Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
23/10/2023, 15:38
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://verdeparkresources.org/[email protected]
Resource
win10v2004-20231023-en
General
-
Target
https://verdeparkresources.org/[email protected]
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4220 chrome.exe 4220 chrome.exe 4584 chrome.exe 4584 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe Token: SeShutdownPrivilege 4220 chrome.exe Token: SeCreatePagefilePrivilege 4220 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe 4220 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4220 wrote to memory of 3292 4220 chrome.exe 82 PID 4220 wrote to memory of 3292 4220 chrome.exe 82 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 3744 4220 chrome.exe 84 PID 4220 wrote to memory of 2736 4220 chrome.exe 85 PID 4220 wrote to memory of 2736 4220 chrome.exe 85 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86 PID 4220 wrote to memory of 2472 4220 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://verdeparkresources.org/[email protected]1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4220 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc89289758,0x7ffc89289768,0x7ffc892897782⤵PID:3292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1880,i,3174109285942291625,10718378271099750904,131072 /prefetch:22⤵PID:3744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1880,i,3174109285942291625,10718378271099750904,131072 /prefetch:82⤵PID:2736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1880,i,3174109285942291625,10718378271099750904,131072 /prefetch:82⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=1664 --field-trial-handle=1880,i,3174109285942291625,10718378271099750904,131072 /prefetch:12⤵PID:3500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=1636 --field-trial-handle=1880,i,3174109285942291625,10718378271099750904,131072 /prefetch:12⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4472 --field-trial-handle=1880,i,3174109285942291625,10718378271099750904,131072 /prefetch:12⤵PID:1148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=1664 --field-trial-handle=1880,i,3174109285942291625,10718378271099750904,131072 /prefetch:12⤵PID:4004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=2984 --field-trial-handle=1880,i,3174109285942291625,10718378271099750904,131072 /prefetch:12⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5304 --field-trial-handle=1880,i,3174109285942291625,10718378271099750904,131072 /prefetch:82⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5360 --field-trial-handle=1880,i,3174109285942291625,10718378271099750904,131072 /prefetch:82⤵PID:3716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5104 --field-trial-handle=1880,i,3174109285942291625,10718378271099750904,131072 /prefetch:12⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2756 --field-trial-handle=1880,i,3174109285942291625,10718378271099750904,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4584
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD587b68709a2f085110c412f3803a02476
SHA19c39663f4542966531e9a137f13c4ffe9b910fbc
SHA25652327594e10dd4e49957a7f7ff586184a96cde8e16341ff5c5afa1be40b114ee
SHA5125d3486e35e0bb35f979bb2dc2f90a09af86a4b81778b19149b84e9528b872ab1db6d687f80f29da2a1e742255462b223795e40c523c92100ac0fb241ae83cf0e
-
Filesize
120B
MD512f580de2e68f8eb1fd4a65c08fa5c95
SHA1075452521751924e4c49149bcc9d11cc99909f4a
SHA256852223451610af681988467d3171c111f5b790bbf2fbc3c93c1dd63ac30d7cfd
SHA512a16c2a87c391247cc5af70ff23cba66febbdfe4a8b55fa11daca2bda619195dbc55679e7199530e794f6a0b7eed9791326e82d2b4a5b46b93ba4be1203bffc6f
-
Filesize
2KB
MD5ded85dc06ad4b4fec2add3fcfdcac9ff
SHA19180a5ad3ebf848957831fc7c07888bd3d0221a4
SHA256bbe84f747a50320f71e46039d4c64f63ed3b3a365d91235b06e14205fae4255f
SHA512a2e0970d1704ff7aa3eb7f00e698c26b3a650013df63593d35aed9b07cf866ef5bec27c6958b4fa5603efc76b3aca1f2a48402a87616c46986c9955edabad36d
-
Filesize
538B
MD54d6ac3a9b51b5ce55d392e6a88365a45
SHA15b6af9f9898f862ed900d4ca79a0e4de39c824a9
SHA25658bc45a5a9569605c461707746a1db4d4509f30e59dab22eb342d32f14ee0b9d
SHA51216770398bff66ac6a6666bbae10ac5a19c53db868e3d02b0aa137368cc2511f5f780e1cbfad3048268eaa37b200cdecf5c81c8c2e630fd7ab722923f28a10cce
-
Filesize
6KB
MD5456a845649975a9afdfbb81880d16d4c
SHA1297f3dfaf0f19fc51f3c835a2e4ebaef4475966a
SHA256b3a69070cc4bddcc8129e095e8104a78d28edfd848c92fab6a3ada5a880dcfcb
SHA51242fe392f62a6b10d07ca6eb72274e30e99a1b2666655ee2305453440c478ad25d00f6904bdd4c9757c73b2a8e1e11553bfc0ad5e67af5b2d9b708d732b32784b
-
Filesize
6KB
MD5014b935a6e655d05a054e186039107a6
SHA1eaa3781ed6e021ce5ca2bf57534071339d42d6f3
SHA25658d55902cc29d6468dfe064dd19643d7ee90cedf9a009f91246b6a755b998664
SHA512d14379411547ff90d8bffa54ab1bead99d45b9c2743536ce2cce48454fe7df9c9017c9197fe66e88e7b3f9892396c311919e404153cef393b37e39b376df23b1
-
Filesize
6KB
MD5d70aa9d478f58a351b37d6c3f29fd42e
SHA1aa8854bd768e145b9d4ed92997e6737afcc69727
SHA25600f14a5e3f368573aed967a0994ee5218c8cbf2af44b847d9510f292ce83b76a
SHA512a6d904fb09344194790ffb8d3b43e71523db236c5668165cf93b614e414ac5d279d4b6de954f770d6f564cf3f7f4c193dc2ae888758aafb28c5d322d0b650577
-
Filesize
109KB
MD51cb57b07237cd407e2f75a9956f620cb
SHA1a2fae8f31a7cf2521e00974bbed524dda983cbc6
SHA256b558ad01ecf179a8f88613053a226b0d0f4fedff08c2acd7ffcf97ca65812277
SHA5128c4e5253faa5a9c417d48ae3e203d954eaaebad94418825ad0c3f06b16b88c1d29916ce72d21016c2c65fdc9af5a80f53dc7787021927a80ee5d23f8fc54ef2a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd