Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
30/06/2023, 23:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://wisepops.net
Resource
win10v2004-20230621-en
General
-
Target
https://wisepops.net
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133326429107134932" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 716 chrome.exe 716 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe Token: SeShutdownPrivilege 1780 chrome.exe Token: SeCreatePagefilePrivilege 1780 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe 1780 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1780 wrote to memory of 2812 1780 chrome.exe 85 PID 1780 wrote to memory of 2812 1780 chrome.exe 85 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 3388 1780 chrome.exe 86 PID 1780 wrote to memory of 2592 1780 chrome.exe 87 PID 1780 wrote to memory of 2592 1780 chrome.exe 87 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88 PID 1780 wrote to memory of 224 1780 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://wisepops.net1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffabf0a9758,0x7ffabf0a9768,0x7ffabf0a97782⤵PID:2812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1836 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:22⤵PID:3388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:82⤵PID:2592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2260 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:82⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3200 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:12⤵PID:1704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3212 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:12⤵PID:4784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4528 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:12⤵PID:1628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3244 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:12⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:82⤵PID:3236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4620 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:12⤵PID:3524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:82⤵PID:560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:82⤵PID:4384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3372 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:82⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 --field-trial-handle=1820,i,10415816848358090518,8699693368094077266,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:716
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4788
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD59a3ec57140aceadf8b43f9aabe850bd5
SHA1bca18b74567d43436e2f272c94fd4260feb0d0e4
SHA256ba79a0384a5087118695f461d9caa0addd9b645af643d2877752c31bf0d9b647
SHA5125f875a06b6ee9c38dd0821f65c36b1089c4597b48ea84fd5365c6c47d1db7c3eb207059ad32dd16b706644b1e0fe8f7f75f0591f6e4cff4b2c178cfdc5b9a18c
-
Filesize
5KB
MD59bcc5b4e0a431fa93d0756625477b977
SHA10c9f6e704e63726c7443b690c787a68288966eac
SHA2564d5652b8ea016d06ad4378cc2c0be95646dcae952c709f9356d35a342d08b6b9
SHA512b489d4b007f62c2a4c374ddffc1f22fb1e1e2270602bb61edf46e07d6c94d007bc481a4c21df12bc5dfcf5ae8dfa75d32b1149cf079f3838ec2e0c32296a8a79
-
Filesize
5KB
MD5fe0560865b7b707e1ddb499c25d48370
SHA139df382c9412ff72fab95ffb0c52325eb4516bd6
SHA256688b0deb3fb5ab4a7438a4bee577d867f3aa0245e6cf7810c5aeeb934b66e8d6
SHA51235a873869f50868fb8cd96a33277d60f183b9bc8628494286bf747139d54caf3a3dcdb9b578aa4ef1f4fd9d25e2b7f6ebf57610eeed8af5e41ab7c6a0bbc803c
-
Filesize
5KB
MD566946a6f7f46fc1fc1bda776d76753e0
SHA1f3cceaf96b7f2b1e1dc28412cad8a212bf571be7
SHA25629b56a83c4e5661a7740246d39c6404e83c940a603160d15ae4e21f7ea644b56
SHA512e9d96716ca1eb10c432136258e7e936112d2d8d0a48d46664cfcaf1042a043a10ba2168f2a48e54f01675c5028efed85e79582dd677179cac0299a65b5e77c18
-
Filesize
88KB
MD579629c4d84b7567a63a9e396112a0b3a
SHA14459acefc39a3cc2c106bb6944da34d84cd73d40
SHA256131e23691a30938c543560a1d55aa0eb157751e41e35e087725ccac5c9b42e10
SHA5125046eec3e258e648cdfc8c2a024a4960c3f999971cda648da330a434e57625ee8b33d46200e2ee9350da0125c366d100bd84328a156209263f13ab8ecbaa9347
-
Filesize
174KB
MD5cab89f8c303d54d4a31f0711a530f882
SHA10ebc9e10c3fa00a0c75dabf8a01a3a49652ca123
SHA2567d53caccac0265877e3d6c651bb18bdd1bd13737fb0754c2ab14edf4a74bf2da
SHA5123afb1b8be03f123c354a25dfdbc8d3966c164baf7752e392596a72771504205ef3b7ed2fdfe94d1272c42a3c95a16f989cb189a55f5418acca72f8b74bd18326
-
Filesize
174KB
MD59944fd28b005d241c1489bae41b4b29b
SHA141a413f11c11b7dea6326b7e7326ac7793cc5e86
SHA2568efbd2d063aba7731b456eb247b14256132b71eb0abf1b0c415a9cfc6c5145f5
SHA51249485c10d0648bfd045fffc7d3ad90545dc801ba1808ee1bb0625de1c09f9f291ff3e1128344e02abf09c110bf2f5f04a8c578c3826b12f26a98f4653914f4cb
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd