Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
27/08/2023, 17:50
230827-werk1seb21 127/08/2023, 03:17
230827-dtekwsfb75 122/08/2023, 17:50
230822-we39taeb97 122/08/2023, 05:56
230822-gm8ryaac65 121/08/2023, 22:35
230821-2h4bwagg42 121/08/2023, 06:10
230821-gxjwkabc75 121/08/2023, 04:56
230821-fkp2daba47 121/08/2023, 04:02
230821-el9azaaf93 1Analysis
-
max time kernel
1800s -
max time network
1805s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
27/08/2023, 17:50
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://send.cm/z1dg0c7dkj8g
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
1800 seconds
General
-
Target
https://send.cm/z1dg0c7dkj8g
Score
1/10
Malware Config
Signatures
-
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133376322434638816" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4460 chrome.exe 4460 chrome.exe 1488 chrome.exe 1488 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4460 chrome.exe 4460 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe Token: SeShutdownPrivilege 4460 chrome.exe Token: SeCreatePagefilePrivilege 4460 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe 4460 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4460 wrote to memory of 5044 4460 chrome.exe 51 PID 4460 wrote to memory of 5044 4460 chrome.exe 51 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 3264 4460 chrome.exe 84 PID 4460 wrote to memory of 912 4460 chrome.exe 85 PID 4460 wrote to memory of 912 4460 chrome.exe 85 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86 PID 4460 wrote to memory of 908 4460 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://send.cm/z1dg0c7dkj8g1⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4460 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff29a99758,0x7fff29a99768,0x7fff29a997782⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1572 --field-trial-handle=1876,i,9487507988827079881,5551446718118167659,131072 /prefetch:22⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1876,i,9487507988827079881,5551446718118167659,131072 /prefetch:82⤵PID:912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1876,i,9487507988827079881,5551446718118167659,131072 /prefetch:82⤵PID:908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2780 --field-trial-handle=1876,i,9487507988827079881,5551446718118167659,131072 /prefetch:12⤵PID:428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2816 --field-trial-handle=1876,i,9487507988827079881,5551446718118167659,131072 /prefetch:12⤵PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 --field-trial-handle=1876,i,9487507988827079881,5551446718118167659,131072 /prefetch:82⤵PID:4172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5808 --field-trial-handle=1876,i,9487507988827079881,5551446718118167659,131072 /prefetch:82⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5740 --field-trial-handle=1876,i,9487507988827079881,5551446718118167659,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1488
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4116
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288B
MD5664ff346d4c618bb459e7c43b964b119
SHA125c2ba5977a5d958c66147cc455620e2e0a19c0e
SHA256afe5bf2d0d29c8d923a37442a69a768f36706f3c77e505087dea389bad8a18f6
SHA512f110d2bfe36cd077341f84e2cb6b28f8eb5afae74d905bcd7fadcb41c62f83c19e7dd7272134034da45fb160e2c6d880dcbcb4d6cf821aa26a538cfe291a7b0b
-
Filesize
1KB
MD5d8b63fe7c20f9b9909c560d38db753da
SHA1445a0ede50dc76efa7ab07e7a446544a5642d997
SHA256271034e9ec1ffedaaed57854c5fb4e9ab450a705e19344b8ec37e40caa94eca1
SHA512fdc5bdb0779d4e859af856d0ca0325bc5c5227e6ff25bf7286c1f7e615adab5b2f4b203e7089ec99ec6bbf80750ec3f9398b7da4a6595fbf6ea909fc6ff45df7
-
Filesize
700B
MD5cc4f466b652ce9b3b3479c25de26bb23
SHA19312d23f9d04a5a7bd4e62ea63229f3579d1a379
SHA256647ab9c1eb78c16f680fd6eae897a4c0062b67a2621e09174ad27602f7d68650
SHA512c42fe92e2f7954bbd0d18af08d6c4a9405b62216fd912f4196c238514052f6806e422f0846baec3e61a8c52934b701bc0cf63d98b301e3630a2e41653abd7f17
-
Filesize
6KB
MD53a4e791e9b059217e03980cb73d526cb
SHA1af23e8c9a564e48f68826b7d0f2d405c0b878aa5
SHA256cafb64111e3a777135e47b21b0d7c7475ac146b46f1fcf8f7ce01a80538ba4cc
SHA5129421cd828cfd51c9db40c86457f88479b4b4d9d65e51733b0290208cdad3c67f4ac088b31ea0054ab0442f4664283ba923e46417b33d4d90a786d64270dadec0
-
Filesize
87KB
MD50c22d6ff59404d04c93a0969fa9235f7
SHA11683633eba985811dfb15fbf16e4631f02697bf3
SHA256cd589851788158498c68063f96661e1bd9f646f89a80162e04af5c475c12b14c
SHA51256f43df441db247735316616b2a6553278af821460659355dd5da0ef9b94afb3b63c386bc6eae439abe158c00d1645972034a92c71e8a779589b35dd66ff34ef
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd