Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
134s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
05/10/2023, 11:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://r20.rs6.net/tn.jsp
Resource
win10-20230915-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
https://r20.rs6.net/tn.jsp
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133409791385973592" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3960 chrome.exe 3960 chrome.exe 4008 chrome.exe 4008 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3960 chrome.exe 3960 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe Token: SeShutdownPrivilege 3960 chrome.exe Token: SeCreatePagefilePrivilege 3960 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe 3960 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3960 wrote to memory of 3400 3960 chrome.exe 70 PID 3960 wrote to memory of 3400 3960 chrome.exe 70 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4508 3960 chrome.exe 73 PID 3960 wrote to memory of 4128 3960 chrome.exe 72 PID 3960 wrote to memory of 4128 3960 chrome.exe 72 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74 PID 3960 wrote to memory of 1992 3960 chrome.exe 74
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://r20.rs6.net/tn.jsp1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe1fc89758,0x7ffe1fc89768,0x7ffe1fc897782⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 --field-trial-handle=1892,i,11156381941386070630,12223608712445457096,131072 /prefetch:82⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1892,i,11156381941386070630,12223608712445457096,131072 /prefetch:22⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2076 --field-trial-handle=1892,i,11156381941386070630,12223608712445457096,131072 /prefetch:82⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1892,i,11156381941386070630,12223608712445457096,131072 /prefetch:12⤵PID:4848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2832 --field-trial-handle=1892,i,11156381941386070630,12223608712445457096,131072 /prefetch:12⤵PID:3776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1892,i,11156381941386070630,12223608712445457096,131072 /prefetch:82⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1892,i,11156381941386070630,12223608712445457096,131072 /prefetch:82⤵PID:1168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4608 --field-trial-handle=1892,i,11156381941386070630,12223608712445457096,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4008
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:508
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5af800faf089309686d9581c7566a7882
SHA16071dcc72eff74a5cc754aa636b4a970819997ad
SHA256435e5ff71ca17df1d4941d8de6253a19de61288c13dfd993a7341653046d991c
SHA512d4f0fae1e28666e46b85f431a3ba5b1cce5eb0b8bb373c2c288f339f3be5c4e929d71c45ed961e768b9d71bb42d91bec6e99580a153012070cfe57c206d19cb7
-
Filesize
5KB
MD57c7292288c4660cec4bf87ba39af095f
SHA1a5cd492682d44fae62ba8ab1055be6189c5881e8
SHA256ed71f763ce7f245e6c5bac0da408492acbfd160c0aee31010d63a9bb7b8761cd
SHA5122f98652bb47cc49a87e824ca0c735368382cae355f78b0baf116ebe7a68dbe94160d6d552f24bb91d325deb31df6d6584a91594fe1e6b3a32db9de0696af0996
-
Filesize
6KB
MD5b8c70009abc6b3d2c011cb577c45320b
SHA1db4b58ed85ea798030dd8415c61cd06a704d77e8
SHA256a1747d36954fef96539f0e0288e3efcf150607728494076cd5ff61e3423ce114
SHA5128ad6a5056500d4c548d554b08f643c9fd80adaddb1b3711e8d354507130e19d34c2a7f412efdcfd6a29c526fd87b56a89564ed32e143179c590f0411cc75243b
-
Filesize
101KB
MD539207a43dd37951c9efbf2b4943ef83b
SHA174bb313096055e23de436e3d38f966e1f8390054
SHA256a16cce8f31119857eb0f89f20fe4f6188f97658cf13bfaa4c790d3923052388a
SHA512b2e8804babbd33b8470285ee90b400956941ff2c2e90db7bc4dfbb3a98a5db1d33c301f6520a099e1202ef9b79c191481c5f47ba8f8a26a870b3f1855e3843d9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd