Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
96s -
max time network
96s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
08/05/2023, 10:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://w9cNHMipGj.antui.fr?Z294b3BhdDQ4MEBqb2JicmV0dC5jb20=
Resource
win10-20230220-en
General
-
Target
http://w9cNHMipGj.antui.fr?Z294b3BhdDQ4MEBqb2JicmV0dC5jb20=
Malware Config
Signatures
-
Detected microsoft outlook phishing page
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133280158256481221" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2396 chrome.exe 2396 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2452 2396 chrome.exe 66 PID 2396 wrote to memory of 2452 2396 chrome.exe 66 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4488 2396 chrome.exe 69 PID 2396 wrote to memory of 4472 2396 chrome.exe 68 PID 2396 wrote to memory of 4472 2396 chrome.exe 68 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70 PID 2396 wrote to memory of 3224 2396 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://w9cNHMipGj.antui.fr?Z294b3BhdDQ4MEBqb2JicmV0dC5jb20=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc949c9758,0x7ffc949c9768,0x7ffc949c97782⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:82⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:22⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2120 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:82⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2740 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:12⤵PID:1108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2732 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:12⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4484 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:12⤵PID:3056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4336 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:12⤵PID:3068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:82⤵PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5468 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:82⤵PID:4780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4032 --field-trial-handle=1828,i,7236730470869326082,15104076436442666910,131072 /prefetch:82⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1348
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
717B
MD5cef25bf9f0c02e7454ecdb072ffd8bd2
SHA17a478ec99edced095595212410e5ed187ea2c6a2
SHA2566d356c6ffa836796d3481a457601c7b2ec8223df840c3ff29b54de0408c1a952
SHA512ea7eb24dad689a5d6416cee255fa99e1538e48d2e65cfead9461d94e239926d5b99d3ffeae45ddb7137fd40b7db9a2f2b6f8cecbf8a522ba97cfab85fc651703
-
Filesize
538B
MD57c7e106a1e314e82015ed4bf372017b1
SHA116330521966022d76e5686c4e24a2c1c042c786f
SHA256386407df2ba0a4934e17fee605169186c4003ee55ab3963445475012b9789e62
SHA512e65df82d1376cbc2c55eb1937be8d17b16560f838f3477a36b16b85422b24acb85b5c5083129231bb55d7928b0f7cd3315b8679b658e14f81ce554fb1ab9ec6f
-
Filesize
1KB
MD51dbb3410c6aee60bb91f6a5bcf68cad6
SHA1b72223588ed7bb41a27a162fd69281b6a79ec12f
SHA256ac8504f4da4749237466d44ead4529bb6450c65321b7f5f59f6189756ef7fa99
SHA5126402db16a8465e7e5bb28832cf3f1bd10e391d4d6ead453895b00db2cd404e2b1adc483cf9e2c2f58d5f22e26fc4dbf0427283c6819078271e7f22cdc3949506
-
Filesize
1KB
MD590b4e14f8c05cad3cc70c5fc0ba31ad2
SHA114128fdd2a922762da2e27bdaaf95f08633f36cd
SHA2562b8c008c78e17fe16672ac8facff38863ba9d996c914ec32e1e75df72d3ad802
SHA5127f4f5346183b49bf7ba92e06298d906e9e300b240ae6f27007599e247af53ac7520a3099dcf346d38c95c5a53045757d5c644ac625c9d4a81415f31d07e58371
-
Filesize
5KB
MD53b7a7c2fb0e5cf82ee739854fd68b782
SHA1be587876a959f7010795e19ada7cbb0a98d2c2ab
SHA25665edbbe58f7568b2469734c4b06c4df1e590c533e0e58215e87896ab98e11540
SHA512a8e0aa8e96975b9ce606f31ab797a988e700630d054bc7c52e271838b36ef44d23e43f1ff4a814d5ed143e36428be69571c86926974ebc859f8b8f25cdaf0b2e
-
Filesize
6KB
MD53c84edaadd5e7ce73051f42dab86c259
SHA1cfac8471920c605b5ad585d15e2a507f021d3121
SHA256cddc646fdc47e24f93c17a74831356aa0485d79208e47e01cfa0dc9d0a548e22
SHA512f25d0a6aa82deb84b23ee9b1240515d3d49b44e3579fcb60445d6599994572d65bb686230d89930906da2b6760cc8b5327c9a456a67d7ac66e5aec2081372524
-
Filesize
149KB
MD50888789b74bd625ef1d5c0c3c782b542
SHA1bba0c6a6e3f3666a14963ea2f32a3f7b897e8046
SHA256db4577decb26aca5a160853a2661b095320914fed3516160d5d4c9accb93f7a1
SHA512c0d41e5e77daf54e1a881605a76cf73792d5882ee61d4c3ab4119904d182322ffdf2b4a4f397247d336319eb47be602ef534076e3ae2dde9a21acd391def2868
-
Filesize
99KB
MD507a8d0e0f187bdbe280df066356d706d
SHA157f711fac4e4c3c48a218ed7c59af408c253d930
SHA256e130e1f97a814301f4c469f20ab65b1f66f18343a23b7037c122fff8778a3696
SHA51216815bc563025044734ec52c9fc31856108ad5d98cffd1b91ce338697a4f5ee3034c54ce197df31cd68293da10a0323dcd8468fabdd17945e0fb5912b622453a
-
Filesize
98KB
MD5ca987830b4d0230952d5e83eb06755b5
SHA1db788df47dee4e08344cab5bb8d98d0adbf2995c
SHA2561f1b155335efb122c56caaed47a54419abfe18fde5ce0903b0a8f03aea93ecde
SHA5127d9b0c874462a92c198e7653978083188cbda44524a4b9140316e1d9fd4b5d8ae7b0afcac9fa59d34c70097b25706a44c53d5b2eac4f09841686c23afb62e04a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd