Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
276s -
platform
windows10-1703_x64 -
resource
win10-20230220-en -
resource tags
arch:x64arch:x86image:win10-20230220-enlocale:en-usos:windows10-1703-x64system -
submitted
04/06/2023, 00:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://apiservices.krxd.net/click_tracker/track?kx_event_uid=LR25EaJr&clk=http://oau.cabinrescue.sa.com/bio-rad.com/amVubmlmZXJfbGVybWFAYmlvLXJhZC5jb20=
Resource
win10-20230220-en
windows10-1703-x64
8 signatures
300 seconds
General
-
Target
https://apiservices.krxd.net/click_tracker/track?kx_event_uid=LR25EaJr&clk=http://oau.cabinrescue.sa.com/bio-rad.com/amVubmlmZXJfbGVybWFAYmlvLXJhZC5jb20=
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133303122487645809" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4076 chrome.exe 4076 chrome.exe 1968 chrome.exe 1968 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe Token: SeShutdownPrivilege 4076 chrome.exe Token: SeCreatePagefilePrivilege 4076 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe 4076 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4076 wrote to memory of 1764 4076 chrome.exe 66 PID 4076 wrote to memory of 1764 4076 chrome.exe 66 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4792 4076 chrome.exe 69 PID 4076 wrote to memory of 4824 4076 chrome.exe 68 PID 4076 wrote to memory of 4824 4076 chrome.exe 68 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70 PID 4076 wrote to memory of 4188 4076 chrome.exe 70
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://apiservices.krxd.net/click_tracker/track?kx_event_uid=LR25EaJr&clk=http://oau.cabinrescue.sa.com/bio-rad.com/amVubmlmZXJfbGVybWFAYmlvLXJhZC5jb20=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4076 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xd0,0xd4,0xd8,0xac,0xdc,0x7ff8c3a59758,0x7ff8c3a59768,0x7ff8c3a597782⤵PID:1764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1848 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:82⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1592 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:22⤵PID:4792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:82⤵PID:4188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:12⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2976 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:12⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4240 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:12⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3152 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:12⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4540 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:82⤵PID:3404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4644 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:82⤵PID:3952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4528 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:12⤵PID:5036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2500 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:12⤵PID:4432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1660 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:12⤵PID:2328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 --field-trial-handle=1784,i,10495266724169294302,2731930438423874506,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1968
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4916
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
707B
MD54d7169f95d75bb9b2d653a273305409f
SHA11a7f46fe6178f941a2e693b0d5f82874ae67dbc2
SHA25689ab86c913f5294d3b7f990a7d8ac11d10141218fb9f5e8bcce9299c9a648cbb
SHA51218c2c400be737f4e7c0af96e4b8cd837568a8394a2131158efac67db7aa0ec22f2c4338c6ff276dac194c04d039ce3b1565b1ed645cb71aa5cbb47185878b5a6
-
Filesize
5KB
MD5fab828982e207a9e5255e702fa2c1693
SHA18aeb73c18ff91728fa642fa213bd0f5ae16ab610
SHA2569299bd6312657fb62fe16c69c9a2a7b764f2ea9365ba2340b12bd4350edacb1f
SHA512586033388eb5c4e4190d6849ecb1d0117e6f52e58297f24edca90147fd04fa780c67aa232a4793dff240e8da57074a62b15b48dbda42c8e5362f10df0a9a439e
-
Filesize
6KB
MD5bf8639b25d72f196d8e0fe4ade029529
SHA1f37c5f1d5c5d86dec58d9ccc453dd017deccdce8
SHA256ebdf3c721c854ab532b58c231217ea812fa43ae671ccf31d5de750765a6a9466
SHA5127826acd660673a5d0ced0a4777629a7c43c13fc50ffb9c0815fa1b9cfba866bdbb9c08730252940ce83481c410c28a9c67a0bc588e4fff35369c8b77ff0798a4
-
Filesize
5KB
MD59176868a6653e7d3bca380356c27c25e
SHA174e8da4aacc74ab4d3a6bd3868cf3166e9760211
SHA2563092f29c75be5e27582044c04423a0638c3c45de40c881a836120cc4e96a5900
SHA5124610accdac849dcf29dec4a8481fddca30c982e8bc93fd613c3c2544c868278b66348fd6db5d63cbc1c87d272090f8c1b3f4b60c886b339423dc9825c95e4680
-
Filesize
158KB
MD5127cee9302c4999a8872bd531de9be20
SHA140f4857d93461774387d3787ab5bb1f7ac0fa285
SHA256de2e2b5a1832b382843c82c79a014d5fd2ba3553f7596c72ea86fee5627693ae
SHA5128ef19ed41006d921d94f9b93e0e9f07d1bca9df6947029bf4dc13a24647be52b89065527d82036cde61ef726ddbd7331a439289fde584015ea3bc31716b3540c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd