Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2023, 01:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://arraign.store/cl/1010_md/1/171/684/24/41422
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://arraign.store/cl/1010_md/1/171/684/24/41422
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133443127339721276" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4976 chrome.exe 4976 chrome.exe 1932 chrome.exe 1932 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4976 chrome.exe 4976 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe Token: SeShutdownPrivilege 4976 chrome.exe Token: SeCreatePagefilePrivilege 4976 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe 4976 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4976 wrote to memory of 980 4976 chrome.exe 24 PID 4976 wrote to memory of 980 4976 chrome.exe 24 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 3576 4976 chrome.exe 86 PID 4976 wrote to memory of 1516 4976 chrome.exe 88 PID 4976 wrote to memory of 1516 4976 chrome.exe 88 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87 PID 4976 wrote to memory of 4404 4976 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://arraign.store/cl/1010_md/1/171/684/24/414221⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c45c9758,0x7ff8c45c9768,0x7ff8c45c97782⤵PID:980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1880,i,14564039802754512497,16077330387077296258,131072 /prefetch:22⤵PID:3576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1880,i,14564039802754512497,16077330387077296258,131072 /prefetch:82⤵PID:4404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1880,i,14564039802754512497,16077330387077296258,131072 /prefetch:82⤵PID:1516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1880,i,14564039802754512497,16077330387077296258,131072 /prefetch:12⤵PID:780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2992 --field-trial-handle=1880,i,14564039802754512497,16077330387077296258,131072 /prefetch:12⤵PID:3848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5032 --field-trial-handle=1880,i,14564039802754512497,16077330387077296258,131072 /prefetch:82⤵PID:3260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 --field-trial-handle=1880,i,14564039802754512497,16077330387077296258,131072 /prefetch:82⤵PID:2708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3608 --field-trial-handle=1880,i,14564039802754512497,16077330387077296258,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1932
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3372
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5a96166b5b51a93425f5c516395ae8e18
SHA18db944a27d3a34385330fadac41aa1a0d90adf82
SHA256312e2fe9ebb073374e47646e51695b7f076e54ad890dfed77032773586903e6c
SHA51236d96b86e9bfd41fbf8583e8b0f33aefe42ac0623c3e069dcf16d503dcf45d8b18283b02b7e5b7ec8158eb971089567fea24e02756c5bebd598cab6fd46ff2e2
-
Filesize
5KB
MD5191e8b419bdbb16aaa1fbca15c1cf552
SHA1467acc5c4ecf09576e54f8aa7ccce89f845e25ee
SHA25671fdb91f777f4d6f706372a493cd503f198d706eb81bbdc01ace686436efcb4c
SHA51228a15e870c46cfecf6f7cf5fa5e87c8d6130192366f81ee4871f28b4a268019d53b709f677dd45920dec71767b5c368dde69d23e2bc3165054736e8c37c4d47e
-
Filesize
5KB
MD50601a480919f9ba7eca7ce7f36b02908
SHA109e1f4c6753347f7c3d2425ac294480968fab6fe
SHA256540c0b9e6935677e541c7f1fe3e54448b37802eda9193e63abf066add8d64576
SHA512a1221b7f8d3d884c264cb544bd6805bce164ad1cf91b39f51060976d0e3199807ddf282bbf4f1c28c8a30cfd054b596927fc1dd72de0b12fbd46046ae1608e91
-
Filesize
109KB
MD57ddfe2dc2f66c659f8fddd111c8841bc
SHA17c58ad67ed09a5e1b88ab7b328c1a9b26358cee5
SHA2560b8339b70e1605444d7643739fc75cc73ae6a071a17818144b90eea67208a52a
SHA5128b9646eb974b7f3a3d048fe284c12e02441e8c75974e118219bc94fb36bf821e314c9cb0cf8306ec71f03cec1bfa127e75b0004402ec9922c41b9b5e103ed841
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd