Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1699s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2023, 17:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://intranet.tbpc-corp.com/NewPass.asp?acc=d2103c07dd8e07f3eaf646dcdfb7293f&ee=61819971185
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
1800 seconds
General
-
Target
https://intranet.tbpc-corp.com/NewPass.asp?acc=d2103c07dd8e07f3eaf646dcdfb7293f&ee=61819971185
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133432471170627596" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4072 chrome.exe 4072 chrome.exe 4720 chrome.exe 4720 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe Token: SeShutdownPrivilege 4072 chrome.exe Token: SeCreatePagefilePrivilege 4072 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe 4072 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4072 wrote to memory of 2440 4072 chrome.exe 45 PID 4072 wrote to memory of 2440 4072 chrome.exe 45 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 648 4072 chrome.exe 90 PID 4072 wrote to memory of 5064 4072 chrome.exe 91 PID 4072 wrote to memory of 5064 4072 chrome.exe 91 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92 PID 4072 wrote to memory of 1460 4072 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://intranet.tbpc-corp.com/NewPass.asp?acc=d2103c07dd8e07f3eaf646dcdfb7293f&ee=618199711851⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4072 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff856d39758,0x7ff856d39768,0x7ff856d397782⤵PID:2440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1888,i,644644302192695525,11594628220724688648,131072 /prefetch:22⤵PID:648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1888,i,644644302192695525,11594628220724688648,131072 /prefetch:82⤵PID:5064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1888,i,644644302192695525,11594628220724688648,131072 /prefetch:82⤵PID:1460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3164 --field-trial-handle=1888,i,644644302192695525,11594628220724688648,131072 /prefetch:12⤵PID:2292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1888,i,644644302192695525,11594628220724688648,131072 /prefetch:12⤵PID:984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4696 --field-trial-handle=1888,i,644644302192695525,11594628220724688648,131072 /prefetch:12⤵PID:3604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4740 --field-trial-handle=1888,i,644644302192695525,11594628220724688648,131072 /prefetch:82⤵PID:4268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1888,i,644644302192695525,11594628220724688648,131072 /prefetch:82⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2604 --field-trial-handle=1888,i,644644302192695525,11594628220724688648,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4720
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5498fb8b2b25dd9bb1cb77a97ff30dc7c
SHA192c6966cd3bfd8ca44c78c6789a28e86073709e2
SHA256f5b0a40b888ac464dd5b3282d491efb407c01559a1d4d3bc971bbe1928891b33
SHA51249d39a15d7932eb49e4313e46a791238e2504e7e8e8bd0b8e6b8761f4d802590e3810007a5e843a722a198db93afad8f09abea48a71ef0a371d8d8714ec33bdf
-
Filesize
538B
MD5affb85239699b7c88aebc86a007ff56d
SHA10b144c6226f6304618e0699ed17004234a0f9b15
SHA256043450899c549d75d8218004345a4d95087bf55388d4692372668db0b0010043
SHA512bb16f30d3b1bb120ebe699458ef40b5214dfcc33bfb37280cd68865286a4001fe4e09ee5cd8944c04bea3f7cdb62180168aeb567e729b85e37c532f34d6c2d9d
-
Filesize
6KB
MD51e6f00a7bf7c25f7007e440ec545c2a3
SHA1d2a643cf87b5f0f2b89744cca5a5793546b14b63
SHA2562b1813339475a2dbae6723c08470b958bbf2b335eed9d06ab09cb3c9e6a23097
SHA51221bf5fe0b81003411e3ac329494f1ad47f13d07759af37a2e9609b19f74a361353894abba8e9ee73a5d2c461abb6f55e9a1ce38494d96d428013ad83a694d7ac
-
Filesize
109KB
MD5f297803937656465bb71f1b2d83a026f
SHA141b66ee9f6486c843dbfe9f9a02b989b4cb4a668
SHA256119a45de10f22b8aa0ef904101e385b85b7bacd3018e81ca4d05dd52d1e02daa
SHA512005c1ecf10ffc1616ed3d6565682d287297b1d4a5449e134492e91e1aad30532ab6b643acace541acdb36333750f1fb038767746e411e484f9ecaed8809664f8
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd