Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
24/10/2023, 14:36
231024-ryx5pafc97 724/10/2023, 14:32
231024-rwaxdade5w 724/10/2023, 14:24
231024-rqnw2sde2x 724/10/2023, 14:08
231024-rflc6sdd5y 1Analysis
-
max time kernel
36s -
max time network
37s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
24/10/2023, 14:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cutt.ly/3wWK64wn
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://cutt.ly/3wWK64wn
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4908 chrome.exe 4908 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe Token: SeShutdownPrivilege 4908 chrome.exe Token: SeCreatePagefilePrivilege 4908 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe 4908 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4908 wrote to memory of 3032 4908 chrome.exe 82 PID 4908 wrote to memory of 3032 4908 chrome.exe 82 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 3916 4908 chrome.exe 84 PID 4908 wrote to memory of 2044 4908 chrome.exe 85 PID 4908 wrote to memory of 2044 4908 chrome.exe 85 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86 PID 4908 wrote to memory of 1308 4908 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cutt.ly/3wWK64wn1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa13499758,0x7ffa13499768,0x7ffa134997782⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1880,i,11097183487739262341,4371586332187139801,131072 /prefetch:22⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1880,i,11097183487739262341,4371586332187139801,131072 /prefetch:82⤵PID:2044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1880,i,11097183487739262341,4371586332187139801,131072 /prefetch:82⤵PID:1308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3144 --field-trial-handle=1880,i,11097183487739262341,4371586332187139801,131072 /prefetch:12⤵PID:3252
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3168 --field-trial-handle=1880,i,11097183487739262341,4371586332187139801,131072 /prefetch:12⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4668 --field-trial-handle=1880,i,11097183487739262341,4371586332187139801,131072 /prefetch:12⤵PID:3204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1880,i,11097183487739262341,4371586332187139801,131072 /prefetch:82⤵PID:1232
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1880,i,11097183487739262341,4371586332187139801,131072 /prefetch:82⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
369B
MD5a32941918c721246bebdd7033b850e4a
SHA115d5a66a1bb029b242b85b4b22e37470f1a2af6a
SHA2561405d49f8d5c43b39a3d0c2e066ceb7934eec64c40688dfc444efc811468d469
SHA512d156f156adc9afe89aa290e7e2ab738648a3157177d1476a0e395a8e0b2b5404904f1d65ae8f3f6ae203bcf6757e1401d9ba8743fd5b0c6183ee9a26de7dbaf8
-
Filesize
5KB
MD5e2801a452b2f0fcc5d2ac5fb16eda844
SHA13f508b02f0f61ca8b0c062d11fe313d28176fa90
SHA2566af0ff9a4701f87068ad33c9801318f4edf37ff86935afaae00eae5a0dad8f86
SHA512724c0382bb7dd276b4519f45f336bc806d6da568ff4c8eba31d788193344b2fda31f5a8c082cbfe1c1a233eb3e82cfb217cf0a1952b7d108120a915e22ee9a26
-
Filesize
5KB
MD5709f9e6802e903cfa09db5eb03738fbb
SHA179dea9ebb8982e1f2fb51c08c4ed684d26acf5cf
SHA2563012f4257499521e062614e548f455c4688679a33c57103cacdf492385cc30a9
SHA512c6d191224eec21d7a85ec26f36a4a68b293021434c6efd1b192e3f28d0c64fa4464ec268191d246de7afe48efa1638a5c8b5167b69dc88ebfb82633f7cbd11ba
-
Filesize
109KB
MD5963dab8ea90a1f7b96dfec752bbece0e
SHA1d921933dcf93cf8bfbd1bb9a57399b5b19db4335
SHA256914d0bb09eafbe446b524394bbe11ea0a3304f8e524440aa6a3c9577015aab20
SHA512c37e72bd5f0ddaba1ff7b47ddac2126896f3e889c3d87787bc868fbb113e75329827d8b4483818cc5896ff9e053d1684a81ab14f57b6d1ddc9018380aa4dea07
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd