Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
146s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2023, 12:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://vimeo.com/api/v2/video/610948281.json
Resource
win10v2004-20230915-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://vimeo.com/api/v2/video/610948281.json
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133419329798852231" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1236 chrome.exe 1236 chrome.exe 2276 chrome.exe 2276 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1236 chrome.exe 1236 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe Token: SeShutdownPrivilege 1236 chrome.exe Token: SeCreatePagefilePrivilege 1236 chrome.exe -
Suspicious use of FindShellTrayWindow 33 IoCs
pid Process 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe 1236 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1236 wrote to memory of 1072 1236 chrome.exe 82 PID 1236 wrote to memory of 1072 1236 chrome.exe 82 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 408 1236 chrome.exe 85 PID 1236 wrote to memory of 4120 1236 chrome.exe 86 PID 1236 wrote to memory of 4120 1236 chrome.exe 86 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87 PID 1236 wrote to memory of 4048 1236 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://vimeo.com/api/v2/video/610948281.json1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1236 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8edc9758,0x7ffe8edc9768,0x7ffe8edc97782⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1676 --field-trial-handle=1896,i,13586045203822047538,454209869397450671,131072 /prefetch:22⤵PID:408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 --field-trial-handle=1896,i,13586045203822047538,454209869397450671,131072 /prefetch:82⤵PID:4120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1896,i,13586045203822047538,454209869397450671,131072 /prefetch:82⤵PID:4048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3048 --field-trial-handle=1896,i,13586045203822047538,454209869397450671,131072 /prefetch:12⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3084 --field-trial-handle=1896,i,13586045203822047538,454209869397450671,131072 /prefetch:12⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4816 --field-trial-handle=1896,i,13586045203822047538,454209869397450671,131072 /prefetch:82⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 --field-trial-handle=1896,i,13586045203822047538,454209869397450671,131072 /prefetch:82⤵PID:4136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 --field-trial-handle=1896,i,13586045203822047538,454209869397450671,131072 /prefetch:82⤵PID:3440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=980 --field-trial-handle=1896,i,13586045203822047538,454209869397450671,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2276
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
823B
MD5300c889ccc9f82d839b252a9a58a9f4e
SHA1d38105e9ec875137400f62fd178fc6847ddab473
SHA256193c077b481ac49f6c0b5cffc6b33593efd902405667a78e555fe82af77b1972
SHA512528767cc73ddb8ff2d248e7e0b8361f9873b5409fd4337b6f4e507729cdcbf7a1ea668913a587af3959e93fbd0588614f4a40d731e4cd8af4caf21c8bb529c10
-
Filesize
6KB
MD5089b1b1a3bd8567c5b4590e305908b9f
SHA143f853d03552eb1f66e9c35580a64994b8885073
SHA256c4712e2eccfdab59edec313a06a58871a4200f8d37f4ebbbe1a18026d0681f4f
SHA51289dacf9bb74983a610485822ecd046f7982f3a5e1487578374777f2bd4d6206ca735c39f0bb5c08396f8972ddf123bd285c294f5b9e5f196f109b27345f09458
-
Filesize
101KB
MD53cc22c9c0a31b7961fe4d725cbc29e57
SHA1887887f2df1fe70c972f3f7dd229d3baa7d14d30
SHA2560431ed076d0d0ef9869bd81e71a9f661b5c862171c456c0c922f864ac1c92e76
SHA5127cad4a4044301d5128fc4f4a05696ba89e9e3961b2a6d569dbacba9e6f714aa35fd6445a8a57589cb746e00d5b55ad4733f4d40150755b1e278d6d91e8b11aed
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd