Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1690s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
18/08/2023, 01:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://emsachichofabrega.direct.quickconnect.to
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
1800 seconds
General
-
Target
http://emsachichofabrega.direct.quickconnect.to
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133367968755332571" chrome.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 1596 PING.EXE -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4364 chrome.exe 4364 chrome.exe 4992 chrome.exe 4992 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4364 chrome.exe 4364 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4364 wrote to memory of 2912 4364 chrome.exe 81 PID 4364 wrote to memory of 2912 4364 chrome.exe 81 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 1884 4364 chrome.exe 84 PID 4364 wrote to memory of 4700 4364 chrome.exe 85 PID 4364 wrote to memory of 4700 4364 chrome.exe 85 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86 PID 4364 wrote to memory of 2568 4364 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://emsachichofabrega.direct.quickconnect.to1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff873e39758,0x7ff873e39768,0x7ff873e397782⤵PID:2912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1868,i,15286404899767855230,3499976948688269007,131072 /prefetch:22⤵PID:1884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1868,i,15286404899767855230,3499976948688269007,131072 /prefetch:82⤵PID:4700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1868,i,15286404899767855230,3499976948688269007,131072 /prefetch:82⤵PID:2568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1868,i,15286404899767855230,3499976948688269007,131072 /prefetch:12⤵PID:2644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3000 --field-trial-handle=1868,i,15286404899767855230,3499976948688269007,131072 /prefetch:12⤵PID:212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1868,i,15286404899767855230,3499976948688269007,131072 /prefetch:82⤵PID:2680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 --field-trial-handle=1868,i,15286404899767855230,3499976948688269007,131072 /prefetch:82⤵PID:832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2304 --field-trial-handle=1868,i,15286404899767855230,3499976948688269007,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4992
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:616
-
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe"1⤵PID:3656
-
C:\Windows\system32\PING.EXEping emsachichofabrega.direct.quickconnect.to2⤵
- Runs ping.exe
PID:1596
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5f9738d32dc9278bd5f4772bb0f6c78f6
SHA16322cfcc6908407261d04f4c09ee4c7447cfd4d9
SHA256480d556644aa40f9e6b3d1588335475e96eef6be1cffdebd8ea0bd3e2a3cd6b3
SHA512580c2601b3c9b2a91f9ae9b313b646290fa6659fec697c694fc961b4785c6a710be54a878359b984b8e050db117abef3a1fea3497e15fa41defe8306e2c20358
-
Filesize
6KB
MD51fc0a9f7a3ef0d8d9373dcfa101a1aa2
SHA1efe1c3ebbcbecf8ac44d498ef3d6f6bd824c4237
SHA256cb740e96270a166de9ddf039489b87cbbc453ec1487b24f91ec88f79ef414d60
SHA51227c2ff5bbc1ee04ef851aed8c0d422ea5a854a21aadf58302eafaba64bcd1657e2322db908931dbca17661678ad5711362a66a84b78c383ca5c2ae13b096c7a2
-
Filesize
6KB
MD5b497d44564d792befd01360b7d5050e2
SHA12085843ea43094bb468c302479859cb7f0967a4d
SHA2568b3032e083c84a655c101ef24ce7c6b83dd56118fd0a56223ec587b4e23f2dbd
SHA512a56b1bbc0bcc63524c2674813055c0945f4ee89001a5eb1c501b1ba2ed2b1437b3f04eca70c3ca769dc625e41bb268a971109feceaf1795d583b748c5761363f
-
Filesize
87KB
MD5cdef91c34775a6dd6471917801c9cf54
SHA13f119d5afee05878e622bbc93ec39301d37fa51c
SHA2560e00483e285c8dec3b8e3f20cbef7d0122c7f3b0433824b4fe7f43d43984d99f
SHA512bc992e2ae052d8a3e513705dcad4adcdfbcdf281471c8073d2c452ed3e0a142b930d4f31fde022868980c6f2887d71ffc2d08df42646bfb6cd45b716e48ba9f0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd