Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
135s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
03/08/2023, 16:56
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://campaigns..ecellar1.com/ct
Resource
win7-20230712-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://campaigns..ecellar1.com/ct
Resource
win10-20230703-en
windows10-1703-x64
7 signatures
150 seconds
Behavioral task
behavioral3
Sample
https://campaigns..ecellar1.com/ct
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
150 seconds
Behavioral task
behavioral4
Sample
https://campaigns..ecellar1.com/ct
Resource
macos-20220504-en
macos-10.15-amd64
0 signatures
150 seconds
General
-
Target
https://campaigns..ecellar1.com/ct
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133355553996366371" chrome.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2336 chrome.exe 2336 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe Token: SeShutdownPrivilege 2040 chrome.exe Token: SeCreatePagefilePrivilege 2040 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe 2040 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2040 wrote to memory of 4508 2040 chrome.exe 70 PID 2040 wrote to memory of 4508 2040 chrome.exe 70 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 4584 2040 chrome.exe 73 PID 2040 wrote to memory of 1612 2040 chrome.exe 72 PID 2040 wrote to memory of 1612 2040 chrome.exe 72 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74 PID 2040 wrote to memory of 752 2040 chrome.exe 74
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://campaigns..ecellar1.com/ct1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff974f79758,0x7ff974f79768,0x7ff974f797782⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:82⤵PID:1612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:22⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2092 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:82⤵PID:752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:12⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:12⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3836 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:12⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3116 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:12⤵PID:4740
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:82⤵PID:4580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:82⤵PID:4828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3624 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:12⤵PID:4228
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2456 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:12⤵PID:824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4048 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:12⤵PID:196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1604 --field-trial-handle=1808,i,3730132920818913633,18117466019800130827,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2336
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2268
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5cbca22fe4dd57ac4f319fa487d583643
SHA160d6ce9c7bccdc84a8f4ee3a28aad896fb8cfecb
SHA2564c0e5c58a48792c005ef055fee4007b3182937d0267a49b15ddbff1914038025
SHA5123131c7d298ba1f663300b737642fb9c9eb5ddde17fdb5378d4625323d54ec6ece5962e836988cb2e8f702c0b4c33ec42ffab8e6ac999ff1f73e9ed145fa6b1cc
-
Filesize
5KB
MD5ca0eaddd9a9e35fca2cb2093d05f3e2e
SHA174b39c4b2e76d7f6c752610b1fb6462fcdeda1a2
SHA256ded8e6b7e6ae17f91c1aa7fba03d5fbeb7a583a12055e3e3d768967a553b1a8a
SHA512fdc58b103125f880f7c6f4455adf0d94a020aa8adcefcb822b8ddba084d3b11e08981c02818ecb99d5e61568f0d83ae0b989f16928718a89ba568702da6a0af4
-
Filesize
5KB
MD5a9d0ecf65370a06b2fdcface236719e8
SHA1336a8d51336ddf3d6e20c9e6de7314abe2a7883a
SHA256388c2e7a5c4e53560aab2f496fdada2ec79a80ff133511bd765b84601df1d6cf
SHA512392cb20955f55c5cbf32e865f362c8d18661a8c1bc98713abcb7c0b62fc94e00e04284545720f58a528d499e6a69caecfddecd4f0688f7c6cc43ab7cb2297408
-
Filesize
87KB
MD5f4322e2c874bad1736b633719879dd5f
SHA1ce1f9757addf636107310188cf9b4f44d341c447
SHA256ba05a60e6c958455996ec331cbad7e5ecc4dfeba53a4ba1fd4e060c1e0cd01ea
SHA5126cfe0c5be6c2f52b944aa617d20bf016af51976a653a6de00282083ca7bd9a08218cf4b4f96091d8e1aaca42dbb9b5d4b3904ffce1499786bb9e9e461791c179
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd