Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2023, 13:53
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ndt-mlab3-iad02.mlab-oti.measurement-lab.org
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://ndt-mlab3-iad02.mlab-oti.measurement-lab.org
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133408148548739608" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3124 chrome.exe 3124 chrome.exe 3552 chrome.exe 3552 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3124 chrome.exe 3124 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe Token: SeShutdownPrivilege 3124 chrome.exe Token: SeCreatePagefilePrivilege 3124 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe 3124 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3124 wrote to memory of 1504 3124 chrome.exe 42 PID 3124 wrote to memory of 1504 3124 chrome.exe 42 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 1284 3124 chrome.exe 88 PID 3124 wrote to memory of 4888 3124 chrome.exe 92 PID 3124 wrote to memory of 4888 3124 chrome.exe 92 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89 PID 3124 wrote to memory of 4972 3124 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ndt-mlab3-iad02.mlab-oti.measurement-lab.org1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff24c39758,0x7fff24c39768,0x7fff24c397782⤵PID:1504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1868,i,13396992713008135904,4041635216043690839,131072 /prefetch:22⤵PID:1284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2180 --field-trial-handle=1868,i,13396992713008135904,4041635216043690839,131072 /prefetch:82⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1868,i,13396992713008135904,4041635216043690839,131072 /prefetch:12⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1868,i,13396992713008135904,4041635216043690839,131072 /prefetch:12⤵PID:3732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1868,i,13396992713008135904,4041635216043690839,131072 /prefetch:82⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1868,i,13396992713008135904,4041635216043690839,131072 /prefetch:82⤵PID:5016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1868,i,13396992713008135904,4041635216043690839,131072 /prefetch:82⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3396 --field-trial-handle=1868,i,13396992713008135904,4041635216043690839,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3552
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD523a2edd06f7dddb37e88ea967efc3bc7
SHA1c1326d94606bc37bfd7f9f521bdcfa9a87b46ba7
SHA256ac1fca21055315598b61ed82ee74f566e5725757097151eabc02c99a663b282b
SHA51231fb085481ee387f1fdb154f8a4fa4ba63988b9ed4e32b677e7d794053b4bcd355032db0f8a305450e0ad01c3819044185e99138b09b28946d889d458d1a1021
-
Filesize
537B
MD5bf68f0467e5eb53114132b42d26a6f15
SHA1a0a361106e444e10d52ae442407c275643d50e0a
SHA256d5594574f5922612c0d02649bbf0ce64c3d962d25f713bbbb34426530302ea45
SHA5120e0da6889dbd72128996d1f6a39381cf811c1b2f6f1cf5e7f2a2400b0d0b19f4879bc4f4c2904a141c98cb0aedc9f3efd0d0379f4863b5c2cd8154b49a207063
-
Filesize
6KB
MD5d3acdb2ca06af6a6db65b1b3bf96d21a
SHA1cc32d7b30c01e7b7372bfec23dc64d270d8fb408
SHA256888d0560fbeb52b0eb832b0bf06a4d5f84c115db5c21646ed2625d154e048b59
SHA51282a458844509a3d60aba39497d24d556461bc933a47c0383d0a47a88d945092770674104161dc46587940790789c70e73cfb88d42649eefca350c4e5e46f8ed5
-
Filesize
101KB
MD5b221abb80cb29699b94e605eecd9e4ac
SHA135a733ca1983a0ae32cfe5870eb7bc504c4d7c59
SHA25697461f1380073ae0b31188dcd31eb02b4c62f35a6bf5e5e34db32b5af1cbb9ae
SHA512e283d3365f93a4cf9c7e372a1459a4b0568654563925f732d04a87daaf0d96bb6c6cf56c5e0aeb64a77bd4fe99b7232f814ee5d4ce9c4b04cc56b4268c461d5c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd