Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
09/10/2023, 12:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://tracking.vuelio.co.uk/tracking/click?d=iYSsJhZwWaBB7N4XVztXbjosCs1G0JdTZYRgQsRIb2C68rShCKPl5iDNapNSl_bOIKDaTiyc7V5oq_witGr-7RGO-4U8X2zdHZ6rJ8u9lQ9EfQvpzuew0t6ZIgYA95NgcBEken-ia6vq3LpfF7eZGyCSIlo17ucwAIgQoPztfFQgN0fdTkFxDZmneTzdOIC8zA2
Resource
win10v2004-20230915-en
General
-
Target
http://tracking.vuelio.co.uk/tracking/click?d=iYSsJhZwWaBB7N4XVztXbjosCs1G0JdTZYRgQsRIb2C68rShCKPl5iDNapNSl_bOIKDaTiyc7V5oq_witGr-7RGO-4U8X2zdHZ6rJ8u9lQ9EfQvpzuew0t6ZIgYA95NgcBEken-ia6vq3LpfF7eZGyCSIlo17ucwAIgQoPztfFQgN0fdTkFxDZmneTzdOIC8zA2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133413272421118170" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4300 chrome.exe 4300 chrome.exe 3068 chrome.exe 3068 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe Token: SeShutdownPrivilege 4300 chrome.exe Token: SeCreatePagefilePrivilege 4300 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe 4300 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4300 wrote to memory of 440 4300 chrome.exe 23 PID 4300 wrote to memory of 440 4300 chrome.exe 23 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 2532 4300 chrome.exe 88 PID 4300 wrote to memory of 4664 4300 chrome.exe 89 PID 4300 wrote to memory of 4664 4300 chrome.exe 89 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90 PID 4300 wrote to memory of 5004 4300 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tracking.vuelio.co.uk/tracking/click?d=iYSsJhZwWaBB7N4XVztXbjosCs1G0JdTZYRgQsRIb2C68rShCKPl5iDNapNSl_bOIKDaTiyc7V5oq_witGr-7RGO-4U8X2zdHZ6rJ8u9lQ9EfQvpzuew0t6ZIgYA95NgcBEken-ia6vq3LpfF7eZGyCSIlo17ucwAIgQoPztfFQgN0fdTkFxDZmneTzdOIC8zA21⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae56b9758,0x7ffae56b9768,0x7ffae56b97782⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1880,i,3491448360262975042,3620506698531758825,131072 /prefetch:22⤵PID:2532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1880,i,3491448360262975042,3620506698531758825,131072 /prefetch:82⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1880,i,3491448360262975042,3620506698531758825,131072 /prefetch:82⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2912 --field-trial-handle=1880,i,3491448360262975042,3620506698531758825,131072 /prefetch:12⤵PID:3248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2924 --field-trial-handle=1880,i,3491448360262975042,3620506698531758825,131072 /prefetch:12⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4416 --field-trial-handle=1880,i,3491448360262975042,3620506698531758825,131072 /prefetch:12⤵PID:1728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3896 --field-trial-handle=1880,i,3491448360262975042,3620506698531758825,131072 /prefetch:12⤵PID:1476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 --field-trial-handle=1880,i,3491448360262975042,3620506698531758825,131072 /prefetch:82⤵PID:1316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 --field-trial-handle=1880,i,3491448360262975042,3620506698531758825,131072 /prefetch:82⤵PID:2168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5148 --field-trial-handle=1880,i,3491448360262975042,3620506698531758825,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3068
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2512
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
960B
MD59f1701b5414202ede2224c63f3a73cd1
SHA12c351e943cf4b1b2255c58a2ca7c340febc12ecc
SHA25648306bf1fb0dc2e5d0161713220fac7bfcad0acdfa2737b46e0668c6525c94b3
SHA5129fc2430b9a2392cc6b10ac2d79306bc7cdc2e2003faf8e4a53be8c1bc6667794c7878945a82b769ee62ca8a4d4b27054576949da064fdc032674d3cba9fef805
-
Filesize
3KB
MD53f1b5de86119693513f00086ea806987
SHA157ea609d393b6445d771b1960cb68f6efc7e4a24
SHA256a3e2b482eb70cbc96da0618187319b9a28b3c9f4b117ac684aa7260820e19854
SHA512bd5eca342625b9e7356abb63b00c7cbf4b01d59111f028591d00565a2ca16a8f4a182f2a3d8ae7b132758e3d06fc4becc1a68cfeb8dbdb7ca55806764841df9b
-
Filesize
1KB
MD5604836e2e117a6e8da9922d4b33f209a
SHA1c9cd7b0f2ed152459ec8c140f6cc4cd6ad3c2734
SHA256e1120acda7c1501fd45ee0c018ccd3c5469579422d9416e257e7f0b1c637393d
SHA5124144916dd46365051793dcbfef35bb1583c39b0b4f8455a6b248cea67570f452442bc59be879a252c4e982c2a39809b781c669203fd57916f5f7387dcc0101d3
-
Filesize
1KB
MD547f0464792d8c0454c43abd9c3cffcad
SHA16a912ada787b19e31f463f85a470e05f20eadac3
SHA2565f4ec2b1cc4bdf89a4dde7976bd699e2250663ba6d9699ac641c32d6c5737030
SHA5126390c1214aa13fac76a5d3f65a12c52367a0b94e4299e73ac973bb9c67f8370a1b6bd0acd8367c3e3e920ddcfd312b522b63224fca304f966b9ea45ca759a409
-
Filesize
6KB
MD5c3d9848704745436d4005682da501110
SHA1970b9b80e0bfe5fb8691b226f22dcdf787c710ad
SHA2563976a47ba1160c4e651ebf17c9f1bdc9648ae750e51485280c567666dfdf647f
SHA51263967de77e3c1edb33fc2367ff4b3aaae23af381956c8fe7e07c188ac0f274910795dc166942dd80ac1e3203a7d0497b11e1bdf30ea327d98168e8cbc05cf3c9
-
Filesize
6KB
MD5961ffd96d0c81ff1962535af9821da04
SHA15c6b5f0b13f96626d44e95d830dfcbcfd467dad8
SHA2561c38fc3d460510d28e6219dedcc9f462d94ef99fe398d55614048400fcae4799
SHA5122f099c202a5c52e73fcb60bfbb4439bb6f35eff035b2b2113f8e1c34898f1a2c04019760db9b0e09850361bede671c2e4dd504a060880f9192ab8ed0c681c103
-
Filesize
101KB
MD5d7a3a6f514ea4fb5b06f963db040aeed
SHA10cc2c2bd2b645e0374d4ef54fad033fac92e41be
SHA2562cb71232cf5f688b789e1d3aaf50da7182fc4bb8d0ec51589621ddc92232d1b2
SHA5126c5dcbbfa10abf42fbe83a1be8f93308afd173036008ab30929090b7771052ab70ad2cc183aca8806a1c95e91b2465ca2e610265112015d4ea13a2a68d0541f2
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd