Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230831-en -
resource tags
arch:x64arch:x86image:win10v2004-20230831-enlocale:en-usos:windows10-2004-x64system -
submitted
01/09/2023, 02:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://premium.cberbanck.ru/payload/openLink/?token=ad1724d6e7c72d61974f533d488397a822e6a29d861bb7c643e6910627d8f301
Resource
win10v2004-20230831-en
General
-
Target
https://premium.cberbanck.ru/payload/openLink/?token=ad1724d6e7c72d61974f533d488397a822e6a29d861bb7c643e6910627d8f301
Malware Config
Signatures
-
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString svchost.exe -
Enumerates system info in registry 2 TTPs 5 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU svchost.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3860 chrome.exe 3860 chrome.exe 1320 chrome.exe 1320 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe Token: SeShutdownPrivilege 3860 chrome.exe Token: SeCreatePagefilePrivilege 3860 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe 3860 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3860 wrote to memory of 1124 3860 chrome.exe 53 PID 3860 wrote to memory of 1124 3860 chrome.exe 53 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 3924 3860 chrome.exe 84 PID 3860 wrote to memory of 4804 3860 chrome.exe 85 PID 3860 wrote to memory of 4804 3860 chrome.exe 85 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 PID 3860 wrote to memory of 2848 3860 chrome.exe 86 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://premium.cberbanck.ru/payload/openLink/?token=ad1724d6e7c72d61974f533d488397a822e6a29d861bb7c643e6910627d8f3011⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffcd049758,0x7fffcd049768,0x7fffcd0497782⤵PID:1124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1864,i,16640522326970570471,1942940681819499140,131072 /prefetch:22⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1864,i,16640522326970570471,1942940681819499140,131072 /prefetch:82⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1864,i,16640522326970570471,1942940681819499140,131072 /prefetch:82⤵PID:2848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3032 --field-trial-handle=1864,i,16640522326970570471,1942940681819499140,131072 /prefetch:12⤵PID:2080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1864,i,16640522326970570471,1942940681819499140,131072 /prefetch:12⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4824 --field-trial-handle=1864,i,16640522326970570471,1942940681819499140,131072 /prefetch:12⤵PID:1152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1864,i,16640522326970570471,1942940681819499140,131072 /prefetch:82⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1864,i,16640522326970570471,1942940681819499140,131072 /prefetch:82⤵PID:3020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2264 --field-trial-handle=1864,i,16640522326970570471,1942940681819499140,131072 /prefetch:12⤵PID:3416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3132 --field-trial-handle=1864,i,16640522326970570471,1942940681819499140,131072 /prefetch:12⤵PID:3512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1864,i,16640522326970570471,1942940681819499140,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1320
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Checks processor information in registry
- Enumerates system info in registry
PID:3524
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3532
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD5f13f2b9b6c57e1db626f1ba2a81850d7
SHA14e9dfb258db2c1712197d34b79a5a5654ee20b02
SHA256be0eb620855ce4588d753d3d80b01da9a79f09f0d99cfc6bfe1928f49ad90b67
SHA512bce49e94d48243c0e48cae58e1b98fdbc13eb0f27f1ae148c26c18418c54c8c5fd522bff00e2ade3aa90b8a2325c544205aacfcd1cd3d9ccb93c4ebb548f704a
-
Filesize
1KB
MD549bd1bd4c1627abbf605c9fbd05c1ae2
SHA1a7f69d13cf365fd989f9cfc3635dfd235375d2a6
SHA256af439e9e78df4bfb04f3a7961649452a0be70a954976102ad4b16e8f36af872a
SHA512b2f335d53f87a3a99a25472ea62cb197fe5b4afce91d5cc55084e54ab38717a32cb7f9b5fbd1515afc0c3c2608d66f1782cc01d1c1091279030aa76355733042
-
Filesize
6KB
MD579322a60e1daa92964eb6bd5910503df
SHA1dd49e77f9824e0001b75f4f989bcfcafbf90203d
SHA256893fd0ed10bc64c72df9ddf11a65cfa3e227685d78821e43f7fc6f452b32828e
SHA51217e2c861874f5f69fb75c1d4c8487e385ade144f744f1f930946f7484cbfc5d345b5b454a8588270db36765ac369437fe5c0b23e54be263717a4420f5c57bac1
-
Filesize
7KB
MD51df655e5b0db226095ec9da611e4ded8
SHA1c58e1eaa94309135f5878a323f5a5e6aa3b11ab3
SHA256f85cfca3913e541619850b3a5d2e691b14b10859e52ac2cd3a77d19cd7475be6
SHA512123050c255e22f6740e76cfe1f8f936f310bfc57cf281307f1bf92a7a087c7785f76caba25b42eb88699506295720638a8cf1363392e0fb669907f95344ff186
-
Filesize
6KB
MD533142d9b7ac758006aca4f24ef74d576
SHA128cf88d1d607b031b8cab6ea79401cfcfc70db2f
SHA256ca7fa90b3cdf5bdf97f7a7e6dabf7db732088e8a0468b52731c045e963b7ac41
SHA5129e93d1fccb2d98601224d41adcf0d6acb5e2c018d1bbda2a71596c9e48416eb8b1dbc99e74c0c19120da94d51515a105711d78510bd7659c68945b224ad1ae94
-
Filesize
97KB
MD5d200fa5c7dfbd991d4d947bd61cd311c
SHA16118998b74f1e1098bd020fb6b8511dff1e89d92
SHA25687f2a1f97aef3ced4354ac0826b7d435e8dbfd0de0e7a533e0fe7ea1ebc32dd4
SHA5125055b5853514e180d7e676325923ca3f3456fd0b825504bb8752635d094d0a13574a4bc17f77129ed1d6915bee1963e881c8b31eb1a639aa90e38ef759747dd9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd