Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
07/06/2023, 15:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.google.com&cn=app&pid=1&spid=1&hl=en&dm=
Resource
win10v2004-20230220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://www.google.com&cn=app&pid=1&spid=1&hl=en&dm=
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133306262665716621" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4400 chrome.exe 4400 chrome.exe 5076 chrome.exe 5076 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe Token: SeShutdownPrivilege 4400 chrome.exe Token: SeCreatePagefilePrivilege 4400 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe 4400 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4400 wrote to memory of 5104 4400 chrome.exe 84 PID 4400 wrote to memory of 5104 4400 chrome.exe 84 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 2896 4400 chrome.exe 85 PID 4400 wrote to memory of 3940 4400 chrome.exe 86 PID 4400 wrote to memory of 3940 4400 chrome.exe 86 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87 PID 4400 wrote to memory of 3824 4400 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://www.google.com&cn=app&pid=1&spid=1&hl=en&dm=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4400 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8b389758,0x7ffd8b389768,0x7ffd8b3897782⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:22⤵PID:2896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:82⤵PID:3940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1804 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:82⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3208 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:12⤵PID:3608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3228 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:12⤵PID:3804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4388 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:12⤵PID:1424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3364 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:12⤵PID:4592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:82⤵PID:4688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4396 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:82⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4676 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:12⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4556 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:12⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4844 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:12⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3956 --field-trial-handle=1800,i,12420249053353471510,3332196484634446699,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5076
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4416
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\295604c7-8128-498a-afce-fb60ea9a8f06.tmp
Filesize5KB
MD580fbba4c959e19041443f0b7613d1b99
SHA1215f8a2c5bda50f00545e9d7e5eaca44a325217f
SHA2563ad94dc0b9cda8d46a4b63d83d6a24b3048f4d860304a81147b956c360efd0b0
SHA512bd950720ed0263b480d6ab4c8917082286409a08c44524b8098e8afb07296bfcfb7343c12ea6e44b48fc7e3514f2fd2f98cc7f7747e14256df4c88e7d7af494d
-
Filesize
5KB
MD5fd874d23b42ee1dc373c48f79ead390c
SHA106824b63f8776e9d36c2c9f337ba051b728faef8
SHA2569f4e4e8dc1eb42c9f53117e03f087e6783afad0817a62862af043a8355915a2c
SHA512756981309442a0d77eaa488f3bab89b9cedcd34159b8cf75fb7752f1f122c4139841572e517f216f76b1c4a82f264c3db7fdf3656c2bda0fbb46b422b896cacb
-
Filesize
5KB
MD5a94efef536f798c3ab9db43f40affeed
SHA1394047271e2ed7db764102a71d7e139fb226118a
SHA25646e8dbcd00346b01224477c76981269d8e897552f421448d11b073951851c638
SHA51263554b2764d21f662215f219aa772d867b97da160cbc718ed56e30b6ad29aa209da26a47bf55f135b92c990c3308882a4f50b43ab0ea58b82699bf6f16ffa20c
-
Filesize
158KB
MD5bf4830e5305745736737e359c301831e
SHA13a18b403ca751fae0cb8f46c8677fb03a066fc0f
SHA2568ef91cef87fc1ff5ab30d2712489c56e387aa06189bd66feb57d2f2b9b6688dd
SHA5126dc50a3b45ef436538ee93374c509b129bc559a939eff683533d88b933a3584c7422aea3c072ab010b97eb2f138d166e26938eb0beb0062ed5bd035cac425a42
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd