Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
609s -
max time network
500s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
07/11/2023, 20:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://r20.rs6.net/tn.jsp?f=001KOFgqL76TPoDYnKrclTnM70xE8KSzrAnyGfOsbxdhoowfEmuW4YXsc89mc0vKt1s5o_2p6HmZxMdUAQI3Z29mavE7oIw8XATcT4K1m3WG7y7BLA9p5LHmfHxvU1vMGW6eDN_2e3huUc=
Resource
win10v2004-20231025-en
windows10-2004-x64
9 signatures
600 seconds
General
-
Target
http://r20.rs6.net/tn.jsp?f=001KOFgqL76TPoDYnKrclTnM70xE8KSzrAnyGfOsbxdhoowfEmuW4YXsc89mc0vKt1s5o_2p6HmZxMdUAQI3Z29mavE7oIw8XATcT4K1m3WG7y7BLA9p5LHmfHxvU1vMGW6eDN_2e3huUc=
Score
6/10
Malware Config
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 61 api.ipify.org 62 api.ipify.org -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133438643634464875" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4364 chrome.exe 4364 chrome.exe 5108 chrome.exe 5108 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4364 wrote to memory of 4892 4364 chrome.exe 86 PID 4364 wrote to memory of 4892 4364 chrome.exe 86 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3812 4364 chrome.exe 90 PID 4364 wrote to memory of 3360 4364 chrome.exe 92 PID 4364 wrote to memory of 3360 4364 chrome.exe 92 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91 PID 4364 wrote to memory of 4024 4364 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://r20.rs6.net/tn.jsp?f=001KOFgqL76TPoDYnKrclTnM70xE8KSzrAnyGfOsbxdhoowfEmuW4YXsc89mc0vKt1s5o_2p6HmZxMdUAQI3Z29mavE7oIw8XATcT4K1m3WG7y7BLA9p5LHmfHxvU1vMGW6eDN_2e3huUc=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff91c0e9758,0x7ff91c0e9768,0x7ff91c0e97782⤵PID:4892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1760 --field-trial-handle=1880,i,3490390880931906633,3469239933128072834,131072 /prefetch:22⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1880,i,3490390880931906633,3469239933128072834,131072 /prefetch:82⤵PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1880,i,3490390880931906633,3469239933128072834,131072 /prefetch:82⤵PID:3360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3008 --field-trial-handle=1880,i,3490390880931906633,3469239933128072834,131072 /prefetch:12⤵PID:3756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1880,i,3490390880931906633,3469239933128072834,131072 /prefetch:12⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4856 --field-trial-handle=1880,i,3490390880931906633,3469239933128072834,131072 /prefetch:12⤵PID:4196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4988 --field-trial-handle=1880,i,3490390880931906633,3469239933128072834,131072 /prefetch:12⤵PID:2260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1880,i,3490390880931906633,3469239933128072834,131072 /prefetch:82⤵PID:2076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 --field-trial-handle=1880,i,3490390880931906633,3469239933128072834,131072 /prefetch:82⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 --field-trial-handle=1880,i,3490390880931906633,3469239933128072834,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5108
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2728
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD57cc9763e73de2386f94d165847bf81ae
SHA14344b1672565ea6aab6bd5c2707a77e36050e1f4
SHA25684a67a6df5e8ea1a7af3fe53f30dce782994e6a9d77e65759847f3817e13bf1a
SHA5122d11d79575de1af9343664406f40e3d1b1e59ac8897af570d93971ae67fd23ecd34241fc32b5f8e3d59faeccd9b0223c43edba32d2fb7d0cc22e8beab16e9315
-
Filesize
2KB
MD58c851f27c2b6985b66b3cdc7c05e6312
SHA18b9ec4c3470e524178c4d6111a83c24b163ca5fc
SHA2566c88098ae3405bff23c4e3c20f2298273b7c8d4055b145081d6fdb03bc56677e
SHA51236ea55a4ce8915c512a353741ed6d405d131cacbfa18ea8f956c66a6fcd232e5b43b6c9bf88bea755d63b0d359233d02ef7a886c880ecc3fea50d744e8e71cd4
-
Filesize
1KB
MD5f2351b03614e931b7843eab3643cf54f
SHA1d0dc02dd392a82598e55b6a884bc9ae5dd49bf11
SHA256be3e7e107256d378c25c14ad58ad39920ae80fb6702b8e2d88cc4699a7628c3b
SHA512561e45553fe55dea1f3db8f937a9800168b11bc6e732ebd84106e0e8752f2f951ab58bfa1e71a289e196aad532a8179bc33af9ce909823b6e19c4498e3272c75
-
Filesize
538B
MD5c01d21ace4d68753b933a61c63067c6b
SHA1a07c16811478254676d87635507ba134c5b84bb2
SHA2562a4a5985516081413203cc49e8092c8d482ab7c2e41766c2cd08ea7862ab319e
SHA512963426aa6b09a28781d36c20199dcbe6bdbe2db2a6bdd02bbaba9cc9d8f69f7d795ef1467fd4055a2c1c1800a906df81e7eb37f4cb89d15f0e6178a9078acd35
-
Filesize
6KB
MD5c123db13b58771adddcc4ee38c9edfab
SHA117f373b917d94fd980d941b602b0adc368f057d9
SHA2563fb0d37662ee4ed47f0a743082a49c02060c2571418b2cd2d016d0d4454bda12
SHA5128fc6c0470a1b24c27a1bac13ed3c5ecc0df2d7999038f3652cd31e30f156156ff9a276d8f4df0a47c8e5939365a3cba5bb2de6fdf34c34f590d9a8a8a1710f01
-
Filesize
109KB
MD5884018a6711656bedf250183e0ee9cb5
SHA1bbb8e23c5cdea3edca18b22a1bd8f523489c4e35
SHA25613fe2ee1da521abfb7e0dd283168f6f92f8661d98a1d479ca98a5e5287f21f06
SHA5129be5e32b8ccc1d26fc402a5231d6d2b44426438cc30fdf89c4804fe984bd52e85572c6ac98a1ffd59d50e95268de56d51d0ec5eaa20478d3c9758edf29239ef5
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd