d10b4e7de8fadbf879ea1114c
SHA16e566f0759dcf9ad4af963ac6ba5a160c132c8b5
SHA25654b4ffd3dcd4bfc8cc049483a590dc0fba54a29e7c29aa2f96a8541a208f420c
SHA512adc0abef1f02584f0261b10ce20acfcc702d81365976d9942ce175d167ecca7d7e4d2b1e0885418eb5d9a7061a56f71873667f167d9d7b300fab0958f31409ea
-
Filesize
4KB
MD549fa35f86b43cfef2f278afcc65b5668
SHA1075b199ea2f78103d49b0f8010ca980dbfe15fe2
SHA256d713a03b6a7c7c96140cdd52e6cbbc326641e5188d2db218557d3d6ab2334d09
SHA512db50707964b957e9d5c43db5e89b3ec40dc2cbf6d066c15fa58bc3713921b81b7ad51df1e585bd8a6eb753a176ade9469c4d93894a800e97bd1dd78ee192ea91
-
Filesize
5KB
MD56d51c727ba078a71e838864c60a1c33e
SHA1c653cd40ddef9566129740c2d3f4ba1a3d0e6c45
SHA256c9b3c0422f5a8b1f1d2a3384c66ec874e4f4b96511f81ee662ed4889bc043d42
SHA512796a595b318084979005cbe7eb79990431ad64b5009e2f30373bed9cd4a4ad340062aa69d7050d809eed2f518d7004411e009254af9e05eec62478c594a57a1b
-
Filesize
147KB
MD5095e740a45a27adeaffacc63dc8651b9
SHA1e30fb3adf45c20a46d3d7e6da50b8f901a6ff73d
SHA2560aa85b3f5f90d1275692fbcaf371064b5d95e0cee1852fe4cff8376aff72b2e3
SHA5121a5af2d4719dd46d22e675daa65e7ee8dfe605996ba40c2750ad8a7565aa639c84a553452960da264cbba63ca13c8be115a3a3f98b82330af53fec948c5056f9
-
Filesize
147KB
MD5cd9477a640a82ed8dc9cc9a5ed2d2286
SHA10713a95ccb3cfeba96bf4bec521b5fa63cb7b15d
SHA25687d57e7519cd387b55de5d6f3f11cd4da0e8fee9d0f2ea4792e505404d19d17e
SHA512b7d36bc7afbe7aa0cd8c978b801ad87cd107343985348398f58f44f6f693b3a26ad34a0c006f10ec6e0e66a40c0a8bc51853ca01017ba3b71fbbdbcb87798cd8