Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
13s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
01/08/2023, 16:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://t.ly/J_Cai
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
1800 seconds
General
-
Target
http://t.ly/J_Cai
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133353806164678651" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4864 chrome.exe 4864 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeShutdownPrivilege 4864 chrome.exe Token: SeCreatePagefilePrivilege 4864 chrome.exe Token: SeShutdownPrivilege 4864 chrome.exe Token: SeCreatePagefilePrivilege 4864 chrome.exe Token: SeShutdownPrivilege 4864 chrome.exe Token: SeCreatePagefilePrivilege 4864 chrome.exe Token: SeShutdownPrivilege 4864 chrome.exe Token: SeCreatePagefilePrivilege 4864 chrome.exe Token: SeShutdownPrivilege 4864 chrome.exe Token: SeCreatePagefilePrivilege 4864 chrome.exe Token: SeShutdownPrivilege 4864 chrome.exe Token: SeCreatePagefilePrivilege 4864 chrome.exe Token: SeShutdownPrivilege 4864 chrome.exe Token: SeCreatePagefilePrivilege 4864 chrome.exe Token: SeShutdownPrivilege 4864 chrome.exe Token: SeCreatePagefilePrivilege 4864 chrome.exe Token: SeShutdownPrivilege 4864 chrome.exe Token: SeCreatePagefilePrivilege 4864 chrome.exe Token: SeShutdownPrivilege 4864 chrome.exe Token: SeCreatePagefilePrivilege 4864 chrome.exe Token: SeShutdownPrivilege 4864 chrome.exe Token: SeCreatePagefilePrivilege 4864 chrome.exe Token: SeShutdownPrivilege 4864 chrome.exe Token: SeCreatePagefilePrivilege 4864 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe 4864 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4864 wrote to memory of 4204 4864 chrome.exe 48 PID 4864 wrote to memory of 4204 4864 chrome.exe 48 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 1936 4864 chrome.exe 87 PID 4864 wrote to memory of 4508 4864 chrome.exe 88 PID 4864 wrote to memory of 4508 4864 chrome.exe 88 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90 PID 4864 wrote to memory of 1416 4864 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://t.ly/J_Cai1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4864 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9d7dd9758,0x7ff9d7dd9768,0x7ff9d7dd97782⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1872,i,6534714609056361758,15366280321015301050,131072 /prefetch:22⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2016 --field-trial-handle=1872,i,6534714609056361758,15366280321015301050,131072 /prefetch:82⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2676 --field-trial-handle=1872,i,6534714609056361758,15366280321015301050,131072 /prefetch:12⤵PID:1688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1872,i,6534714609056361758,15366280321015301050,131072 /prefetch:82⤵PID:1416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1872,i,6534714609056361758,15366280321015301050,131072 /prefetch:12⤵PID:2508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4624 --field-trial-handle=1872,i,6534714609056361758,15366280321015301050,131072 /prefetch:12⤵PID:2744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4636 --field-trial-handle=1872,i,6534714609056361758,15366280321015301050,131072 /prefetch:82⤵PID:4528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1872,i,6534714609056361758,15366280321015301050,131072 /prefetch:82⤵PID:4536
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4340
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
Filesize
705B
MD5950589069a26a33a09fbfb163ff08701
SHA19dd276548a461328edbeb559665d4ca0eafc5c91
SHA2561fe91b12ab059f5b969a4c105816ee03d9cf5c4eee9348c8d4e4b6c26f89a2df
SHA512f488cbd033d5b68f763de6c47a2aa6cf9c279a18f5fa3c2408bd3092b68803f56c275e32b10c3717cffe24ea7de520664d4a5050b5f3599ef97378dad010a73c
-
Filesize
6KB
MD5b4e9eeed374a2bc78e23272fdc6e5ae6
SHA14aca2c08ab95eb296904cbc4a1b4968532574ff8
SHA25613d61c10cbac00511e3fc36bebd1a1294841d20760ff10f0d263a04919f07f55
SHA5127172746bd867224765035553374f98ed839444c3f316d0c7fbc10376a055715e0a858802da763d17ad81c3b8e0bb1a2f439ad6b3fb489731e983400d466af63c
-
Filesize
87KB
MD5bccbe785f90c24ba6e8dbed4387163ff
SHA1d733cf78ed870d38475be0513aaa4d787a0aea38
SHA2567f87f9002bd951955f754c6fa37b12151ae2a5f2002602abc55fdb8dc5ab53e6
SHA512de17776c7c4f4184137697f3f1092cc631ce1c5f9a454f94178a2d24795ebd44e6d08cdf79b8032abf6a5823b62a48fd0df0065a2a4ad9d17170550033d7b159
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd