Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2023, 06:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://autosupgov.cc/
Resource
win10v2004-20231023-en
General
-
Target
http://autosupgov.cc/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133432938555090432" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3344 chrome.exe 3344 chrome.exe 4252 chrome.exe 4252 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe Token: SeShutdownPrivilege 3344 chrome.exe Token: SeCreatePagefilePrivilege 3344 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe 3344 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3344 wrote to memory of 5092 3344 chrome.exe 33 PID 3344 wrote to memory of 5092 3344 chrome.exe 33 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 2944 3344 chrome.exe 86 PID 3344 wrote to memory of 4784 3344 chrome.exe 87 PID 3344 wrote to memory of 4784 3344 chrome.exe 87 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88 PID 3344 wrote to memory of 808 3344 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://autosupgov.cc/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3344 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd77539758,0x7ffd77539768,0x7ffd775397782⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:22⤵PID:2944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:82⤵PID:4784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:82⤵PID:808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:12⤵PID:1080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:12⤵PID:2632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4472 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:12⤵PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5068 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:12⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5056 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:12⤵PID:3580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:82⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:82⤵PID:2264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5348 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:12⤵PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3452 --field-trial-handle=1876,i,8314493469649482544,6292449096655954844,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4252
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD520c84c9ebd66b28a005a4dd3bac88511
SHA1280878917db74b00ca00767059b2f0cac60e7375
SHA256d2ca9cb0a0c44dab689ebcbb9684249ce5d0342ce833856cf91721aedd7fb379
SHA512b85f107b7b4aa45bb1545137f6ff7f2f5734b1aed4dbe071ace806984b43c626c63897314895f87449d5f02ffb75ea2dacc1845c82082fcacc4cd49d5d8224bb
-
Filesize
2KB
MD5e06b49f2d7c9d23e16787b35fc57e7ab
SHA169d64286b0ee65fd7fbc511bb59fe06cee0e8aca
SHA256db34843c8429cee60762a2b2e02935a4a5a21f4e63eb973036dc22b6b7407bda
SHA512030a19ee7e71de60631d1dde3252b72dd9b4b5317c71323f64c1555d93a05479d3ae351f71ad6e2511c23e9bc0263f62ef133f1844e77b522a7bfae4698ab609
-
Filesize
535B
MD5b6cfdb486b1f0846c57817d1df2b3db8
SHA10b919683babf1a9e42ca145205027944bb44a6bc
SHA2562dbc35bbee087fedbc69775f25056d611eea684454e2b199428e62b66cc28608
SHA512077bec898417d2f190c46f3d98dabf48563873951cd9cb9561813a2fec5ccaa447598c05b92039a3a7ea49679b2613a18ba432322d5c1c1cb2bb48882cd381b3
-
Filesize
5KB
MD5612a80acb806a9fd5ab3be6f0faacdd0
SHA1a0ba664248df8ed177b6944f9cf9db087026619c
SHA256b6f3c40924c67aa434a795397c9ea554c29383ecd54460da07ddae5f45cc3d16
SHA5122e49fa055e5bca7681dacdcc7a12bccc2b5ad7a7e82a3d3d2e2a5d8c7f46312a2bfbfe5872f89d5ec22eae343ea9bd1db068f438af5c64b394a8a4a8cbbaf3ab
-
Filesize
6KB
MD576215842aaf30d6c8fe5ccbc0d0bd16f
SHA138a1a3fc81a522c02b4812eb7d2fb1790a165f25
SHA25673e42f5a8d05fba2c4f53bc4790dfbf28b05d64e48e8c7a68c0057d82cc61ff6
SHA51247d3ef7d248685ca8fbc2b4439f9e1230dab4601c7e4f57e65ad51069fdb3fcb15a882d6d42026ba193543d1fef0a295c26c3368aea051f87729b3837fea353f
-
Filesize
5KB
MD588ff698670f1ed43c5df9844f4a4e773
SHA1b9289125416c0034f893c93cd4fcc4811ef7c9b8
SHA25611197c908d73b6a1dfdbc5cfbc49f5cfb72cffebb52d9f1ae77d2f6a7b94d9fe
SHA5126ad2e06afed59eb3a5441aad14053bdc3e7dc7c54b989dc5f451880ee840b733da9697be6940e6f5b41e105e7ea1997c1aa77a44533532b518906eeb14fcb436
-
Filesize
109KB
MD59ae9abf61dc6a772153230c92a78844c
SHA146bd4107057a50907c71ddebd9794e997a587cf4
SHA2564e75661a0736cb3fd71ad0d955b06ea797db83cdca2533f2ae2f8a90157b147e
SHA512b52029b934f31d136b4aaa625cf4a7f9067102cdb7236f63379f21a9401a9d4245fe694c5ee2b89e84aec1db412edceaca11afd61b65faad1f05afe6179f67c3
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd