Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
21/08/2023, 11:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.pornhub.com/view_video.php?viewkey=600602923
Resource
win10v2004-20230703-en
General
-
Target
http://www.pornhub.com/view_video.php?viewkey=600602923
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133370894381568607" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4168 chrome.exe 4168 chrome.exe 764 chrome.exe 764 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe Token: SeShutdownPrivilege 4168 chrome.exe Token: SeCreatePagefilePrivilege 4168 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe 4168 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4168 wrote to memory of 2420 4168 chrome.exe 80 PID 4168 wrote to memory of 2420 4168 chrome.exe 80 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 3764 4168 chrome.exe 82 PID 4168 wrote to memory of 2652 4168 chrome.exe 83 PID 4168 wrote to memory of 2652 4168 chrome.exe 83 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84 PID 4168 wrote to memory of 968 4168 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.pornhub.com/view_video.php?viewkey=6006029231⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5da39758,0x7ffa5da39768,0x7ffa5da397782⤵PID:2420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1880,i,8360488055716468401,12947971888122347080,131072 /prefetch:22⤵PID:3764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1880,i,8360488055716468401,12947971888122347080,131072 /prefetch:82⤵PID:2652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1880,i,8360488055716468401,12947971888122347080,131072 /prefetch:82⤵PID:968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1880,i,8360488055716468401,12947971888122347080,131072 /prefetch:12⤵PID:840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2952 --field-trial-handle=1880,i,8360488055716468401,12947971888122347080,131072 /prefetch:12⤵PID:3932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3672 --field-trial-handle=1880,i,8360488055716468401,12947971888122347080,131072 /prefetch:12⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1880,i,8360488055716468401,12947971888122347080,131072 /prefetch:82⤵PID:3884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4804 --field-trial-handle=1880,i,8360488055716468401,12947971888122347080,131072 /prefetch:82⤵PID:2828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 --field-trial-handle=1880,i,8360488055716468401,12947971888122347080,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:764
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4036
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
912B
MD5851188cadfe72fb19c0a363b92990d40
SHA191a1f14217a6e96d888158908d6bb6bce3ebec9b
SHA2569f45381aeb0e1c1d98bc8521c6542122f36fed507757a23c418c6377a3889581
SHA512c7030d32cb5d3606b0f0654d268d442e5733ec71dcb28c790b0dc32f057ddffe496fb0893f2ebeb2f7e5e13fd4b2cc4cb83c195f4e9dea800286632b2b4bcb6c
-
Filesize
2KB
MD5f37f128ed8d783069910401d8a60a083
SHA128c2e02be59e5af2e382a601aab8591ff03b309d
SHA256dd5cb060bc377a6b662f9e9eee42411654dfb251554d09f52695c0ec9969f077
SHA51277b214f1ead2f377e5e00a891772ab96676d6fddfa7791d9dd32b484e08c295da57b2c9e40bfa23cf03a0e0c5f5fe641a50d07df7976ad26fface65cd6e37fa2
-
Filesize
1KB
MD58d595d2fea52ba009fbd15f59d5087aa
SHA1ca1d5de1e1fa371a5f23ae7ff1f217f5430cb58f
SHA25628263fcc59ddb2cf8182174a215b96b0a1156929e945ddc7e992b5ced546c060
SHA5125ed1ff85c21a6ea630e28f72d1dbd5ab13c2a175f02379f1a94bc4999007ac4124f76104d4933f083d7a4782e0cced17b80e7379edb3b1b56eb16f97f364b65a
-
Filesize
6KB
MD5894157ce29dbdaef45859428bfc6b5bd
SHA1d626eeb9b7897064fb0681a4189d411f925e2a3a
SHA25650fd19eb0c962b8fdd2c936a4b38bbf557f253e32fbdd6ffd60178f6de3934c8
SHA51247c944930cf721224233de2b6c6155a61a9468014cbb617c15a6c4b4111b5c71f55db06f680b42136e614465880cd071cea1ffdce0fe170acdc128d52a502daa
-
Filesize
6KB
MD5ec2e43e4d9bf50f7b5079e6833188be3
SHA179a1b97a374fea936956cfd79a07a91630c3ebf5
SHA25663660a5f09df5fcaf6d1b9c708e6e86b20a73ce72a75d7d10306acbb01ff8b4d
SHA512aab40dbfeffd78fc3ae7d302eb9da9b8529f38c5a7916c7ffd714e5e55001ac52b0c8b032b81912e1a2ad95e6835790f2a67fc814229ae45181b514177315673
-
Filesize
5KB
MD548dea23d3df7fc785c1001b0a683249c
SHA13e67fcf9e25b38f09c7d44bed8981b499ce40da4
SHA256bcd5890a470c427a85943b4c41b1f94a6e3fece0189b9e02e40182bfc3c50ee5
SHA512cfc6ba30e041de4a72c4089a7aa26b6a0a27eb46c36c175916a219c21f197bdf28c8f48cc44f61645e15c20b604635b70a01d3ab50617619396e20c971611a9e
-
Filesize
6KB
MD5c782c6f004a3add9fae59ea5f0b8092f
SHA1f28ffa16ea5e0d0c05e187b633592f1a336e3cf0
SHA256e41124ac6fb3d8c56aba014abfcb11a6e77e2589ec5198a576b4dc01d3e71674
SHA512486ffbb99426fdb124ffc8b1693791d0f52fc6315887d7a9cff82f15c4d1576bc49aaadf0e2051cd53065dbfb7c48048473e93fefabfc61fc953f49b4604d05b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize96B
MD561886080305325307bbd96cc6b80f8b3
SHA13a4b275cb2d010d51fac6041513894aa8fdf3928
SHA256289a8baafaa7520499464de1cf6451a40d8b42557b7cdfa75faf4db4bea92d38
SHA512d365dc2b23991f5eaa8b589ca746f1ca559755eb8500fc7106a9a6ea6e001ba09ef3b33bcc6a4d4342418f653b46842d76b4ca63895bb0385b0fc5f238817afb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58879a.TMP
Filesize48B
MD55833a5275a5b2d5817258e5e5e77e510
SHA1cc9d08915cb9c6bf608636f735a10ef38c66ce39
SHA256c8ee53a95714ab90e4c7358d1ccdb56ca89f6e896a80be5f6720cee2850de268
SHA512b38b05d1bdc8c0e9737cf7a8348807710192e50347153d0ee179faa0a4cf902c0a9a5d5c931860fc96a491b67d04e34944d27dd4488ea755a643169b8a04f7fb
-
Filesize
87KB
MD58b42af6e6b29336f3ec109a5b016753b
SHA139f756bf706a9e94e8ac445a0742efb0cc58fc2c
SHA256f1443c904bc21b51f074d34d9da08a480439edfa19e896fbca2bf54ef370a319
SHA51218ae0ade2143102aa28b10a6bc17e873bb14e72e845d5dc90a29d6f018987eae48245ad0ef25218d05de6e9c8217a462c43de5fadbd6c3c52d2fd370475af970
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd