Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
30s -
max time network
35s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/07/2023, 17:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://clt1236550.benchurl.com/c/o?e=1695F4C&c=12DE46&l=C3601618&email=CKk9yDP1mhAb32aWNMFPbmHJRG4In56Tx0%2FgNTKMyzl55ZEYy1Gz3g%3D%3D&relid=AFA21D9
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://clt1236550.benchurl.com/c/o?e=1695F4C&c=12DE46&l=C3601618&email=CKk9yDP1mhAb32aWNMFPbmHJRG4In56Tx0%2FgNTKMyzl55ZEYy1Gz3g%3D%3D&relid=AFA21D9
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133344358617810014" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5012 chrome.exe 5012 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5012 chrome.exe 5012 chrome.exe -
Suspicious use of AdjustPrivilegeToken 54 IoCs
description pid Process Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe Token: SeShutdownPrivilege 5012 chrome.exe Token: SeCreatePagefilePrivilege 5012 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe 5012 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5012 wrote to memory of 4132 5012 chrome.exe 22 PID 5012 wrote to memory of 4132 5012 chrome.exe 22 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4108 5012 chrome.exe 88 PID 5012 wrote to memory of 4992 5012 chrome.exe 89 PID 5012 wrote to memory of 4992 5012 chrome.exe 89 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90 PID 5012 wrote to memory of 3256 5012 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://clt1236550.benchurl.com/c/o?e=1695F4C&c=12DE46&l=C3601618&email=CKk9yDP1mhAb32aWNMFPbmHJRG4In56Tx0%2FgNTKMyzl55ZEYy1Gz3g%3D%3D&relid=AFA21D91⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8352d9758,0x7ff8352d9768,0x7ff8352d97782⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1768,i,1670179815297482739,15784563868427663411,131072 /prefetch:22⤵PID:4108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1768,i,1670179815297482739,15784563868427663411,131072 /prefetch:82⤵PID:4992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1768,i,1670179815297482739,15784563868427663411,131072 /prefetch:82⤵PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1768,i,1670179815297482739,15784563868427663411,131072 /prefetch:12⤵PID:2228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1768,i,1670179815297482739,15784563868427663411,131072 /prefetch:12⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4572 --field-trial-handle=1768,i,1670179815297482739,15784563868427663411,131072 /prefetch:82⤵PID:4468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1768,i,1670179815297482739,15784563868427663411,131072 /prefetch:82⤵PID:3364
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1768
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5fb19845f2acd2d48833c62bfbfc82876
SHA10c22d892fa67fdc5043d86e452d98999975783a2
SHA256d08043c1f2ca7f2d37a5d85195649d62a4543e044231c97b23ea36004e86dbe2
SHA5126efb5aba0c6a58fb196370134cce846227f16de2adbf257380344bf45834eeb449db4fb6adfc200acde520f81c19fcac81a13be73306153fe2a91d177cde2ccc
-
Filesize
87KB
MD509193d194177c0753bb53d52a8a68417
SHA11e865c1139ce692318b720a86cd1b57a6d75d0d8
SHA25637e8113dbaeb1ce47a6b3efd95556cfbc4190fa3a83a47c1709f2aacd42a63fe
SHA5128a1fd063f42c65b25cc6cab4b3c0ce95bc293129086fff1ee62d038d0cb0acaaf8c539ce06193cacf776b77b81ece567889078a9d3e9a47d9008c43284004e40
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd