Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
600s -
max time network
491s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
19/09/2023, 16:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://occupationcomplimentsenjoyment.com:443
Resource
win10v2004-20230915-en
General
-
Target
http://occupationcomplimentsenjoyment.com:443
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133396160180391934" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 3256 chrome.exe 3256 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1064 chrome.exe 1064 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe Token: SeShutdownPrivilege 1064 chrome.exe Token: SeCreatePagefilePrivilege 1064 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe 1064 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1064 wrote to memory of 3528 1064 chrome.exe 83 PID 1064 wrote to memory of 3528 1064 chrome.exe 83 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 452 1064 chrome.exe 86 PID 1064 wrote to memory of 1904 1064 chrome.exe 88 PID 1064 wrote to memory of 1904 1064 chrome.exe 88 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89 PID 1064 wrote to memory of 4616 1064 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://occupationcomplimentsenjoyment.com:4431⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1064 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f7369758,0x7ff9f7369768,0x7ff9f73697782⤵PID:3528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:22⤵PID:452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:82⤵PID:1904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:82⤵PID:4616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3120 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:12⤵PID:2212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3088 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:12⤵PID:3712
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4452 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:82⤵PID:3876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:82⤵PID:3820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:82⤵PID:4568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4544 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:82⤵PID:408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:82⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 --field-trial-handle=1916,i,9337678576620096327,3807388773736714861,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3256
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD50f61d47dc9de4ca4741196b9f131f32f
SHA10684497753ed2fcfd659d71bf9ab67c9e06b9a6e
SHA25647c83c0d8b6d15a095989f70c548ce821a03146a8800dd8cb31ec1725a1cbad9
SHA5129f18af09230ba93edf9a49a42e66dfe45aa0208d8f7c902a37a4f78fdf945dd0dde32e22b9e3745590910b3be23947506dd728e2ac150c86d03057953e57c0a1
-
Filesize
6KB
MD53f08d04476430fe15e9ec39c27820cdc
SHA1fba53465aadfd94540df22c3c74880434bac7f17
SHA25649a2444946261c6971055fdccc2ecb58c0113d4ce835dfa4d56f8a1412277624
SHA5122afdc6acbc4d2454327b9ab28cee136964c9cc3b64b069f2c86904ad6a5adc3c9d887a223863627893f10dcb7ae119a43013df1ecf0cc16c1f3b0ac900eacb4e
-
Filesize
5KB
MD556974a0e72bb5667f28639ea2006b487
SHA10bd498fed9e3b867ea8b27981bf4b2c0ca61e7e5
SHA25675d3f2184b715741ef5fc96764b92a13cd7f4fa87af8e8fc02596cdde0ade8b2
SHA512425a2ecf1dba0651d19f70537958845a2228bc5e40f246eac798c9c7b067fa33f4f6d555e40f1f87988b214362dc0d24a60f110ee83e473c4402a4a9c41a15cc
-
Filesize
122KB
MD5ccd1c156c58063dbd63c6192e0488e79
SHA17ab69cb2c4a6e45542688536387ca9cceb5c0ca2
SHA2560fdf2232706181037edb0425cc99e594f112a5155c0864d50a411e35f1902111
SHA512319e9275d559e55b7746f8e3717926f5eba550e1de04dc36b371d61ceddacd801eaa8452808df667e63eaf004fb2b6a45eff0958ebf086c61bd0ea1bc4facab2
-
Filesize
103KB
MD5e56dca09fd14f847346c3ada9937c047
SHA17d070d3380b6451989e98d7f13c7cb59b64fa63b
SHA256c7dc724f0335fd9bf3eeea693ff6ef332265f4b951345d09adb78b6b5dd1683a
SHA512cc17c4bb044e852d80bc03ec3901cf1345e0b8114609d569db153e5dbc96843f5bf4073e693e57f1f556167b01e9c804e4a05df5c3cfce6695aa3654c9fa113f
-
Filesize
103KB
MD57cacb0e26b34f11d13a3a6a8a1b33a8e
SHA1567a63204b2cf50d9a4fead3c60c39725f7e37e6
SHA2566cf3160105fc82f46f39fa34921d0d382eae378a98b77c2f9e77c549399ec23a
SHA512efef0525b74dfb1d40bc79a7716cd28f9a2934664703a8a77375aacf8052b8fd77e4c71ced546b6b1d6a15662abc4fd504370216d85dd9851ebeb1f6130297ad
-
Filesize
104KB
MD5baa497bad8f85ac5ab3d90d71e35673b
SHA175f2852ff29c45cc5a7105a2ebeb18c6dce59055
SHA256b7a297f6940b03a7b49700fadb5add69e41088814760ac872f97ee2c6858f98f
SHA512d0608c17712db95fcd5d9bd43e1846c2ab5426155e2907e0975ec4cd64665a2519f3f52de9cf0a104fd0d4e4133920b5b87cc077fe48afb4370d67db96a42032
-
Filesize
121KB
MD5c337d7d22552e7b3353b58ac0b33851b
SHA1c65b176b3f9cc3945eed487119782c33fd4483c2
SHA25656d1bab46df22e335a0c9a01482f80df5c1b79251a22561a7776aa245102c4f4
SHA5120bf20bc5945e089edda61bde069260a7eb4dc74308446f38c6169329229a91422af12ecb65f42b757bdaab9af358b12357115bc3eeea7ae2b50dacf01111f9b5
-
Filesize
97KB
MD556fb0b750f91ff83885c117bf9d72f61
SHA1baf0fa756b4ec59fb32b3f482829d46597d2b612
SHA256052179d45ce254e5c6edd18aaef5356d89bc2ad5e06636584ccf5d01f846ddd1
SHA512a508d0234feace02c54f2abf62ada6850b1f3f6514cc7a0c5b808f8843e261e4695baa8a685c8c258be59b5d9ef393c5d6f96c98a4ebe9e8959da7cf2813e94e
-
Filesize
95KB
MD510829f20ed89296198367a695aaeb729
SHA1fc49c7f0eefdb82f3265a5a994ee0c6be1176f4e
SHA256042001e36c7ba11bf6e7e689a913599acbbcb79f801f34bbb8e954e818af6744
SHA512fe29c69b020799aefa33b4353d7e745c3ed3b975b58f3775e57d75866bff452f69b689052d81d1e91cbdb27d0269dbf1b69a4f66128aa1148dba8692f00706fb
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd