Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
112s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 14:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.loom.com/share/27477072db57461ea313119829dbcdb1
Resource
win10v2004-20230703-en
General
-
Target
https://www.loom.com/share/27477072db57461ea313119829dbcdb1
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133373608169235447" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3340 chrome.exe 3340 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3340 chrome.exe 3340 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: 33 4496 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 4496 AUDIODG.EXE Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe Token: SeShutdownPrivilege 3340 chrome.exe Token: SeCreatePagefilePrivilege 3340 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe 3340 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3340 wrote to memory of 4928 3340 chrome.exe 81 PID 3340 wrote to memory of 4928 3340 chrome.exe 81 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 220 3340 chrome.exe 83 PID 3340 wrote to memory of 2908 3340 chrome.exe 84 PID 3340 wrote to memory of 2908 3340 chrome.exe 84 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85 PID 3340 wrote to memory of 3776 3340 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.loom.com/share/27477072db57461ea313119829dbcdb11⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3340 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff987c29758,0x7ff987c29768,0x7ff987c297782⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:22⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:82⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:82⤵PID:3776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3080 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:12⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:12⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5104 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:82⤵PID:664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:82⤵PID:4540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4996 --field-trial-handle=1828,i,4986536714113981902,4131306304773366537,131072 /prefetch:82⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1776
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x368 0x3c41⤵
- Suspicious use of AdjustPrivilegeToken
PID:4496
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57691942daf4da0384fcf2c0e27e87218
SHA18ab812b9fd56ce35eb812ecb472a790ebb8ce9c2
SHA256563dbaf26e3fcdf4b45cb8ba5db17e222580f208f786f579c3b9aa0758357097
SHA51253b43ef140be7ea379928abbbd54450aad5903fe1c679913144009aff72597cfe37a9870caa929eaf2c9e7dc738d303fbc01cd828ea6e5264a4d49d098a57524
-
Filesize
3KB
MD54e322c2c3eb8fecca44e3578ed923cba
SHA1a4b6d1f75c77689beaff9ecf0c6d5626b0b328b9
SHA2567e838537005b113df8df5c54964bfb0787547f19a0ba9dda0fbf1ec575631445
SHA51297b5fc0533a2880ab641eeae80a9e56236773ee3034de89d4d2122e957d672a5a360b2d4224c13675bca0e9df09fc2b6c6c479dcd49b3bc2a1b2c37c3ab1de14
-
Filesize
1KB
MD53447b7cd5d66cf5cd8354026f9030062
SHA109aa47f84d02eaa42b6a0ec4703da130855c27a1
SHA25650127b36c47c995c75b919af4f1664ef967b1cc1672da89ee5c274c4d0e023aa
SHA51215bfb2418fee560de62ed98c5bc94de241aa377c63bbdde5aeb348f7accd5a52eb73ab0f9bce3afe49a3e388e55c97b0354cb011548af87a58271329ff64e67a
-
Filesize
1KB
MD5f671cb6c76cfa7649f83ea0a39226109
SHA1ffea43a34fbfd2f4e6b55ce73c68b70a0273ad53
SHA25696331d7084e182f7fd4aa5ddf88432cf1bda45f42a53da22a185a29662974250
SHA51276cda3e656fc915b6920e132522bfda1a22e7d4fe446db142cbb4b6b5e8e9851242c3098046f91429ed71cb591f5b5aefa7d8d717b6e67d10e18e41a16573676
-
Filesize
1KB
MD5e0eefe29d50f2bd6f6a81022b02c1409
SHA167cdeac574611ef855d1f513c2ce8fa6c90e3d65
SHA256003384b5ae1ef3cab05584201c94f9a00573be97c3fc7609f62d647dd67ace6f
SHA512ed62425c489059a4cc58f89c9c515ff28d96db36a26024313d567992a063a96626dc4136faeb40b3e6f5cc46b9f0ee8697018f0c60741954c7f35d0c3bf2a532
-
Filesize
1KB
MD5b4ec2c2d6a3ebad32e456ea837f97c31
SHA12f8f885c80b5e319e34e35f90c9dc86d184aa050
SHA256c4c05d9c929f6e27f26ae0b8b2411853f6ea81d49d5590f80d0dc76975a1df51
SHA5122552135afdb4bf42993e997b3799ef14448d7619b3c00cc76e7b66338ed65e34543efd35ae4c4a23fb6b0508f29195bdfd859be49ac83c38d18538f2b5d7f3cb
-
Filesize
1KB
MD5690018e94d8de7c48d1d9c775f3461c1
SHA1a1fcef53bd8ad07fc57c12d6ba507269678f759e
SHA2565c6ab8e9583cd987fa2862ab5f68ccf948964d0e8e4ceae138e0461931c25afc
SHA5124be3a3c28f01066878b37c5f766b1be9effc8eea57ca24a5ab6410d7087fe01c5ad7cc73e64875847e5d6e5340b6223ad5dea331856c2a7c5fb6141797474b7e
-
Filesize
1KB
MD552071a42593db772366c30c5eb75c30f
SHA17a75c2bdea9eb1c09806ac0d1156fa4ccfdbbfbb
SHA2568f25c3742a5de5bcb46a6b1301c161c1e253516dd538c842cffef946850aa7e9
SHA5122757ab9488facfe5512a5b8c494ab0198fd4b810d1c3ac6313c77ae355537b72bb38decbb3204c93789778dce7402931c6f94d84411e5c28109aea9a661ebb35
-
Filesize
1KB
MD5f03478ea64dee7cb6939d51baae19e86
SHA1e5543691d710321519fd3992b25d8e5611fb1dfd
SHA2567fbc6ebe0f48cf0ade9ac6cfdaa189f94f1de8039b1f2d8fd603c7f639481d5c
SHA512b12739e838696aee223abf21058449f03d70ca99bb81d0381d43a276d2962018c70854022f80266fdd09fe58341a4e784cb0ed6f81023a48ec4d6cb2edbab2b4
-
Filesize
6KB
MD5f3e71ffdb05f11f7b5eee439d8ec5860
SHA14ea9b5a36f6e2f0a83ee396f729c28c011dec345
SHA2567fa4235fee2155085d06cd59a49a930d7a4f623d186e180cbb87cb879f6259b4
SHA512c8b95e556b34d2784f9ff7b847d849802eb4e0084b286363bc418a604a94babb7c39b20561ce527c22c21f0658d56deca528c29fdf0e5bde3ddabbf638b2dcb9
-
Filesize
6KB
MD5b71fbc0c079157d31e9d0c901d044579
SHA12def54324a76a76b03e8d915af5c6871437382c2
SHA25600904bca7e4a7ad6c169365d4ba8a881fea3df4198466e2543ab48edc5a9ccea
SHA512a4f4b88497553a6563148db1edaf1bfebd60c332786792e2b092a9b016ddbcefdadb281e9e0aa06e332ddb410461a8e6bb4c2cee5560a03bf57606b53910e493
-
Filesize
6KB
MD55134bb757404db79916991f59aaa0ffa
SHA188932924cefbd5f51bc2e3f3cebc5baa221bddf7
SHA256e864f390aa152f2d49ff483b7ef9550789d57e4077c7083fa2001f8fdf2a578d
SHA512fee4c6dec00afbcec83dd7b5da6ca99602c2f5564beb86a1481721d3bc17714efc3cddb2ba342d717f12131ce7d8e059a95bdc9c16cc250725c5d68e4ed4bed4
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\c90c7f89-2246-42cc-b5b1-6f0cd9c51d28.tmp
Filesize6KB
MD51ea043fc10020ff9940b9bb694982410
SHA1f5caa8be0f0a04b8de29de99c7591896c13da116
SHA2567035762a27815b3b7c8eb2765a4def64f8bf356624fab6d2be8f2ad1d9e8a731
SHA512c15a4b3dc9f988d42fd56d87ef7c4fea051622f5d2506063bc1fd98efb33e83516adcbb1c552c49477865be74c74e20c89dbe201af3e57e21509d773ee6ab706
-
Filesize
87KB
MD5a764839a7d4cf0f6092f0f93a40ad073
SHA14989abb3ab939ae25415c894a798df1135c989ef
SHA2562fc0455ea8e542bae8cd1d7c9ed1747e1814bcb992813f127ec8fd1a6924afa3
SHA51232191ea4f487825b4a4065c5d61599f3f17ef8ea0ed768549d5eb58f056a74ef422cfa0b3d1af0cfa180279bf98a5ef37baa5f26f660410d10dbb9a9f710eb61
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd