Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
16/05/2023, 18:29
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/[email protected]
Resource
win10v2004-20230220-en
General
-
Target
https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133287425607268638" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1080 chrome.exe 1080 chrome.exe 3948 chrome.exe 3948 chrome.exe -
Suspicious behavior: LoadsDriver 3 IoCs
pid Process 672 Process not Found 672 Process not Found 672 Process not Found -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe Token: SeShutdownPrivilege 1080 chrome.exe Token: SeCreatePagefilePrivilege 1080 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe 1080 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1080 wrote to memory of 2948 1080 chrome.exe 84 PID 1080 wrote to memory of 2948 1080 chrome.exe 84 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 652 1080 chrome.exe 85 PID 1080 wrote to memory of 4196 1080 chrome.exe 86 PID 1080 wrote to memory of 4196 1080 chrome.exe 86 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87 PID 1080 wrote to memory of 4784 1080 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://a9328f77.33023cc9ae08612ab75b308f.workers.dev/[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffacf3c9758,0x7ffacf3c9768,0x7ffacf3c97782⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1804 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:22⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:82⤵PID:4196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2164 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:82⤵PID:4784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:12⤵PID:4836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3160 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:12⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4484 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:12⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:82⤵PID:3948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:82⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4416 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:82⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2700 --field-trial-handle=1820,i,4638941384510509363,13484020223425940007,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3948
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4580
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD51aa7380b2f4d2ec4dc4d3c1ab7abed13
SHA17c0e24c5113b80a168b123c3a832b61b58040892
SHA25621dbe00cd4d3a6d0bc7991d26366d8027952b970e03ec72d6caeaa8f00856371
SHA512bd925b01d141dfd0ab2717db850661fd59e4e3ac1ea817f44f9f8979beaeb8e3bf53c43b0d3373de258752ea9bef6c527f37ec7d206549060a9e9a6ccfb92f86
-
Filesize
2KB
MD5c203374894ddb2d57287f3383bf96700
SHA19069ce854ec05ead1b6dd53499c2dd44520314df
SHA256449dec352fd4ddcf990ce747d69afd70750f5b1420d322c68ad0d98747c3d04f
SHA512b1e1a7b81340c4e62830b6f5a73c2cdafed848d5a9dadfc74b6b705dc2e2863959d24235ed3a70a810ba23af70358238032082f0d41814125afc4185d4eb1caf
-
Filesize
1KB
MD5d51a2881e100e6cb7f4d05df216fd6c5
SHA14e14078beb4dc8fa14ab201fd743662a12b242fe
SHA256e4155b9c4ac10237440798911849c2d5c98d24de511db1ca0d014c3e93086b54
SHA5121d377fbd0340266846111b585935e970fc057640617f0b7a6ff81607d23ba1bc571c234358e39a52a360bac371f701c12e50bc2d3ab64803eec29bbc9ea66167
-
Filesize
1KB
MD5a2c759e46a35aacd46dfb3ef3b49d3f5
SHA1d3cfc0dad91fa9438484175951c558c0ba3d4689
SHA25662c29e9cca2502970771a420c723e5e6c200068f01e3c02535e7d6ec212a568a
SHA512dc73e383c7e6cf6cb9d2eefc304e96719010b2d99e83366d4b807d4f82745eea3d2b8f4a5ea675ac1ce2d5480ce4f0085a5e003637f1d52cec03aeb8499a9fd8
-
Filesize
4KB
MD5c213b148052c3792aa2e288b8da6268c
SHA128f4ab320aeba2d14bf9853494d69a4e6ce25abc
SHA25686552b6baa94cbbea30dbeda5492505846af155535eba282b5b4ab7e1b59380c
SHA51205106ee3ec3b1126e43cb6884f2545b3ce7a3b4a0e942755b0aadf68fbd289b16c694e10a75b438223c227c1b00546fe02e5308fbc10532b6760d7f89b6bfbcd
-
Filesize
4KB
MD5add3a29ccd6b62efe34b7bd2a3bdd7ab
SHA1e317b3a38f315210ed314fa79fa660186874e9af
SHA256177321796db0c213cf5e58fdde28149d1d4c89b8dbee6876399dabbccb43fae6
SHA512356251a31f03bb8f9975d9c59a8e6e463a9b1387b684a81115c453b87a7785d04de289ecc585b3095eb0913bb85ce2305fe1505fa7a5c306611d1dfc3bafaa64
-
Filesize
4KB
MD5b47f18ceec54fba68203044134881c28
SHA19fd0a6ce63b0fde5553c79ee5779bb79bd6c5226
SHA256ca10e91e6705ee80dcb71dccea79f85feec83dd7c68d63200faeb2f34fa7edea
SHA5124b90cc657293989e84847a1587e816c1c62d1f5b1ce5a0a12fb383c0947e4e44dfdd648355b7f8bc57038127340fb763efa8049e0096d0544da8b625c42c48cb
-
Filesize
150KB
MD5db5fad806651495785b6b3a4618fad4a
SHA15a814cba6a0053609bff4d3e8652d169045db9fd
SHA256f1b0974117cb59a04a36633de134006545ad13d774621b84de045c7e86b58427
SHA51218426270a3d82c99d0a919c506304eb39171627801ba1967644c14f6e1ea6ee8ae67563f3cb33d99a3b3d970c4f5606683dacbdb0a869c075d0634149feddbbf
-
Filesize
103KB
MD5d715cb78b7743c408b6d74ccb82e2792
SHA16be7cde22fa45668c8e1c1bebd19f313c605c854
SHA2564018aab4e8e83351add50221e7e00b40123cf349a03433377dabe79b48137ed0
SHA5126dc5ec8eef0b8f09fd7468b13e33f228163ef005d512eae55a4fb95d24428fd33cc3eaeb43b94ccad4f2fedee07be3ac4daa14b860d975d9b221be274cf8a26e
-
Filesize
99KB
MD5117f4c6eadaae6d2691491fe65432a31
SHA1a337d1c934004c851c7e8b9c7d6de7889383b15e
SHA2566ebed8672c6ae9e78601c679d14ab24667fc9366b7113e5d134d0ceada3455fd
SHA512d28187cdc07fc615fca4119c4b4b2adb5999afd64c0cae477f4818c1271229a262dff62b08e15480a48e30ed09ed98fe3a25ae45cf71ca9a3a535316eb1fe5dc