Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1797s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05/05/2023, 14:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ipfs.io/ipfs/bafybeiakyjshnzqfcymbyrlmdg7mn6tylo4lysur5i5jxdkfmyifsxqxa4
Resource
win10v2004-20230220-en
General
-
Target
https://ipfs.io/ipfs/bafybeiakyjshnzqfcymbyrlmdg7mn6tylo4lysur5i5jxdkfmyifsxqxa4
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133277710409019382" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1368 chrome.exe 1368 chrome.exe 1152 chrome.exe 1152 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1368 chrome.exe 1368 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: 33 1548 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1548 AUDIODG.EXE Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe Token: SeShutdownPrivilege 1368 chrome.exe Token: SeCreatePagefilePrivilege 1368 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe 1368 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1368 wrote to memory of 2204 1368 chrome.exe 85 PID 1368 wrote to memory of 2204 1368 chrome.exe 85 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 5028 1368 chrome.exe 86 PID 1368 wrote to memory of 1896 1368 chrome.exe 87 PID 1368 wrote to memory of 1896 1368 chrome.exe 87 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88 PID 1368 wrote to memory of 4992 1368 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://ipfs.io/ipfs/bafybeiakyjshnzqfcymbyrlmdg7mn6tylo4lysur5i5jxdkfmyifsxqxa41⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd3bc9758,0x7ffbd3bc9768,0x7ffbd3bc97782⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:22⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:82⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:82⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:12⤵PID:5080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3192 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:12⤵PID:2368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4636 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:82⤵PID:728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5368 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:82⤵PID:3144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:82⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3680 --field-trial-handle=1800,i,7033887899808636734,6603241503354168077,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1152
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2708
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x338 0x3941⤵
- Suspicious use of AdjustPrivilegeToken
PID:1548
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
MD528ca7ced579a7ce289edefef6dff6ea7
SHA171129493c393d52b64ca295acbf2c49c99c2046f
SHA25607c27818c66d88e023b762afda1cc28b7fd422cc5456c788c22ad19c1157f522
SHA512b4c22108ceb20d20eaa86bee3fecc9fe6acc164ed483b83e257a8c3437a0bc27a067473472d84b5af919bf199990f60f2672c2cb213d7cad5fa0aabe61d4e513
-
Filesize
1024KB
MD581d04c9cd641b5c6a44c9e9307e91ac1
SHA1207af3d0259791921322c2bc7214285e70acec2d
SHA2569dc914f778fc202f87cea7e8de3c153771586eadd67e30dba8471b2d9416f736
SHA512a57c915b5022a0e28ebdcaa9fb6700047911dbb822ea35cfac4e56e8138ef7de6c3d61925fc54f868eba9117047427812cc7af0b934cac2829d3ac5da8b85c5b
-
Filesize
1KB
MD51e3c956ecd90f28706640c0ba0d28d9f
SHA1a7e0307a564db42b4f16189fb7331787218dff15
SHA256a77ead18742b91e89879fc1fc65829a79f685969ff8f061e10c5f7b98037c169
SHA512891fe71c71e33970407db4df67bbe9af13e735f9ffdf3f3d61dd171ec7e24d1d59664fea222be3d80e9ac11efe128b766e4b17e8e3e30129bac404881812e449
-
Filesize
694B
MD5585fb7f5360fa487b6e6334c984c5dbb
SHA115957f8d1b08ba4fa733e584cceb4ffcdfacc983
SHA2562c34a2e785f6919b3432fedda2a0087c6fd581cceee99dbaa7b974c889538245
SHA512c3acd7ec7e29d6d9f84e88c45aba46ea94a1ce354f60e0ed3d9d3a73431bac4fb0688bb0e03cbafb2f1f85e2cf2f3070f78466e590c760fd9ab83042f54f3acf
-
Filesize
538B
MD5a65a9975e2eb04dc557fd6cfab847d76
SHA159212442e858a88757362023963fa80115b81dd1
SHA2560fde27644d580702d918585d16f7560e592838260ee9615ec504781d48639f41
SHA512e0c28e70e99c880ecbd7608ab6270ce1094b505d32ab2139b559968aad56d50b2d7453bbee0c6cbc674ce2bf4fb9264c50af1fa5687a302915c244c12cb774f4
-
Filesize
5KB
MD5c5131309f6c21b2acdc8a14c78380713
SHA16d5e3f9089a332143f789d3e4ec504cdd60d453c
SHA2560e4daff46febda76fb118c21e5526355c05ae6692b6b7e7d370a9d5aeb7e83cc
SHA512b0970ee52c966e8f5a63f2f170f829348768bd4a3c2a948690bd762db1b74e375b87beda751b86f3b3fa1e4f4b6ad2b4f851630b22cb254a036ec2313c7c8298
-
Filesize
6KB
MD5c952c0b2fe979789586c5d6cdc953959
SHA199f89e05926b3685540838232e7c1306b411bc0e
SHA256d69f13528830c0bb92c06de3e39039503dc2a21836b7ecbb800a383a80af192b
SHA512239158ddfa512939c2d4a4dcaf5d697d8267d5c835ab36919895f9ce169ff123802b0f370f33887fbd062fa86824cdb96f9abfa211622548214ccdb232efd4cb
-
Filesize
5KB
MD54ccd1bde8d1719e18c0e7655a7c96ab2
SHA1f406e589004c9504aaf19d500f1f1ac93251b9da
SHA25611666d8c6a7bd69f0f06eb7155ef54e9eb62b410f915a404f818cf8e1d70deca
SHA5124037443712e7b56e5a99241eb475331b23d25cbe3570bc061c5cf3304fb68857823aaa55ef0a313b5d5a1d346f34f24332127eb79f0f51030ab9c89b35b5f7b8
-
Filesize
148KB
MD5920842f25f2bdcdeb7106182f7dca2f8
SHA1c847dba3346e03296ba3a7b8f487cc3a6ed18f52
SHA256b0c040c34a0477f27b757c9558190304cc77c8534e31c55a323287ac6122e8c1
SHA512280d8d9046e07449fd158bbbd34d76b9e8874e50049a1f50d299676c8e8867caa3686f2a8a5113c186a797b4f2f55d578f1817bfedd21e7c1c7f0fc98736aa58
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd