Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1200s -
max time network
1195s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2023, 11:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://maxstream.video/videostream/5zpo0zvmezzg/593j4aq3nnv7/cWhaeGpqZWh0Sk1waVhlMVZGQmNLUT09
Resource
win10v2004-20230220-en
General
-
Target
https://maxstream.video/videostream/5zpo0zvmezzg/593j4aq3nnv7/cWhaeGpqZWh0Sk1waVhlMVZGQmNLUT09
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133288831698126730" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2248 chrome.exe 2248 chrome.exe 4888 chrome.exe 4888 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2248 chrome.exe 2248 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe Token: SeShutdownPrivilege 2248 chrome.exe Token: SeCreatePagefilePrivilege 2248 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe 2248 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2148 2248 chrome.exe 86 PID 2248 wrote to memory of 2148 2248 chrome.exe 86 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 3120 2248 chrome.exe 87 PID 2248 wrote to memory of 4804 2248 chrome.exe 88 PID 2248 wrote to memory of 4804 2248 chrome.exe 88 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89 PID 2248 wrote to memory of 3264 2248 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://maxstream.video/videostream/5zpo0zvmezzg/593j4aq3nnv7/cWhaeGpqZWh0Sk1waVhlMVZGQmNLUT091⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe06cd9758,0x7ffe06cd9768,0x7ffe06cd97782⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1816,i,6150407591157827372,7207021784243163239,131072 /prefetch:22⤵PID:3120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1816,i,6150407591157827372,7207021784243163239,131072 /prefetch:82⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1816,i,6150407591157827372,7207021784243163239,131072 /prefetch:82⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1816,i,6150407591157827372,7207021784243163239,131072 /prefetch:12⤵PID:868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3172 --field-trial-handle=1816,i,6150407591157827372,7207021784243163239,131072 /prefetch:12⤵PID:4108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1816,i,6150407591157827372,7207021784243163239,131072 /prefetch:82⤵PID:1128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1816,i,6150407591157827372,7207021784243163239,131072 /prefetch:82⤵PID:4760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2336 --field-trial-handle=1816,i,6150407591157827372,7207021784243163239,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4888
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3460
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD5f9539d558bd3a8013f00ff55175083ab
SHA14c8fcc5e826cd07a31fc88a0d1e11713d1f3e1f9
SHA2562ba737ab6944673939bdd66030b5c0ae625ede138c0e9cc541cdd6135640f485
SHA512d007fcb79e82819c30333245d96cd7ee087423a043c8553b256b4dbdb669f69111a5746c23d9fc6c2dc94110b162f34003881ddb323a26e18a325907400e7fe6
-
Filesize
1KB
MD51f79fda10ad02fde1ecf0209620b8643
SHA1c60c028a7fa4be622c19497a4646b81c110c7144
SHA256c70a69c376efdf2d7403589ec13f7a955263dcec79db2ff2f451fe42bfb8166d
SHA512561f26b57ecd1cf746941fafb9b978cc7f851b72788b5641b60ad872060b700430eeeebf31fdcbda2f09164d779fa5e0c989ced5bcb877f59ffb88f17ef92492
-
Filesize
1KB
MD52eb94f916bcb4b28d534feff23decbc3
SHA155eb1189826b97b9075a199e308352db7d9464ed
SHA2560081ed9a305efaa520c56b1665fdb0da064d2dda62145ea8db45811a0238918d
SHA51259cea00d8fa925689adbee75cc5a7c0301494ccd89c140fa7f7ab47ef9b1c14ee087c7269b39d71b2eadb8ab7c46c5cef525a9f955d7020a3f02fe90d4ec4d58
-
Filesize
1KB
MD557e54d78933b9a87e149fe7726e2781b
SHA186e33c5775089c216d5fc6c4eb2274f8c8263f3f
SHA2562098c9badc0084aacabfc8bc8d46e7f3b99a108dfe7ff598988188aa68eeb0af
SHA512d42a2871e3f385c1614c482892edd523431c9c1dbd82b669f5b4de08ed7b0fca604f7c54851a836a7ec18422c4067589c8e6204833e5c43ab32cc524d2fb7ead
-
Filesize
1KB
MD5eba213bcc584167e48e6bd07b8ce6021
SHA1dba6481bfb9972ed2837db72a00ed312e497e264
SHA256b23c447736cd78483312582b4ca6545cd30b2de82ba787b3c4a98eab3194aa96
SHA5120affee0f7cae6bd35506dddbfc94c6c83d71ce3956fb5c04e51564cde74a8da05d616336ab91290ddfc89c333d3d901b1db2de93e45a8ce328592638a43814ea
-
Filesize
538B
MD5286c76cb75d3d3c7c3ae81dad496fd87
SHA133bd20ea6ef8334ad55ff8f71556faea46a0e2d8
SHA2563a1ad26b9be13962035e1cde18a7456c27f2fa1a56a417faaaca00e636dacdb7
SHA51212bafa3b2a5df64287e507cf90b61a342c36166e2b64de28d68ea98e4636ad523bd5482c562e3131ad8d83a363b02e17433ad4775e89f316ea36962072a21209
-
Filesize
6KB
MD51cd239e5cf03f4466eca5da59dc9f154
SHA1505996c13690abd6d53d193284dd01715dfcdaad
SHA2560b3bc1221f6483cd62c22cc06cd89c066ff48837e1400518f343f63fc42be829
SHA51215580bd0c98f0da0c998ba442f39789f2c4dbd1136e76b4dffe486c5bab123ad3407a5d5abc34a704c8da6ca2635d73a825d25ddc5085b1e50c6eaabc4e10150
-
Filesize
5KB
MD5e5b7dc44805b418574a27c7498d9583e
SHA1b60b67d5c844d0d6e2b4e288ca3e9ed92ea28935
SHA256bf1772e38a673372d432ae0d9419eaf1d33a02a9585426e432341b09351c33b0
SHA5124ef96ec9c698f1acc31328320e98ae2a5dd1e4f5ec429f262e6fe3c8ad95ab9ab8ded5b572de41e255199b0e3f7590e5ca24dd93059adb755c9f033320dc8a91
-
Filesize
5KB
MD50b4272bd6538198186683a786112ac70
SHA1573218d76e9628fe0647e19a91bd04f40e5ba3a5
SHA25683a43b3a46ed092f05646d4314f3fb5af34e37c16a8edfb1109ad4c90d20c874
SHA51272c1910cbff271a22651b881bd730e66b362a52a5560020ffca7fecc7a6fe6a4b1102da4b6aebb2128e67b4eaeb76da08189f7b679de30db0bc60bda419442d1
-
Filesize
151KB
MD5b80189a71a692d6d1bbe4c4b9394f4f0
SHA10ad6a3074c26544342affd4fdad7a729ec5f3328
SHA2569e917654587cb4c17cb0bbefc268be640a118e8185584384fd763f334c7e03d4
SHA512276f26a8d9caf30b6c6b0c64f303b3bb2cca51c5780e5b2b512417b6568e826bb1e8e2fa681de92cda09611e38d04842e6f623a7ed3505d60b134a472fc94620
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd