Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
201s -
max time network
195s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
22/05/2023, 19:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://rb.gy/u87k5
Resource
win10v2004-20230220-en
General
-
Target
https://rb.gy/u87k5
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133292660447138472" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1528 chrome.exe 1528 chrome.exe 4804 chrome.exe 4804 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe Token: SeShutdownPrivilege 1528 chrome.exe Token: SeCreatePagefilePrivilege 1528 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe 1528 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1528 wrote to memory of 1300 1528 chrome.exe 83 PID 1528 wrote to memory of 1300 1528 chrome.exe 83 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1884 1528 chrome.exe 84 PID 1528 wrote to memory of 1620 1528 chrome.exe 85 PID 1528 wrote to memory of 1620 1528 chrome.exe 85 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86 PID 1528 wrote to memory of 5032 1528 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://rb.gy/u87k51⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdec4f9758,0x7ffdec4f9768,0x7ffdec4f97782⤵PID:1300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1804,i,8042024199983314829,1665602699520774872,131072 /prefetch:22⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1804,i,8042024199983314829,1665602699520774872,131072 /prefetch:82⤵PID:1620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1804,i,8042024199983314829,1665602699520774872,131072 /prefetch:82⤵PID:5032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3136 --field-trial-handle=1804,i,8042024199983314829,1665602699520774872,131072 /prefetch:12⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1804,i,8042024199983314829,1665602699520774872,131072 /prefetch:12⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4724 --field-trial-handle=1804,i,8042024199983314829,1665602699520774872,131072 /prefetch:12⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 --field-trial-handle=1804,i,8042024199983314829,1665602699520774872,131072 /prefetch:82⤵PID:960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5300 --field-trial-handle=1804,i,8042024199983314829,1665602699520774872,131072 /prefetch:82⤵PID:2032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1804,i,8042024199983314829,1665602699520774872,131072 /prefetch:82⤵PID:4212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=848 --field-trial-handle=1804,i,8042024199983314829,1665602699520774872,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4804
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1512
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\847e05e1-8c5a-43fd-bb90-a2f886686b5e.tmp
Filesize6KB
MD5a108e2e864d8d11b3213935ddcb6cdac
SHA1a911b6c8730b9bc1dc023b103a4d43d8813da6fb
SHA25695d496d6622dad5496c813bbf4590a15b8a0eb19a8875084fa0116985984d8c1
SHA5125dc836495610bbbeb5634badabec8ee15664364275d2f6cf23dd271801efe2978574a434c67d4b1a004d5a69fb033a6dfd8206c626565b2e08135a63fad57ec8
-
Filesize
72B
MD546fa0dd081690ceed302f3350f59a781
SHA1ed80a9bf8166b656be8ddb240daf2f1da2b1e61f
SHA2566f879cc63f301e9299a3b6e28a64a400751cef8cc2540d017fbfb6eb21df798f
SHA512b1990698366504ff8a86494c5c8527d23ed9f165562696c78d9eba7ad39292ebe728168fcab1f5de53b48823ac41184a9696d5441e16d2ddb996f1ff133ef2a6
-
Filesize
1KB
MD5bb5f89b997ac47bc7d08f8c1a4c8b44c
SHA1b8416a5d7d6907d70372f453f6854b227bcb0baf
SHA25669a96e5a7bcd932b18c8650e92ec53dd6a69fdfaa26f1fe8f7cd08723d44f458
SHA512ee37e055ac881fbfa5f40e49b79791f8471b3642cde744b20bea9346c4fe47019fc8b7eca8e6574d4dec15702f54dea473221ab87105b79a9d9aeeb36e957f53
-
Filesize
1KB
MD5da974c874fe60cd0385cbed41c907dfe
SHA1e1cb57a30a1439ab3a124d2421f20a58ce4e90bd
SHA256789a9b190f61e1669bd2d7718de5f67a7160506c6c6971ed8b5644fd3031b372
SHA512c7f9bf5a7e736bda164918f4c60d1c833a6787855b07170cbef887bf0bc7e5b38575aa841341072666b6eee1b5a91299f456e82280a2dfdb1de99f25cbf2fc84
-
Filesize
706B
MD5af568795be097254145be5f27821e46c
SHA119150151018d1cb30d773ac2f82f243481d93c85
SHA25615e143360de5599302714ac5792a74064e7b9db458fb4917d0eb044ed8961d12
SHA512a4cb90f3abf0d7333ed5c3237b0543266d751340416ead024e9ce8cde63084927932b0c2003e6075e15e899b0b0a45b638c8b812354f01a9c991043d4ed9498a
-
Filesize
6KB
MD5b6a4dcdc9cdf5108e97b428c23f18066
SHA10ad4d10c74d5a97ebbb5cfbdfba9824eb8e4c10b
SHA256bf66419e313a60f337e2f32c65392a52a893c4c773433cc9dec3c1dbed35e18b
SHA51248187806b208e5cc93d9627a8280315990ad3cf60e9417d0fdcc00f6cf116177d8d93c0a58d25b543baf0d40d2e2e07013e57e107a81ce79a468d0758e36a8fd
-
Filesize
6KB
MD5ff79a825c616615266cb09b128a2d51b
SHA1c5a77efa2f357b6f24b8b61f58311e553bdf2520
SHA256c1d1a8adefa1459a5f70911cefa6e5d6180fbd6d6421ca2c5c76336ccdf845ca
SHA51250092453efeeef8d10314826f3c288671ace7d6c28b48bea81556bc110507d7769e5ce768369ae4687ce1dbc5d02ba9929130616a2b4b2e581f746fa188803af
-
Filesize
15KB
MD5b96e914fecf2eeb1fa7e0896a075f535
SHA1f24dbed6236d48e768bb437cefa474dc442f6b12
SHA25618ba7a985b193b394b8265cede74a025116b21313dd97cbf9e7ecdf6f1a3beac
SHA51242b6780ebe4f5d797753b04d9597aa0a826a6add73e36da8ccd0f35bc3587afc80f8a54f1f3e535b5093b9eebdcc568d8b7ea7836bd59cc5b33fd6a86e19bfd1
-
Filesize
151KB
MD5b36fdd582730592b4baf9e0fa68f3ccf
SHA16cf51b8791b8231e34e5802007c525e0210ff5f1
SHA256cc20dbd950ef94da08d0a63b607f0e9eb6f57664ae1711d082f3f3e732bef0b6
SHA5121255b51b5a01013514f5793d586b472b6f355b5834de1c00af36fe15fabd59519c7cae9414191ee63c251c11a6cc6403c0bf9ba78d122c3af46b30f7b456fd46
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd