Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2023, 03:01
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://url7052.hivecpq.com/ls/click
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://url7052.hivecpq.com/ls/click
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133407756932792017" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 372 chrome.exe 372 chrome.exe 5728 chrome.exe 5728 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 372 chrome.exe 372 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe Token: SeShutdownPrivilege 372 chrome.exe Token: SeCreatePagefilePrivilege 372 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe 372 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 372 wrote to memory of 1344 372 chrome.exe 31 PID 372 wrote to memory of 1344 372 chrome.exe 31 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 440 372 chrome.exe 87 PID 372 wrote to memory of 2000 372 chrome.exe 88 PID 372 wrote to memory of 2000 372 chrome.exe 88 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89 PID 372 wrote to memory of 5040 372 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url7052.hivecpq.com/ls/click1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:372 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff02ec9758,0x7fff02ec9768,0x7fff02ec97782⤵PID:1344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1676,i,932300471186510175,2539393733402687045,131072 /prefetch:22⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1676,i,932300471186510175,2539393733402687045,131072 /prefetch:82⤵PID:2000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1676,i,932300471186510175,2539393733402687045,131072 /prefetch:82⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1676,i,932300471186510175,2539393733402687045,131072 /prefetch:12⤵PID:4560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1676,i,932300471186510175,2539393733402687045,131072 /prefetch:12⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1676,i,932300471186510175,2539393733402687045,131072 /prefetch:82⤵PID:3148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 --field-trial-handle=1676,i,932300471186510175,2539393733402687045,131072 /prefetch:82⤵PID:4292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3688 --field-trial-handle=1676,i,932300471186510175,2539393733402687045,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5728
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3396
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:5728
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵PID:5840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD56982a13db4287583ebead33cb1343833
SHA1f535bc9bd8a1b31353250ea9ca94d09e8e2b4646
SHA2560eaadae0224813cecaa0a71a931052fc7d466e0a6dba1ad684f672bd586b08e4
SHA5124eb119e8ea428eab66482ca60b7a9997598f62df08fb84c18a5ca921239354e2e6d9a52c7fdacc0ed96f14816c5f071996d727b4f6dc8b008217f0e3ceea45dd
-
Filesize
6KB
MD5f78c69738037bacb2ff3168d1806559f
SHA1a143d130fef925ed3c888a62e4cf644461047929
SHA2562185d94b7f07f944420675a82b7053837fd4712e60796d3870ba06103b25600d
SHA51222de57474aae22e017bfb3be04e6c24eb80432833a1b4a075b16d1a7b2adaf41ff1ddff2dd98a4cdf369281326d332bad5af1fd18af98a3c1ad0713e719e3761
-
Filesize
101KB
MD50175fd55b0ac85a245d6cf3539fce8bd
SHA167b59a6638a2d160d16797d08c7090da3ef911e6
SHA25648f1ed0e2cfd771756edc7e6c537e231c7ae22af024dc06fa85fc10f90d9e3cb
SHA51239a00739784d777e1c39a819cdcd66c1edd6fc6f13e5ba7df030b967adcb935f6f6fe227d0b5f9c2b8faa0464adb19486c5298f05e4c046db751fd16feb18146
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd