Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 06:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://adeccosearch.tellwise.com/rest/v1/open/Q7bvrw2EBAA
Resource
win10v2004-20231020-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://adeccosearch.tellwise.com/rest/v1/open/Q7bvrw2EBAA
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133433817400721414" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1068 chrome.exe 1068 chrome.exe 1940 chrome.exe 1940 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1068 chrome.exe 1068 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe Token: SeShutdownPrivilege 1068 chrome.exe Token: SeCreatePagefilePrivilege 1068 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe 1068 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1068 wrote to memory of 4532 1068 chrome.exe 29 PID 1068 wrote to memory of 4532 1068 chrome.exe 29 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 1444 1068 chrome.exe 88 PID 1068 wrote to memory of 212 1068 chrome.exe 89 PID 1068 wrote to memory of 212 1068 chrome.exe 89 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90 PID 1068 wrote to memory of 1304 1068 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://adeccosearch.tellwise.com/rest/v1/open/Q7bvrw2EBAA1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff8e409758,0x7fff8e409768,0x7fff8e4097782⤵PID:4532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1864,i,10378490394509912763,1491420391632656552,131072 /prefetch:22⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1864,i,10378490394509912763,1491420391632656552,131072 /prefetch:82⤵PID:212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1864,i,10378490394509912763,1491420391632656552,131072 /prefetch:82⤵PID:1304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1864,i,10378490394509912763,1491420391632656552,131072 /prefetch:12⤵PID:208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1864,i,10378490394509912763,1491420391632656552,131072 /prefetch:12⤵PID:3088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1864,i,10378490394509912763,1491420391632656552,131072 /prefetch:82⤵PID:4348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1864,i,10378490394509912763,1491420391632656552,131072 /prefetch:82⤵PID:4520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2352 --field-trial-handle=1864,i,10378490394509912763,1491420391632656552,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1940
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3664
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD52f0fdf1f9e8e6d862f5de91b775a3d50
SHA10e000623dd5021c458e67fbeddec2c39eccc0607
SHA256e890533f2750493e10ce89809b34e58cfbaafab82a8d23fa57ae06896675f3bc
SHA512e524ddfcc7de152a0e9958d801564005ea7fd0d124755949779165793862c87929bab7ae30cb2a5cc2f7de513e8257f719b09093ba416c472785d342ac14e587
-
Filesize
1KB
MD5c17d78cc03e019429f7cca017e3ef0e6
SHA12eba2193a3685017c4510f4cab1d4fc63269ce45
SHA256e41d973e31df8b17abafeec112a0c4f2d5c27fc7d49c905e3c47c92b5ca585fd
SHA51278464096f596d3cf791caa591dd6bc08d414808d99e874579c656aa5a84ad6d7246389f033a505b94c72cbd3e57636650f0fb1885dafd020aa6485e4dd515f20
-
Filesize
706B
MD5e42c782f2e1a61441ada6ecf3a432030
SHA13f942bdc268da864ff276e8e8f89048b5aa18a82
SHA256b7c16f9928f48280a748a656db1e0855b85ee588568f64b4d1d2b50158074146
SHA5122e4098bb95280a9c730644e085faf65a5a92ebdddc90114adc151c4e645fde7056589ef06572de5c02072ad54b8993739f94eb175eb7ebde155d30db718dd5e6
-
Filesize
6KB
MD52ab860022ea227c663bbabc73dd29e81
SHA1d214b59eeb95d1d57548b390bb37d56ac00099c5
SHA256adf3c8f50f063ebcc7777ddf93e3e6309e4f6489372a384f7b9fd86dc82511f5
SHA5123b727b507da5703df653c037eab7f1bc5f249f22f648098ccd9f4b115dd6c155b3746b52b2f1caa3b78c3d5075b10706d50ee1dc88e3dc6527e75656c7a90b4e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd