Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
204s -
max time network
215s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
12/10/2023, 18:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://qusbec.com/Financing
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://qusbec.com/Financing
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133416076821946823" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1204 chrome.exe 1204 chrome.exe 4860 chrome.exe 4860 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1204 chrome.exe 1204 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe Token: SeShutdownPrivilege 1204 chrome.exe Token: SeCreatePagefilePrivilege 1204 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe 1204 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1204 wrote to memory of 1472 1204 chrome.exe 48 PID 1204 wrote to memory of 1472 1204 chrome.exe 48 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 4456 1204 chrome.exe 86 PID 1204 wrote to memory of 3120 1204 chrome.exe 87 PID 1204 wrote to memory of 3120 1204 chrome.exe 87 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91 PID 1204 wrote to memory of 3240 1204 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://qusbec.com/Financing1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccd379758,0x7ffccd379768,0x7ffccd3797782⤵PID:1472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1900,i,5152670266333640501,13377437362434315683,131072 /prefetch:22⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1900,i,5152670266333640501,13377437362434315683,131072 /prefetch:82⤵PID:3120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1900,i,5152670266333640501,13377437362434315683,131072 /prefetch:12⤵PID:840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1900,i,5152670266333640501,13377437362434315683,131072 /prefetch:12⤵PID:1328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1900,i,5152670266333640501,13377437362434315683,131072 /prefetch:82⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 --field-trial-handle=1900,i,5152670266333640501,13377437362434315683,131072 /prefetch:82⤵PID:4576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 --field-trial-handle=1900,i,5152670266333640501,13377437362434315683,131072 /prefetch:82⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2968 --field-trial-handle=1900,i,5152670266333640501,13377437362434315683,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4860
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4520
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b3d2a5de0cf1e94083f4b67ea9ec951e
SHA17cb1d24cc839042e9cadc7f1f87514e3162ed4d3
SHA25692f1e78ef8656e5353927e05d8c7d9c928c188ced30386c0217c32730e0a6de4
SHA512913e843ddb179d425d9787943ab7b2f519604130fd1a9e625505c194a8082731140c3c5be174eb473688f129be219b93b15db21e5204c0d1ba6c4cd8769583c5
-
Filesize
6KB
MD50183646c287e78a4afb5a78d296c2ff5
SHA16c3235594506b47b7a56d47c90103ded9b818122
SHA256609804882a096525fc3d221d3f823d5d8304d20e19a6f262e86ff4f41aee2223
SHA51256ec7d52edf299baea02437c64def70bf694ff4de921602e95a392a3e4006859c37932a4cf84cf16426ba15397f21530c901f2955f254ce6cd53bb6ead4fda3d
-
Filesize
6KB
MD59e253cfb382a6cafaf6eba6399670269
SHA15c846e75ae1e1eb6ac1c1f81eb74fd450e4fdaff
SHA256ebbb7e7b442866c8fba9b6f3838fe2356aba0590dc19576c77e5f700b643c9e5
SHA512e09b4b55c09354ce02501748c7153899294e3d77b2bd83898ee68b71b7d4426edcceda704e9be79ef1ef31741f58f0bfc8c73837dd0487d73565e53b2e4315ca
-
Filesize
101KB
MD58ab957d4dff11af3b6085d355fc9f818
SHA19c26989e9b90467c7e013b0cfbe5a5c9a7a203d9
SHA2560f0d93b13c04e6c7b6dfa67d972f5943ddd5bac5ca0f3a2bf2c3637ac3abe525
SHA51202e03570d080bf82a4983e071d6076778b6623531d135a613f9ec1aca29271ee6e04fc7c814d92d9bf02bc227a866fed01c5a635d6cc42c8b26f4670159dacc3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd