Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
249s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
07/07/2023, 06:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://busswe.info
Resource
win10v2004-20230703-en
General
-
Target
http://busswe.info
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133331863144207870" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2260 chrome.exe 2260 chrome.exe 568 chrome.exe 568 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe Token: SeShutdownPrivilege 2260 chrome.exe Token: SeCreatePagefilePrivilege 2260 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe 2260 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2260 wrote to memory of 328 2260 chrome.exe 32 PID 2260 wrote to memory of 328 2260 chrome.exe 32 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 984 2260 chrome.exe 88 PID 2260 wrote to memory of 2172 2260 chrome.exe 92 PID 2260 wrote to memory of 2172 2260 chrome.exe 92 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89 PID 2260 wrote to memory of 2812 2260 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://busswe.info1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffed01c9758,0x7ffed01c9768,0x7ffed01c97782⤵PID:328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:22⤵PID:984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:82⤵PID:2812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2916 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:12⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:12⤵PID:3380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:82⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4432 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:12⤵PID:2684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3388 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:12⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4856 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:82⤵PID:1828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:82⤵PID:4192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:82⤵PID:4224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4688 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:12⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4928 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:12⤵PID:4332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2436 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:12⤵PID:4712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2364 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:12⤵PID:1740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=936 --field-trial-handle=1888,i,4063406910648830711,8359407387344195260,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:568
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4900
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d85b694ca325548b614eb94d66cde107
SHA1786dbbaf12571d439c3200026a3b69abb8cf50dd
SHA256c86f2dfd2689fe89b8eef51c2632c32b4519bbc9e06881f5cf4984d0103ec267
SHA512f40ca78e3bafd08bfd51a436698bc07bb8a84872aabca10d9a1eb0c8dce298c73e01accc5ed167425a2363cac4e6e32a4b57da6afc6607364219d0d501dfb04f
-
Filesize
6KB
MD570cf9df7b1f05abbc8e1544e487b92df
SHA1307bef78e05ee1b6a05c3af45d859f1ae5f747c7
SHA25629cd23d777214f6377f335cd47a1609d66a7bc118843204c711010c0aa2da964
SHA512ea0dfc81feff386145bfdd3532f4c8b7ab67318ec8ef1b5a82b996d912a158cd952d68a11c4b8e835c9f58d03e36b078a171744b05a9e877df363741ed2ba1e4
-
Filesize
6KB
MD5b9fecb6b1044167702f3e536d8273bc6
SHA1977fdddedeba9e84882edc30dc23fc119f12114a
SHA256867dbd64410f62984a61d975ba4bcd98029e2f40c3ffd45a686b462d9fa38e5b
SHA512c27272bf7cfd96a0144e752f14109ba48eb3a453d4dcd423a165904350e77f9c60695f44f3d3398ece84b6d1ab33613a1a011b35ba1aaf8aa1eaf751047eccbd
-
Filesize
15KB
MD5a261ac33b75e0ba46daa6948c6469784
SHA1a39963305307cb60e6b473bb219fe852578be331
SHA256f20c83df4edf710275a1ad87105ad2102bb136cfb455e1952943d380259bdb77
SHA5121d82b1a27e179c848bc847b4153f58d5ee9ed99a3b92be6f7a57af6968e256da80520e8101a27eb6b6c2e59c1d178c900353e72b46624b3eeeff0d3be4840e3c
-
Filesize
172KB
MD5c46c30c0611f0970b2a7db460b0163ba
SHA1224e0e8976690973813a9917fa32208ae89cd428
SHA256704687882cc0a2e4163a4921be401f0112e660f21d3e797389098b5e5f856d0a
SHA5126988d96ed843cd29984d15809282206d4be5ec2d9b96753336de20008e0153013879d67ff5ca707b8d350f8a3827bcae20cecafe09fe5b69ae9484eef7cc3f58
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd