Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
111s -
max time network
125s -
platform
windows10-1703_x64 -
resource
win10-20230915-en -
resource tags
arch:x64arch:x86image:win10-20230915-enlocale:en-usos:windows10-1703-x64system -
submitted
11/10/2023, 15:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.pointclickcare2/training.reliaslearning.com
Resource
win10-20230915-en
General
-
Target
http://www.pointclickcare2/training.reliaslearning.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133415113658624970" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3264 chrome.exe 3264 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe Token: SeShutdownPrivilege 3264 chrome.exe Token: SeCreatePagefilePrivilege 3264 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe 3264 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3264 wrote to memory of 4328 3264 chrome.exe 34 PID 3264 wrote to memory of 4328 3264 chrome.exe 34 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 3432 3264 chrome.exe 76 PID 3264 wrote to memory of 4156 3264 chrome.exe 72 PID 3264 wrote to memory of 4156 3264 chrome.exe 72 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73 PID 3264 wrote to memory of 4344 3264 chrome.exe 73
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.pointclickcare2/training.reliaslearning.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3264 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb72f69758,0x7ffb72f69768,0x7ffb72f697782⤵PID:4328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:82⤵PID:4156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2080 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:82⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2604 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:12⤵PID:912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2596 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:12⤵PID:784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1616 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:22⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3644 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:12⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2984 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:12⤵PID:4792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3820 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:12⤵PID:3584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4216 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:82⤵PID:4244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4184 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:82⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3760 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:12⤵PID:4200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4496 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:12⤵PID:4136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3924 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:12⤵PID:2608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4556 --field-trial-handle=1696,i,13437040419304672422,17610841085786384121,131072 /prefetch:12⤵PID:3984
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD535a307cd5669636ba865d74811ec35cd
SHA198da1d1e95695ff2cd7a9d4a90296ace1cdfb2d1
SHA256d703ea1c4eb22575aef3a776d22be21b0bf63f0a66f8325182a2fdc56db24a77
SHA512f2b626678eac1d1c6a0652b4fd2436e42ebc2e740793d487820fdd78dfe47611e6b5464c478194ea4709246fc8147c6649cb177a8f3d2a2fe6c652d2b663c77a
-
Filesize
5KB
MD5c2cd01c55aaf49b8fa0faca42c571580
SHA1ccffef25e765d627d43f126dfd7e898f33e82003
SHA256e3d97af9f686c07008279247ac493b041c40ea8c6581f648e040ed6d38142dbd
SHA5127c89210e1ca6111a05fc1ddbd9bfeb8f2e12e688918e607b1ec83d1e2b333e67b15899ac49e979d3d6110810bcb9cd1aabbbc109def3f627cbaf264b563f83b0
-
Filesize
5KB
MD52178aa921484dff924504ecfd4d40e9c
SHA1b24df5f1891bc042d057323bd2a98511681f7313
SHA2564b496470135b99dd12638835ceb2bddc544684e13ecb668d56d710492a9846b3
SHA5126cda7db81a857d8ec7bb35b2c2595296bdd1a0978be617f8eba61f6e97d4c6e42ec6e37cde92548488219ab575041a7cfa6fd8d077698341224cface1f6c8f01
-
Filesize
101KB
MD5e4230d81019e8b2730a6181ae1517822
SHA135a50c3f5500ae4c23c4d596d43e9136f31c91ee
SHA256897b0ae6b33cb51bb4c5a7aac9add56296052d91bd5fd30a71fe54d6658c0d07
SHA512917c695ac4287d1cdda67ba268ffeb8ddf3f97ab1a02f3c392d7db50bcc739bd53b8f218a6480bc7b885bd7b610765cb4381aff1fc1f5882a9315fd7ad4f3023
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd