Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
19/07/2023, 08:49
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://f.vimeocdn.com
Resource
win10v2004-20230703-en
General
-
Target
https://f.vimeocdn.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133342301641731252" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 1908 chrome.exe 1908 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3180 chrome.exe 3180 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe Token: SeShutdownPrivilege 3180 chrome.exe Token: SeCreatePagefilePrivilege 3180 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe 3180 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3180 wrote to memory of 3028 3180 chrome.exe 68 PID 3180 wrote to memory of 3028 3180 chrome.exe 68 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 2468 3180 chrome.exe 86 PID 3180 wrote to memory of 1904 3180 chrome.exe 87 PID 3180 wrote to memory of 1904 3180 chrome.exe 87 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88 PID 3180 wrote to memory of 116 3180 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://f.vimeocdn.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa906c9758,0x7ffa906c9768,0x7ffa906c97782⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1892,i,13644102588155136872,15775794685574508448,131072 /prefetch:22⤵PID:2468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1892,i,13644102588155136872,15775794685574508448,131072 /prefetch:82⤵PID:1904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1892,i,13644102588155136872,15775794685574508448,131072 /prefetch:82⤵PID:116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1584 --field-trial-handle=1892,i,13644102588155136872,15775794685574508448,131072 /prefetch:12⤵PID:3392
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3188 --field-trial-handle=1892,i,13644102588155136872,15775794685574508448,131072 /prefetch:12⤵PID:1056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5048 --field-trial-handle=1892,i,13644102588155136872,15775794685574508448,131072 /prefetch:82⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1892,i,13644102588155136872,15775794685574508448,131072 /prefetch:82⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5260 --field-trial-handle=1892,i,13644102588155136872,15775794685574508448,131072 /prefetch:82⤵PID:724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 --field-trial-handle=1892,i,13644102588155136872,15775794685574508448,131072 /prefetch:82⤵PID:1388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1684 --field-trial-handle=1892,i,13644102588155136872,15775794685574508448,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1908
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2028
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD514d21effdd159ab3cb9606cea0af2f5b
SHA1bdd968b783263dfd1f4a15b3c3f17321193ed30f
SHA256fe96a4265a7768b27eb15c7fe3dca80d6d39e1c11db541e251ba8f0ad0224907
SHA512a5de3183e0025321ebd6eee735eb955779d6d50933927e132b4aebadb4cbdf9bd0c03ccbb5b6e3e9bbbd7d5f8f07c0dfd4c65be12a8a05755149a9301ae95af7
-
Filesize
6KB
MD530d3a79eec4bae1281cb7638335409b9
SHA1cb6e1ab1b263d9af6a74e5cb547435b692489f7e
SHA2563bd3198f7f67f85db6269bcdafa722d3893114846b85fe2c2f9572aa2bce7017
SHA5128215a80a73ced5d17fb2ed8e85a9324e7eb701ef58ae5848af34ca454b411214942f06f126ee1ec2e6b11c127ba1530ffc4fef6a5432a7e1e2693c684a8bb94b
-
Filesize
89KB
MD53ec4eaea40d2ca1e9af5e82ec218cc7a
SHA1d12dcab635c4a279d9d4f6146e5250ad36ffe4cb
SHA256f4abc804c95271bd005bfe86645d34ac101e0145d6ec7be62c0d25e95555dbbe
SHA512b38b3da54594c071af14fd0b35dd2b47c169b0b98c45738167342d684e1612138d17408ae2af5033684736354b8d19d056ec7bd574229bf827a6f73bad7e6b96
-
Filesize
108KB
MD56a4bef57a4e9724984cf7693f291ba80
SHA1b9be023bc6cc91f2870b0a3d7cd229569a257f9e
SHA256bdde30926b9208643f7380d6c2b75c101814bda4a892cce9938b518d7b371a5d
SHA512c6ddf81e013cbc8309d5fb2805e69122af7bc7c59fa3c3287420e3e72381ef7aa03012495ea4a3ddeeb7607f4dc11f7ff7345ab333659462111fdc7903118ee5
-
Filesize
89KB
MD5d1d857e13cd0d95f32951deb313c9eff
SHA14442c55d369c76cee0d85dd07af0e09c69a35456
SHA25604659da6bae4f4971cdde2687a42f96bb35ef2d22bfa9cd59daa856511f5a1a6
SHA5126bd2062157eb63bf78300c99d57562db6dcedf60caa90e9b245cf55baf9762a299cb23da73022e2d6b9765086c953075428ea610c54fae41711885d7cb9f2708
-
Filesize
89KB
MD5f5694f81e941ad9e9cc1a94d8aad7962
SHA14b8597ed814ac53b7bbf30adea12b613f6bc94e2
SHA25635069712b244de2a17bea679174e86225a5ca4df365d8c73b0c297e4a7fbafa5
SHA51281edab653c8980427ebd1455382e7465e7fa23134959b9fc7082cb4fd3e380dfca2ecddc2284798558d630a75c0dab9e404e1cef653a5f93594f88c4f504f0f5
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd