Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
74s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2023, 18:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://avsvmcloud.com
Resource
win10v2004-20230915-en
General
-
Target
http://avsvmcloud.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133408327008260681" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3332 chrome.exe 3332 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe Token: SeShutdownPrivilege 3332 chrome.exe Token: SeCreatePagefilePrivilege 3332 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe 3332 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3332 wrote to memory of 3408 3332 chrome.exe 45 PID 3332 wrote to memory of 3408 3332 chrome.exe 45 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4004 3332 chrome.exe 87 PID 3332 wrote to memory of 4532 3332 chrome.exe 88 PID 3332 wrote to memory of 4532 3332 chrome.exe 88 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89 PID 3332 wrote to memory of 3644 3332 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://avsvmcloud.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3332 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe34b89758,0x7ffe34b89768,0x7ffe34b897782⤵PID:3408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1800,i,13616313286615240135,17661194228642673974,131072 /prefetch:22⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1800,i,13616313286615240135,17661194228642673974,131072 /prefetch:82⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1800,i,13616313286615240135,17661194228642673974,131072 /prefetch:82⤵PID:3644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2844 --field-trial-handle=1800,i,13616313286615240135,17661194228642673974,131072 /prefetch:12⤵PID:3396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2836 --field-trial-handle=1800,i,13616313286615240135,17661194228642673974,131072 /prefetch:12⤵PID:2576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1800,i,13616313286615240135,17661194228642673974,131072 /prefetch:82⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1800,i,13616313286615240135,17661194228642673974,131072 /prefetch:82⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5068 --field-trial-handle=1800,i,13616313286615240135,17661194228642673974,131072 /prefetch:12⤵PID:1312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3116 --field-trial-handle=1800,i,13616313286615240135,17661194228642673974,131072 /prefetch:12⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3816 --field-trial-handle=1800,i,13616313286615240135,17661194228642673974,131072 /prefetch:12⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3796 --field-trial-handle=1800,i,13616313286615240135,17661194228642673974,131072 /prefetch:12⤵PID:2108
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4084
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d960a86980593069fd9e589133bee1ed
SHA17b225d91b72abf400b04c83b2d1103a46207a99d
SHA2562dd17b80a1e6aed698448807c9e0f1b039c73867942d0798dbd5504615ba6cd9
SHA51287132e26323bbd49c72d20e6e13823f04ae00c875c1680a729c97955a789c3b031566259dfc7d98123060c9efa89a12e90dd43b9aa1f57c94d75de001b856a6b
-
Filesize
6KB
MD522864dd08ab9aebd10a0dd22ad2759e6
SHA1b9e24484be7ec4ba78583f65f0074b39783d4e5e
SHA256b74ac93f3b978ef33bd297c69ce0812c6dd4c950f9cd8f96c596bf4ca2207df9
SHA512058a17bf277404ec0b5c4272dc0de0a95dea03b4f2c2579b563eb52b4c19e872bbc41751b83638e1e5970c3167a8c845bc67f3df097c53b44c70302d3eb78863
-
Filesize
6KB
MD5db26e33dfd66b925ac109e794939a939
SHA1259a7af612e4c76b18ead0599d5a83cc36be4d18
SHA256cef2129fa0d7cf9da2482b9ba123bdbd90dbeabd24609b588fc727d98b8e63f3
SHA512ad96570a077b9c6c0a7d7b63d8509b9f5b66d58050864cfb18d1bb6bfdfb8b3a780511887ce1931ca5540a296dc7786b88df314289d52cab8a83fb9fda478a00
-
Filesize
101KB
MD5816637d8a513784c92f478392982f87a
SHA1d44b08bdf93b05354b995e9845e6c2567bf1580f
SHA256c2d6631698d284644bec9030a6188637de843f15bda0e7796ad17a5335137879
SHA5121b379ac00f3969490cc1ec2eb6e598a8480090325d141a140a82c616baf1e909d310f5a6c261a4e6701edb0486f772bf95980b1b201d778a2612cbe3ae62b11b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd