Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
75s -
max time network
75s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
12/11/2023, 06:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://tx.gl/r/fyo3o/
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
600 seconds
General
-
Target
http://tx.gl/r/fyo3o/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133442460126496618" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2172 chrome.exe 2172 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe Token: SeShutdownPrivilege 2172 chrome.exe Token: SeCreatePagefilePrivilege 2172 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe 2172 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2172 wrote to memory of 388 2172 chrome.exe 87 PID 2172 wrote to memory of 388 2172 chrome.exe 87 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4092 2172 chrome.exe 89 PID 2172 wrote to memory of 4284 2172 chrome.exe 90 PID 2172 wrote to memory of 4284 2172 chrome.exe 90 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91 PID 2172 wrote to memory of 3704 2172 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://tx.gl/r/fyo3o/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8b5c9758,0x7ffd8b5c9768,0x7ffd8b5c97782⤵PID:388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1832,i,12077688870607742485,16011987395999781438,131072 /prefetch:22⤵PID:4092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1832,i,12077688870607742485,16011987395999781438,131072 /prefetch:82⤵PID:4284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1832,i,12077688870607742485,16011987395999781438,131072 /prefetch:82⤵PID:3704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1832,i,12077688870607742485,16011987395999781438,131072 /prefetch:12⤵PID:3756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1832,i,12077688870607742485,16011987395999781438,131072 /prefetch:12⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3900 --field-trial-handle=1832,i,12077688870607742485,16011987395999781438,131072 /prefetch:12⤵PID:3736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4660 --field-trial-handle=1832,i,12077688870607742485,16011987395999781438,131072 /prefetch:12⤵PID:876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --pdf-renderer --lang=en-US --js-flags=--jitless --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4712 --field-trial-handle=1832,i,12077688870607742485,16011987395999781438,131072 /prefetch:12⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1832,i,12077688870607742485,16011987395999781438,131072 /prefetch:82⤵PID:4940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5288 --field-trial-handle=1832,i,12077688870607742485,16011987395999781438,131072 /prefetch:82⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5004
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5891bfb1dfbdf125bd8bcf4ca323ff029
SHA18fa0e163167229c5fecad70625f7219b753eb7f9
SHA256de4ee281e3097dc8a47b1458ecdf12ebf6dd9ff1da73669875ca1e88d1a4c502
SHA512d4c4765b4af6e0fa1bea0a09dbdeed15775141f06a68ecbb731b684afb5cd55c63ccaea1b3b19f1de6eaedb2e19458708c9f5bd621d142359eacf3170e0e1e55
-
Filesize
5KB
MD541b45143eec01798b8f2dd484c61ee52
SHA1ce1fe0ad23f02632a8076ace2c7902727fe4d82d
SHA256ab9d569d8ebfcdc7e3ef4f58387859a06a55246fec3bdbc8053107aa424beabe
SHA51202f077995bfe8cc0965b8b31745cd298a3edd082415f243e9a3a3daff11af29326aa269a8316a30ddc9d659cfab70c9699810afa0a910d0f9f1235f29f8eb987
-
Filesize
6KB
MD57f8c212277f208750390b60bacc723f6
SHA1b2f865b042b29f81879042e04bf0dd6875bbca06
SHA25631313ddb34251bb79cc87a13e9889e210db0af4e6288c8f48e134a3bba82944b
SHA51291e64a7d08290fb7ed32b15783d0861761aa8f8e0e4bc86839f1d72fe5aa780ed269a24c67b0e4c1f1f6946c6823554275fdf7f959d9e09828dc38514b7e3907
-
Filesize
109KB
MD50b63dbc65aa21a8212d6053b657cddc3
SHA176589e655aad21f158588f556c24c6eef9e5ffd1
SHA256d436d6b82ee00eb671114eb005963df46aea6a320ab08597eff7315c6edd9a33
SHA5126e189252752cd20bad2ebd0b4bb32e9ad6cc0f4f4087819d0e3c2886954a85a8322c99d18ab46e896637ee5cb740fca7c9021c763a87e493f1753cda5cbda729
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd