Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1690s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
13/11/2023, 06:48
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://h
Resource
win10v2004-20231020-en
General
-
Target
http://h
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133443318067570991" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3376 chrome.exe 3376 chrome.exe 404 chrome.exe 404 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe Token: SeShutdownPrivilege 3376 chrome.exe Token: SeCreatePagefilePrivilege 3376 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe 3376 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3376 wrote to memory of 4820 3376 chrome.exe 32 PID 3376 wrote to memory of 4820 3376 chrome.exe 32 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2088 3376 chrome.exe 88 PID 3376 wrote to memory of 2692 3376 chrome.exe 89 PID 3376 wrote to memory of 2692 3376 chrome.exe 89 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90 PID 3376 wrote to memory of 3200 3376 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://h1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3376 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdd379758,0x7fffdd379768,0x7fffdd3797782⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:22⤵PID:2088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:82⤵PID:2692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:82⤵PID:3200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2888 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:12⤵PID:896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:12⤵PID:2804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4632 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:12⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3136 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:12⤵PID:3296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3760 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:82⤵PID:3000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:82⤵PID:788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4860 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:12⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3720 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:12⤵PID:4508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1612 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:12⤵PID:4904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2704 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=5308 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:12⤵PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=5800 --field-trial-handle=1868,i,5903687596991832808,13612798042755866021,131072 /prefetch:12⤵PID:2308
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD50c939fb189064a579b3d675dcd182b57
SHA166aef8ba1270a937e67eb8320fb5e4636afc59fb
SHA256ae16a01bdf9b150f00d54ad6975ce5126d1bc6a3864b0eb563e31f58518b9af2
SHA5124dd3cc867e4ecbcfd61febab95ddad62392579d951733532bcf00a6f335babedc1fd63e60664d7b7bede80bed8a795f4ede2a61d137a89c33d51de6acc1ed3ca
-
Filesize
6KB
MD58c9be2f47c25c1250979eb68a31fed02
SHA1c34ada7e24228b94205e1565bb0159165f6e93e1
SHA2569f0a1028fda2f765a38ed4c9a8448c413c54660df492d9655d7ba042294b2ec3
SHA512c11ad1cda384d28a3deae58eb6e9694205cc1609e0d0d0a502771a421a37900017a7e4ebd2a1cda761363b2bef94971bfa456eedc207316afb531cc0be81de40
-
Filesize
6KB
MD5a8709071b012fbee9e14efa1c734ff02
SHA186d1a441430f11ec90925b95a689d103ece2bae8
SHA256741c14caa478a236868b7278aec0192ee47318a11c29b09026ef509bd34f3b13
SHA512299843f356a5c8edef1877d2972e5f65dc5e4408bbc0b0e2f9f9ed7ce92209678fb582d019850251da2798f681dda0accac532785226211714c513b2d59b4029
-
Filesize
109KB
MD59ca9ccc1bacef5e666472345c2d3b7fe
SHA1a3ef76c8f5e06e620457d15c645ea6b47641fb1e
SHA25647ba8affe49d9150cec5a71ef05003a2ae64073e916a2c96a46904b9602c1051
SHA5129cbba060a9e7e6d5b75829e12b0a73e3ff50cbfe214bb43eea45fe8bfa4f7c2e06a793b465844e9d87562a1595a1714745fa5ed324ebf3ea530eb58129fe893b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd