Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
29s -
max time network
28s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2023, 05:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ncv.microsoft.com/fjq5iwXikw
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://ncv.microsoft.com/fjq5iwXikw
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133282655494599860" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3584 chrome.exe 3584 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe Token: SeShutdownPrivilege 3584 chrome.exe Token: SeCreatePagefilePrivilege 3584 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe 3584 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3584 wrote to memory of 3536 3584 chrome.exe 85 PID 3584 wrote to memory of 3536 3584 chrome.exe 85 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 4860 3584 chrome.exe 86 PID 3584 wrote to memory of 1216 3584 chrome.exe 87 PID 3584 wrote to memory of 1216 3584 chrome.exe 87 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88 PID 3584 wrote to memory of 2112 3584 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://ncv.microsoft.com/fjq5iwXikw1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3584 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff99adc9758,0x7ff99adc9768,0x7ff99adc97782⤵PID:3536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1812,i,13202220064419427619,12583949076414772242,131072 /prefetch:22⤵PID:4860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1812,i,13202220064419427619,12583949076414772242,131072 /prefetch:82⤵PID:1216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1812,i,13202220064419427619,12583949076414772242,131072 /prefetch:82⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1812,i,13202220064419427619,12583949076414772242,131072 /prefetch:12⤵PID:3944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1812,i,13202220064419427619,12583949076414772242,131072 /prefetch:12⤵PID:2248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4472 --field-trial-handle=1812,i,13202220064419427619,12583949076414772242,131072 /prefetch:12⤵PID:3180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1812,i,13202220064419427619,12583949076414772242,131072 /prefetch:82⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1812,i,13202220064419427619,12583949076414772242,131072 /prefetch:82⤵PID:2668
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1372
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
706B
MD502336f55996e666cc6f3485f8b0d2ef4
SHA1056ed5c33c2146d49cfb607f5bef0ba51e0706d5
SHA2568f80220e04c5e304196edaeb9183dded3216ebfa42cc1fa91ef035d057cf72ea
SHA512a7371450208675dddbe7558ce3939b279bda58edfe6e19dfb450bec46431e8b31fd20e9121c6761133af3b656cecced173e625af17dd52ed3f0016aab0fa9dce
-
Filesize
4KB
MD57cb7f2b614ffc6611dec35a31201512e
SHA13fcf836484b574bafa7ab355fef5840dde3875f2
SHA2561a3da1937cac4bed842fad251acb17c106e54a9b78d2f91ed80a513f67c98014
SHA51203bdb7fc62ae2df847d43e48266bdc9d6f8ce297eeb6f5366704ec63c59e75aa3773487a653465df34ac1f250a6ae409cbd49d569b8cba05c54c4468644893e3
-
Filesize
149KB
MD5f0a46a5673b923781f5de301d15f48a5
SHA1981f0731f39ec2cae4137adf2c8d9a24fac52e73
SHA25638ef1c7679770c4fbf1e8764e742cb407d9ecf09c68256c1dd32705b04b8ff6c
SHA5124f780860205a448ae0ecc485445075e273fcbc4a7388f92e5cfce3334e5a2b9a9210e6ccdc5b14c044b03a576f828d0618bda1b0421c8a2b2319e97405b83dc2