Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-es -
resource tags
arch:x64arch:x86image:win10v2004-20231020-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
22/10/2023, 03:05
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://kms.teevee.asia
Resource
win10v2004-20231020-es
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
http://kms.teevee.asia
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133424175852887814" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1148 chrome.exe 1148 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe Token: SeShutdownPrivilege 1148 chrome.exe Token: SeCreatePagefilePrivilege 1148 chrome.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
pid Process 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe -
Suspicious use of SendNotifyMessage 26 IoCs
pid Process 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe 1148 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1148 wrote to memory of 3292 1148 chrome.exe 84 PID 1148 wrote to memory of 3292 1148 chrome.exe 84 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 3992 1148 chrome.exe 87 PID 1148 wrote to memory of 4028 1148 chrome.exe 88 PID 1148 wrote to memory of 4028 1148 chrome.exe 88 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89 PID 1148 wrote to memory of 2860 1148 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://kms.teevee.asia1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff33159758,0x7fff33159768,0x7fff331597782⤵PID:3292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1888,i,3693807626120963110,2682710498461682742,131072 /prefetch:22⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1888,i,3693807626120963110,2682710498461682742,131072 /prefetch:82⤵PID:4028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2256 --field-trial-handle=1888,i,3693807626120963110,2682710498461682742,131072 /prefetch:82⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1888,i,3693807626120963110,2682710498461682742,131072 /prefetch:12⤵PID:3464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1888,i,3693807626120963110,2682710498461682742,131072 /prefetch:12⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1888,i,3693807626120963110,2682710498461682742,131072 /prefetch:82⤵PID:2968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1888,i,3693807626120963110,2682710498461682742,131072 /prefetch:82⤵PID:1880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4584 --field-trial-handle=1888,i,3693807626120963110,2682710498461682742,131072 /prefetch:12⤵PID:968
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1972
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
537B
MD5a8699d833b12143fe479e425e9eec03b
SHA1faf5a0ae2c4f5855cae66f1a6404e11a1a0cd9ba
SHA2567c3370c7149dcad13f09f2df8b9805355cbf35f20ae53a10b16f14fdc50b15e1
SHA51252a0b73e5be9e2bb4fa0567d706cedeb1d4b16b50091a9ad5eeedb3aace156913c53e5916612242a132078b5e88d3de640fa51828ef20634bd51b5ddd7a8e95c
-
Filesize
6KB
MD59e29a9bc190a79897556231fd0a81842
SHA1a0e15cadcd10889ec1f75e2a3596c5acfc459095
SHA25614f7ef8d43923b9e0423e0abde9b9b01a67d3e98a258e24483c31337ce9e6370
SHA51282184a814b14a7c243a07a10f6bf977a4678edafb8211b0eafed828d2906ece58ca14c0d4ea4c0890e852f57da61af500b0e2f6573371f1a842bbd2ae1e14cc8
-
Filesize
6KB
MD5cb5560bdaa25c803545b753df15b6e82
SHA149e19f9e237d84a36c3a9617285b22a11df428de
SHA2569072b83762767e4435714b151345f35c9cde4fca6a6092ac0c9484c6d4dc0984
SHA5124a926f2f0269dd1188cbcb5c091d5db272f22641d8673e1b2f139cb8047cd73cad963be545a06fc65d56be3236fb6cd9fba20f31c06c56f6a606372e2e8bee25
-
Filesize
109KB
MD5f9ba903562f731e5679456a042f00c5b
SHA1225b7be0d694b53938a265bdb8499965f3edaa70
SHA256c5e936632c238dc5efe8a63d049d06467be6b059382c172edc6d02dfc9e8ab6f
SHA512b99cca74f523359b16a75c953c008a345e99d02550d7865112430f202b64d62340360d6ac96adedf8a0fe4bbbc1ffcfe9938b61b7a2486c9bbf03d036749b413
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd