Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1691s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
08/06/2023, 13:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://backtolifes.online/1Z76pLYvDvxxMm9Lisfu729bllrhG6ktUbcdT
Resource
win10v2004-20230220-en
General
-
Target
http://backtolifes.online/1Z76pLYvDvxxMm9Lisfu729bllrhG6ktUbcdT
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133307030723221510" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2372 chrome.exe 2372 chrome.exe 1212 chrome.exe 1212 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2372 chrome.exe 2372 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe Token: SeShutdownPrivilege 2372 chrome.exe Token: SeCreatePagefilePrivilege 2372 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe 2372 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2372 wrote to memory of 2304 2372 chrome.exe 83 PID 2372 wrote to memory of 2304 2372 chrome.exe 83 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 2624 2372 chrome.exe 84 PID 2372 wrote to memory of 1916 2372 chrome.exe 85 PID 2372 wrote to memory of 1916 2372 chrome.exe 85 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86 PID 2372 wrote to memory of 3932 2372 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://backtolifes.online/1Z76pLYvDvxxMm9Lisfu729bllrhG6ktUbcdT1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8d6a59758,0x7ff8d6a59768,0x7ff8d6a597782⤵PID:2304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1796 --field-trial-handle=1816,i,10530185763167222505,8364178637149913058,131072 /prefetch:22⤵PID:2624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1816,i,10530185763167222505,8364178637149913058,131072 /prefetch:82⤵PID:1916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1816,i,10530185763167222505,8364178637149913058,131072 /prefetch:82⤵PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3096 --field-trial-handle=1816,i,10530185763167222505,8364178637149913058,131072 /prefetch:12⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3112 --field-trial-handle=1816,i,10530185763167222505,8364178637149913058,131072 /prefetch:12⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4756 --field-trial-handle=1816,i,10530185763167222505,8364178637149913058,131072 /prefetch:82⤵PID:4704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1816,i,10530185763167222505,8364178637149913058,131072 /prefetch:82⤵PID:4840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2856 --field-trial-handle=1816,i,10530185763167222505,8364178637149913058,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1212
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:724
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5577b5860632006729c5dd62c3cb7fed7
SHA17a367131adcd6bd411f8b21b495018be2eb96216
SHA256172b14f9baa71f1d369d284cacb0dedb391575b11a5aa23362421620bb8d96f9
SHA512f18eb14fc66d431b43746b21df454ad1d931bd770fd9a265581a97dfd972b17ac6867eb8084c502d06e07eaf23f314b114df30bec47401ac21fa5a3004409221
-
Filesize
6KB
MD53634c9a583223e924e2c3aa7bf43c7c7
SHA1fd7df01945f551a3c352f742317916ffba0ab7db
SHA2568e0a0cbe7e5ad4f5b2f9c46b90b00e9053f8214cb12512e01727d870208d7d02
SHA512d6a9f345c998a8180b60b722f582f98a7e22b056790c27edf429b650102dd8a08028ca64357673cfbb575bbaaa93f9ccd53caccb6e66534ee9c9090840df8b63
-
Filesize
5KB
MD514814f1a64ac88c8b98468bf2160d0d7
SHA1966649f829a685a871b98b4dfc8bcf6f87f65cd7
SHA25670ae6a6562ca2585f79cc684969e8aa1c137edbc0f1386a6d03392dac9412747
SHA512c07c79eeec28af34df3839a51ac5866b156b776d01f7f920088d6751bac40ec0977dc663124a402a0fade9a59a8ed69995cb75cb309cc5bcfd5c7eae19d37a91
-
Filesize
158KB
MD54800831bece13ab38c24af90375a732d
SHA1afcd17e9a696f301671487779836660650aae67a
SHA256aa2eef193c9597dce89cd891f9a0e26af6a04840f22ee12bad46a96e6f1b1c69
SHA512e2b1d4ba308685080b2a2c8cada0d41bf5e5e0879d3f88d6594519bdb47deb44d0f1eae7b68636b5a4850d351ce7e7e4de069fa86a9ed454391f55a8dcb7e1d6
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd