Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
60s -
max time network
55s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
13/07/2023, 14:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://shredder-us.osi.office.net/
Resource
win10-20230703-en
General
-
Target
http://shredder-us.osi.office.net/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133337334266844728" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5092 chrome.exe 5092 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe Token: SeShutdownPrivilege 5092 chrome.exe Token: SeCreatePagefilePrivilege 5092 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe 5092 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5092 wrote to memory of 5008 5092 chrome.exe 69 PID 5092 wrote to memory of 5008 5092 chrome.exe 69 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4892 5092 chrome.exe 75 PID 5092 wrote to memory of 4468 5092 chrome.exe 72 PID 5092 wrote to memory of 4468 5092 chrome.exe 72 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71 PID 5092 wrote to memory of 4040 5092 chrome.exe 71
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" http://shredder-us.osi.office.net/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc71bb9758,0x7ffc71bb9768,0x7ffc71bb97782⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2008 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:82⤵PID:4040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1824 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:82⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2704 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:12⤵PID:3840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2696 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:12⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:22⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4448 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:12⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4568 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:12⤵PID:3800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:82⤵PID:2084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4896 --field-trial-handle=1836,i,9435460593870907232,17900144731998001170,131072 /prefetch:82⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:204
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288B
MD51384973408865b25ec116585e4c6c3c2
SHA1ba8786e1c6cb271f160e2ecd42593109892c6200
SHA256ec77a9bd91059f140895abfb8d5c69c698cd055efe069c1e4e304a5bf3ed1a07
SHA51272edecffcffc2777be12732327d58dbc28e79f18eadda4be4e5be7f271b32d135a4a1c29d8a35092e71b589b90e8e2f1fe382faa3dcbbe372db9fb65307469e6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\LOG.old
Filesize347B
MD50cf82bd8d238b27e48846499f7f2ecf1
SHA10cc17e72d56daf954b373bf847b811fbfc3f202f
SHA25699f3f6192e3084f268443fa7dc8afc053a0d506b16808b6c7f7564037a452bf0
SHA512dd3535d23d8fca76b6e967a638e4e09ecfb8079b7f7ae2ed2f4f115b0af3dcd93cc4d63346534da091377cde9c2f8a2d32e0a18b1cf6c5be67a0ad7359b16acd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\IndexedDB\https_www.office.com_0.indexeddb.leveldb\MANIFEST-000001
Filesize23B
MD53fd11ff447c1ee23538dc4d9724427a3
SHA11335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA256720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
SHA51210a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
-
Filesize
1KB
MD5e9684e8ca01d39c345f08add283fc5cd
SHA1d35b7af02b0824b39f7d99c595b9750bcc6a4d23
SHA25677f911ead03d5eda3d1ea7adc234001f8d9c50332735d578245f934ed42900f4
SHA512390c3a6dd8a89ff6492fef5c80d4d0152cf5ff918ea82f58eda56a6d6075021d6085052b003b2baffca10528b25604ce58311e8ef145cea8b78ce44b8bce1de1
-
Filesize
1KB
MD5cad9d9f8aa6a78308a4d48bc8dd9e136
SHA1e55497235861f41be134db0d55a798aeea63f2e1
SHA256f8d2ea56c04745ccc4d795aef02b8eda079f0dabd76e2b9c795ab42b414c973b
SHA512da6fc616272ee683206e574ecd74abac44adc331c7b7d97795e349c747bdab3ab6f15c8853de06c42b06c502ee126f5117b40d32213a998f9e1e061fbaa1f8c5
-
Filesize
5KB
MD578ec412679b226253959a44b0da2e817
SHA10f75eb6d3866fe6b40dcff90c2696fb4737ea7ff
SHA2561f77ba6191863ede4aad8f4c4e8a8f281f066f1e26c07e2fbc000da84d68ed98
SHA512e9e0dde06ba62433fe5896d326fe5e964fbf9d86685968afc5736d793d6a2587ff6e8d5c2a537e9e4906ee0a710ef25329b543faa6ddae7598e469794eb7605a
-
Filesize
5KB
MD58b6a0697a85b1017b1b5da9919fe3eea
SHA163898d5b329041609726815a54707507f27b8162
SHA2567382ed2f83925f374e5a54fba8b807e02727c619e5239e33d21a5dc31ee5479e
SHA512a9687b440775e218a584f7bc0566912d63705f76188667ecbfcd34d1bd60938281440ab5ecc3daf3e0a69dd65fc0a6444b4dc6aa1fbb1353d14bb00d1a1dc3e0
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize240B
MD55d1c7219a2ae8cdad0416c3496d1e214
SHA185c1daa3c4e964fd19bbe8a00f06b8a8115b3038
SHA25693923b44a9345ea15370cbe3f1c8eb9ca1be31ab0f65103f0f9556919181d58b
SHA512d29b989c02bd7b5d0c5c5ff960103bd7d19052d8ba52615c22519101ffcda9825ccffd7407d1fcc58be90a64f23bf0b6b4a2f29fb8abde02ddc7c87289086aae
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe585261.TMP
Filesize48B
MD51430372d2e113cc10821c99be34c0065
SHA111217058e5c40ca3d0360e59b2777a1b82c1cb36
SHA256590956c3a5dc40217c865c32db4fa298e9f2ca1f4a498e2208c44298328e091c
SHA512f1e58b08ab314de02950862aa3c5a2cde4956c5250cad4c337aad1f1be28682f37bd261a740f0a861d8f87a0443db3c2b4d9bc5f60697cf95b0c08199dcf402b
-
Filesize
173KB
MD5de7199fa88919e5f0d6db34ed17fa5fd
SHA1fecace298a414c4dd5fdbce53a4d8f33f4f8195a
SHA256a54a594413fc84d4219b3f466fd0486f2256fa49000e3fd9d711a87c874e6ca8
SHA512eb9e9e477326d74ab1ef11c93d2744cfc79a96d2ff956e019b49e9c34aaf87a9e87186f97636daafd1865d266952c2e76368fdd60fea7434099ed1ca310bfef3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd