Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
19s -
max time network
22s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28/05/2023, 11:37
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://is.gd/DKP0stalsp
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://is.gd/DKP0stalsp
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133297474641340187" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 432 chrome.exe 432 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe -
Suspicious use of AdjustPrivilegeToken 32 IoCs
description pid Process Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe Token: SeShutdownPrivilege 432 chrome.exe Token: SeCreatePagefilePrivilege 432 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe 432 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 432 wrote to memory of 1428 432 chrome.exe 84 PID 432 wrote to memory of 1428 432 chrome.exe 84 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 1468 432 chrome.exe 85 PID 432 wrote to memory of 3944 432 chrome.exe 86 PID 432 wrote to memory of 3944 432 chrome.exe 86 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87 PID 432 wrote to memory of 220 432 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://is.gd/DKP0stalsp1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff865aa9758,0x7ff865aa9768,0x7ff865aa97782⤵PID:1428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 --field-trial-handle=1796,i,8550165260174298485,11342200430190921196,131072 /prefetch:22⤵PID:1468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1796,i,8550165260174298485,11342200430190921196,131072 /prefetch:82⤵PID:3944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1796,i,8550165260174298485,11342200430190921196,131072 /prefetch:82⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1796,i,8550165260174298485,11342200430190921196,131072 /prefetch:12⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3200 --field-trial-handle=1796,i,8550165260174298485,11342200430190921196,131072 /prefetch:12⤵PID:2056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4572 --field-trial-handle=1796,i,8550165260174298485,11342200430190921196,131072 /prefetch:12⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3508 --field-trial-handle=1796,i,8550165260174298485,11342200430190921196,131072 /prefetch:12⤵PID:3620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3824 --field-trial-handle=1796,i,8550165260174298485,11342200430190921196,131072 /prefetch:82⤵PID:4044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3968 --field-trial-handle=1796,i,8550165260174298485,11342200430190921196,131072 /prefetch:82⤵PID:1048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3932 --field-trial-handle=1796,i,8550165260174298485,11342200430190921196,131072 /prefetch:12⤵PID:4100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4660 --field-trial-handle=1796,i,8550165260174298485,11342200430190921196,131072 /prefetch:12⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2624
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5bcbe23c2b3f234b775795ed9d5453513
SHA183a18d330c7441c89b9578c862d486ffda0fc56d
SHA256cf91fbe633a13e6a782da5214d89b3f0ef85065432c0775850f061c4ddddb072
SHA512ee84755cc0f22579e6b0a6aba6a30d7681a9794914bf704eba5dfe1f89952f89151a069e04d4dd2dffaa89b166dedbf1126fcf6c34a060f3e8c9e39c5a9d0e17
-
Filesize
153KB
MD5a4d6d4abc9d7844d9da0addcf7eff5ed
SHA19a9fed013f54ed2300313aa6391610e60a0cc481
SHA25617b86a1cfb92b2a62443a399ac818c3c2555602d4464ce86cacb21d556a88c4f
SHA512e2d25ee99c1134cc4b02db6d6a87a374cf21d8ae1593412d8d55534c1e7f75cc0033ddfa91083a06f5be411f5a78811daa8ee576eda4e07250c38de102699723
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd