Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18/05/2023, 20:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.apprecords.com
Resource
win10v2004-20230220-en
General
-
Target
https://www.apprecords.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133289244087142902" chrome.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 3200 chrome.exe 3200 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe Token: SeShutdownPrivilege 4112 chrome.exe Token: SeCreatePagefilePrivilege 4112 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe 4112 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4112 wrote to memory of 4964 4112 chrome.exe 84 PID 4112 wrote to memory of 4964 4112 chrome.exe 84 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 4296 4112 chrome.exe 85 PID 4112 wrote to memory of 2768 4112 chrome.exe 86 PID 4112 wrote to memory of 2768 4112 chrome.exe 86 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87 PID 4112 wrote to memory of 2304 4112 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.apprecords.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4112 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9faf9758,0x7ffb9faf9768,0x7ffb9faf97782⤵PID:4964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:22⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:82⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:82⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3168 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:12⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3176 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:12⤵PID:452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3908 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:12⤵PID:1928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3352 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:12⤵PID:2364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:82⤵PID:2492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4912 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:82⤵PID:5056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:82⤵PID:1428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5016 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:12⤵PID:2832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=836 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:12⤵PID:1448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1032 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:12⤵PID:3228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5008 --field-trial-handle=1828,i,7185823559411449270,266945282360886969,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3200
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4104
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
882B
MD516de354e777b7c04a71ce1e038016797
SHA1b2ccc13ba67ce865e2860556c3b31fc6af7c76db
SHA2566bf36cc204c4f0133696fb586edc51e41c92ec975cc9dbdb39cb4da3749af4d0
SHA5122690f36f2f8653d7c5b8205430c83403eab6b8c7b142b298ca53ed71e7c4d3b3d49059903ce947ab60a6b9365396cf762afb868b1d7ef55c3646c697975fd7c7
-
Filesize
6KB
MD518496be19a6826d652cc8cded829cb72
SHA16d151931975ae14ca430f6d94d9c525b878dbbf6
SHA256af5b8958dea5add0aa37bf22fe5bb04d249f7a9626549550127876c977c572dd
SHA512bddb7b399f0f9c4e9b770351f3ebebe9741ce2715bba0785c5a7ca9349e3dd852e5028851fa2d37321ab7c5d3e838deb8f4f7c22fcf23b964d2d08aae70c353a
-
Filesize
6KB
MD5fa07f8583ba062c405521d8ee2514a32
SHA182a774ffc81a04a6b9feff68d31b9b911ca89782
SHA2569ec6f6e0b09d790cb38f9d387932e738098d36fc141275a6dd881fc81e97580c
SHA5129d6ce8a04643ca2332b140329d97246db98d140cdbb8fb9bac30f10cec7b15bd7e4810cc2bf2f35d449425cdbf4188ddc54e222fac0275abc139cd7aa1abf4a6
-
Filesize
15KB
MD5b096e492538dd6eda8b1d8c8383bdece
SHA11c37b5d974f22824a4975fc3ed73276f1848bfe5
SHA256247e5759d01c093b4290fae0f2f616b9f4d36a47c30a263be41bac5cc387a399
SHA512e80bf80132f563bf0dc1e7e5a816665d5e82a0c99889767a1091280553dac825e1f2af9392816ee22fa63ce7c7ddd97c5811229e6fa60a2289f5b7bd12002503
-
Filesize
151KB
MD52993abb97291863bac196a5fb48042c9
SHA19c31766dd05e08680e611bc7d3fa9a1cb964a99a
SHA2568a1efa650db459996a13fdb56561a344b4f580927604f35e7bcf8a0230b2eb27
SHA512b137be51dd65f1b2c687ae1cf1e738d2217d6d87e1632b94aa1e138721ead6183b159e62d71c3d1f20c2038ac7fd7224a092bfd71724dacb612a3093d82fedb5
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd