Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
22/09/2023, 06:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.livenationentertainment.com/2023/08/scentre-group-and-live-nation-to-bring-live-performances-to-customers-across-australia-and-new-zealand/#:~:text=The%20partnership%20will%20bring%20live,free%20live%20in%2Dcentre%20events
Resource
win10v2004-20230915-en
General
-
Target
https://www.livenationentertainment.com/2023/08/scentre-group-and-live-nation-to-bring-live-performances-to-customers-across-australia-and-new-zealand/#:~:text=The%20partnership%20will%20bring%20live,free%20live%20in%2Dcentre%20events
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133398362948709113" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1680 chrome.exe 1680 chrome.exe 1700 chrome.exe 1700 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1680 chrome.exe 1680 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe Token: SeShutdownPrivilege 1680 chrome.exe Token: SeCreatePagefilePrivilege 1680 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe 1680 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1680 wrote to memory of 4856 1680 chrome.exe 26 PID 1680 wrote to memory of 4856 1680 chrome.exe 26 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3832 1680 chrome.exe 86 PID 1680 wrote to memory of 3448 1680 chrome.exe 87 PID 1680 wrote to memory of 3448 1680 chrome.exe 87 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90 PID 1680 wrote to memory of 3332 1680 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.livenationentertainment.com/2023/08/scentre-group-and-live-nation-to-bring-live-performances-to-customers-across-australia-and-new-zealand/#:~:text=The%20partnership%20will%20bring%20live,free%20live%20in%2Dcentre%20events1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa90349758,0x7ffa90349768,0x7ffa903497782⤵PID:4856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1924,i,10165222218547392062,3335175329655505583,131072 /prefetch:22⤵PID:3832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1924,i,10165222218547392062,3335175329655505583,131072 /prefetch:82⤵PID:3448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1924,i,10165222218547392062,3335175329655505583,131072 /prefetch:12⤵PID:4224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1924,i,10165222218547392062,3335175329655505583,131072 /prefetch:12⤵PID:232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1924,i,10165222218547392062,3335175329655505583,131072 /prefetch:82⤵PID:3332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1924,i,10165222218547392062,3335175329655505583,131072 /prefetch:82⤵PID:3836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5196 --field-trial-handle=1924,i,10165222218547392062,3335175329655505583,131072 /prefetch:82⤵PID:1304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1924,i,10165222218547392062,3335175329655505583,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1700
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4164
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
504B
MD5956b29072a679ae2f869f5d1c23ea7d5
SHA1b8336c939dfbbc523e26dddcf31888810ea5674a
SHA256f9858d107f394c8208095e062a108df3ac65ac78fab4494f1699c705f5f8bc8c
SHA5123ca8621df2f8e860ecc24c463397dcfa47ff6faef49a39a0faaea0cae52baa01eda35f43817d3d2d29927441955e5df85fe57f29989bcb9d3e8103c48c4e47c0
-
Filesize
1KB
MD51988b8483a3b4dfc76f082cded4f8971
SHA1d4a384a170a4c8202aa7382a7735e94645a792a8
SHA2566f3abef395b0e7fe1c0ad251ee4e5a846b6f559ae730bc3bc6e173a7f775073b
SHA512d1fe8fe14cf0d229e45140ff1c9100e3936f0cd4eeae12b8d7eb9be18db3a864ac44d13a14728c53f5a3b6e797267a24d2cf43e14f11a2b784a10d36440dea5e
-
Filesize
2KB
MD50647c308ed1cfedb61b7d26e65b7d560
SHA1ae441b8bfff695050724809eb5a4b654c52d812d
SHA2563ee997e049ce9458055bf69e614e848271d760a7a093562394e5661dd042cb36
SHA512f0bf94b3ed14c5e9cae99c54baa4ec0b3d6f57eaff5bff0a0ee90dd98804de97f1bfded3619d06ab0af734a57214d200617f5e95e6650e0c47517b33aa2ad9cf
-
Filesize
705B
MD552468b33c6592b737a0ba2d4cfe37624
SHA14c37726e6df481b13beab2db25a3c53f018da557
SHA256872e13aa00be3cf3a28ee50e0b8a3349f41cb332b27cfafddf1f52eb2ac51537
SHA51273aa321d073f60c639b7136e8c3021cff517883806e7b94fb172b05a35c5d4e084735ffae18fec9703522c9bf202421297fc9f8370536da3be00c95c34857d41
-
Filesize
6KB
MD50d7594237a21d7c873e31e4ce7c9c074
SHA186976dc2040a708d6209f3d05c4f33622744c8f8
SHA25674ae50e8b7007d2bffebf72feb88f3ac6d6cf886fa00aba52edfaf9cceaa1717
SHA512c01dd20251f8c33ea8d3b67ba1ae70200dd1003610d6adb4d5550b372ecc7c8e600a006490fe84ddb17a7a1fe7132419f24323c4b725babf6b24f55392adc85e
-
Filesize
6KB
MD5223eb30bc2e5a129af20ed31dcafe733
SHA1b755d306d57427db44bebef5634c740b75a74ae4
SHA256d2e51c7d5317a52de3419fed6d61dd439e294d452f7f6bff84cfc6652e1e86f9
SHA512ac55b9339c6c4e9f0a09d4b35825f52a86f46ca1e71fff68487f691197e703cf9dcf1b926232e0bfb08640929afe82aeb1286ac9feddd95b7dda10b671f639b6
-
Filesize
102KB
MD57936503bf594ee93149283deba86ed6b
SHA1040711a7eca87c1a190a442d042ec01d5684950c
SHA256136a86b154103cb0ec017dbe507154439201972e5dad5ab17fe990108c87c405
SHA5125bf1f043a8d5e8cfaf4a6b73783d03da97ea144b0be35ea34cb950b597ab6c7fae3c8932d400ab2e0e4ef00e0c1c7ef427fdc8738081d65b3d5056dc15d87863
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd