Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
173s -
max time network
179s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
02/11/2023, 17:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.virustotal.com/gui/file/38c88eddfbc88ce8efd34e16c9fc9008ac20b066925c31ef04f78979e966d762
Resource
win10v2004-20231020-en
General
-
Target
https://www.virustotal.com/gui/file/38c88eddfbc88ce8efd34e16c9fc9008ac20b066925c31ef04f78979e966d762
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133434215547644169" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3632 chrome.exe 3632 chrome.exe 2204 chrome.exe 2204 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe Token: SeShutdownPrivilege 3632 chrome.exe Token: SeCreatePagefilePrivilege 3632 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe 3632 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3632 wrote to memory of 2688 3632 chrome.exe 31 PID 3632 wrote to memory of 2688 3632 chrome.exe 31 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 4464 3632 chrome.exe 89 PID 3632 wrote to memory of 3700 3632 chrome.exe 93 PID 3632 wrote to memory of 3700 3632 chrome.exe 93 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90 PID 3632 wrote to memory of 1508 3632 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.virustotal.com/gui/file/38c88eddfbc88ce8efd34e16c9fc9008ac20b066925c31ef04f78979e966d7621⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf2799758,0x7ffdf2799768,0x7ffdf27997782⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:22⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:82⤵PID:1508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:12⤵PID:840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3040 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:12⤵PID:2496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:82⤵PID:3700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4776 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:82⤵PID:3084
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5568 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:12⤵PID:1620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5800 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:82⤵PID:2476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4988 --field-trial-handle=1948,i,1592364790378965437,6551080639492660085,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2204
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
MD5990324ce59f0281c7b36fb9889e8887f
SHA135abc926cbea649385d104b1fd2963055454bf27
SHA25667bcedd3040fc55d968bbe21df05c02b731181541aff4ae72b9205300a4a3ecc
SHA51231e83da1ac217d25be6e7f35a041881b926f731fff69db6f144e4fe99b696a31f9ab7766ca22cf5a482743c2a2d00a699ca2c2d67837a86c471a2dd3bed9ea1f
-
Filesize
1KB
MD57e1290cb433b39a96bd7fe080276a473
SHA16bcf16708ae26d54bb6bba148d0c55ddc2b71d46
SHA256e37765a631632474e1370b13c3a5e93e156bfa03e84c99d60fae933c663cfb91
SHA512d9ba8e3796da042383caf32babee58fa7a594cf96f124d65e5cc24ffc506fad496920b5057c9ba86fbb9ba05f7ee25bc7ffcfce53ad939f5c3236dacd081237f
-
Filesize
3KB
MD529e2243d0e1b27792adfe63f6ae0019b
SHA197c0d694ccaa9a861c4c3383400be37c99f12175
SHA25680faaa16943e63d1c30fc5899bfd065b782fa3c20069c54f386c80be07e06e01
SHA512000bac8a7cad220033151a0166b6e0262f92c1e0761fc7dffe4c1c971e0e1621ca816f8f219d2ea69bcff04a731ceb0ce8dc0470e13b0c270b827903e3341e6b
-
Filesize
873B
MD5a199fe9642c1ed0c640473c591326e9c
SHA14d970bb771b9eef741d8db5b328334046b74eb6a
SHA256f9c6965ed10c893f05c4ca53bca24266275ceebe6a87e14d2a3f2ce6830a0591
SHA512b0e3d7cdefa53517a12ba592d8b44d517da10b7f42fdf23e1da166afbdb4def26a87b72a5157eb5164a9c6252eb9b70523b9415ad415d31c28c1fb64b35b898e
-
Filesize
6KB
MD54592060a1b5dc80ef278b0c61b7bdf15
SHA1df7fd7e370d61a5727061731ae4c13b42a713888
SHA2568a0c5ead2a1e56a1d30df148785273a8e3446728061a03c874fec959394596ec
SHA512de55e77ab70854cb07d1f1d1ba58c4c65a7d466a4d2140e18e140bc3424349ae3d05ad804e28fb6921e686201063ab4c8b6645b4d0ca4f05fb05a646d29f2703
-
Filesize
6KB
MD5582d3438f23d0241a90afdce3a2fb4b3
SHA17a73cd343345f0a7c57fced1568365b88d2169f3
SHA2561f115e7d896f03196e39adc682d415e8f15a7ffe673e3e6aa28409f15803f95e
SHA5121566b52dad5511f8c45597f5907634892b71f61bc6b5c315bff38ab852e4c9c91fc300bbde86ee12f4907c0725e0976f63be70915bd8f17ff0dd048d52554374
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5dce1c862fbbba61942b96db5378c5ca7
SHA1e8575c0089294e4e5a929c09f09dbbbb4988967b
SHA2567c149849a9af3ecb38da5f64dfe67db7783dc7a1d6535e1ab601cc72b45d6b0b
SHA512b96db5c69b60e172fa5d938ce2251469543bb5320bf0757fcc6c06c75c5f4352b8031de03fec5b71031043ac286aba0fd0a6af88ff991427bb5bfdb63964953b
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58be69.TMP
Filesize48B
MD50bcd4d0ae11d973f13a5d0f9f7756e45
SHA1fb27dd6899e10c3a807a72d4a43016129f870528
SHA256975217bd0e4c7c051741376e119609081ee8fa707e71585e6d61414034fe804c
SHA5121bbfc8a28694e4803c3069d1c576789f7ea484288a327205e84adfebbbe3479f840814dad25f8f7355f6f2ba12c3f4c1ae709a2a100dbc9f8dae334e4f56401d
-
Filesize
109KB
MD5edc2b65b07c9065c0bd7b04b747a17dc
SHA135408dd6919d43ed6e05654c6cb08a321e205182
SHA256b8c5285e96399dcbce142d822365721160a071fc1d82041ba6a38c343c94a283
SHA512d456180e52037c5269d8106bb85fd5c6f12e6aa54b0db713f31187df852ed7bf26cdd4564d30ca996dbd48dd857f4fcf37c26e1deeb885e960d8971558c616af
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd