Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
51s -
max time network
56s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
16/08/2023, 03:43
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://hamiltoninternet.ca/one.htm
Resource
win10v2004-20230703-en
General
-
Target
https://hamiltoninternet.ca/one.htm
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133366310282850708" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4260 chrome.exe 4260 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe Token: SeShutdownPrivilege 4260 chrome.exe Token: SeCreatePagefilePrivilege 4260 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe 4260 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4260 wrote to memory of 2948 4260 chrome.exe 43 PID 4260 wrote to memory of 2948 4260 chrome.exe 43 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 3044 4260 chrome.exe 85 PID 4260 wrote to memory of 4084 4260 chrome.exe 86 PID 4260 wrote to memory of 4084 4260 chrome.exe 86 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87 PID 4260 wrote to memory of 3408 4260 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hamiltoninternet.ca/one.htm1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4260 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff73139758,0x7fff73139768,0x7fff731397782⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1880,i,16247374107668083117,6938655904330533922,131072 /prefetch:22⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1880,i,16247374107668083117,6938655904330533922,131072 /prefetch:82⤵PID:4084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2252 --field-trial-handle=1880,i,16247374107668083117,6938655904330533922,131072 /prefetch:82⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3176 --field-trial-handle=1880,i,16247374107668083117,6938655904330533922,131072 /prefetch:12⤵PID:2484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3156 --field-trial-handle=1880,i,16247374107668083117,6938655904330533922,131072 /prefetch:12⤵PID:1876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2240 --field-trial-handle=1880,i,16247374107668083117,6938655904330533922,131072 /prefetch:12⤵PID:1364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 --field-trial-handle=1880,i,16247374107668083117,6938655904330533922,131072 /prefetch:82⤵PID:1224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 --field-trial-handle=1880,i,16247374107668083117,6938655904330533922,131072 /prefetch:82⤵PID:3436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5612 --field-trial-handle=1880,i,16247374107668083117,6938655904330533922,131072 /prefetch:12⤵PID:1012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3268 --field-trial-handle=1880,i,16247374107668083117,6938655904330533922,131072 /prefetch:12⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1776 --field-trial-handle=1880,i,16247374107668083117,6938655904330533922,131072 /prefetch:12⤵PID:452
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2100
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD570c56ba0400b6f20d0cdee0634995559
SHA14c68b062c6ca9bb5bd38d353bc405933ec035026
SHA25643a9befd85531b2d62e41ef61592e4c5b840b53dcae7ed9a5162c9c43a73978b
SHA51253d05abd27093aef507a2841882e87ea11ea27380d7d940e720876529f43300671e8b755acf17374f3afc76b2cf26011808bf1e053fc636419aed313d20c5621
-
Filesize
6KB
MD54c4fa3aba976d9afe8d509982dbcb8e1
SHA1bdda3d1cfee68b7cede4e13fa205361d8434ab79
SHA2566a08b95ab54b47062e92e7d20e92e7a9ba620633d0cd1c6a880ae1cee1785f80
SHA51274b0d87461f9f59733b563f91f8c0cb681e323ecefe92d25a46b9e8fc471fa930e86fc274e881b42bdc453423f562b06253445ef8683dafd475f6fe4cdf2bb72
-
Filesize
87KB
MD5ea2cc230a5b62cac7ee496af1d51be27
SHA16303999b4713391be3d97373c49a2ed7d6c066c0
SHA25626416454614459689b8fcc187432de38b61d8e22380a22957e9e003856ad7827
SHA51286e4b70238095a7b655869b14567dedc35af125acb16759f09a2e2271333af1fd31a6aa96a5e9cf18a544848f95ed46d70ce45494622e96e51f05f8ef33bca23
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd