Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
15/11/2023, 12:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://295222458573650.shopeka.ae/
Resource
win10v2004-20231020-en
General
-
Target
https://295222458573650.shopeka.ae/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133445234241750063" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4708 chrome.exe 4708 chrome.exe 5764 chrome.exe 5764 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe Token: SeShutdownPrivilege 4708 chrome.exe Token: SeCreatePagefilePrivilege 4708 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe 4708 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4708 wrote to memory of 4812 4708 chrome.exe 86 PID 4708 wrote to memory of 4812 4708 chrome.exe 86 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 1724 4708 chrome.exe 89 PID 4708 wrote to memory of 4596 4708 chrome.exe 90 PID 4708 wrote to memory of 4596 4708 chrome.exe 90 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91 PID 4708 wrote to memory of 1200 4708 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://295222458573650.shopeka.ae/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae1ec9758,0x7ffae1ec9768,0x7ffae1ec97782⤵PID:4812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:22⤵PID:1724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:82⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:82⤵PID:1200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:12⤵PID:3360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:12⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:82⤵PID:4932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:82⤵PID:1964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4880 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:12⤵PID:992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2600 --field-trial-handle=1864,i,7451342692923613912,14623436764238860147,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5764
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2392
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD56f7746397a02abf38b90a9a68e175c8b
SHA11648a765229ebb57c67d02858a55f84a3f6d09a7
SHA25634adbefd5896d8629e9d75cff0309d9dae3ef8cebb5b6ddc0facdcb74d54d7ef
SHA5121aadbb45c5affccea5ae7d734aca9fa2380c0918477d2500a65233fa54e922417d03813694d6379f9024f148c372f5448651b09e9d3b73715c82ccda68de72ed
-
Filesize
2KB
MD5e628c68a507bdd01ba2f765633395096
SHA1618bb88b6968d19112d71b4c29d8f4dd2f774636
SHA256246dede2c600fa8e7875f1b2608ebe3e4d4eaa5dbe794264ec57b8d8f6c5cfe8
SHA5125de17c5068641423a8bd1e04f829bd3e15f2ba5f56125265e1cd76b1cb16ffea795dd8413cb1f6bea9033b849bf0473cf5fd4289f6e6138257228fcfaaa6311a
-
Filesize
1KB
MD548491ea4b1d8d47176da515928b42799
SHA16d57c471703e1ad861bbe3f797c8cf9e4c19f936
SHA2561178109153c7bbe3ced5e272cd2c846a28b09062c591fac01963f183786f7907
SHA51219c6794e030ee6b5493f68aaaa4ae0100105fe9a8817f9bd3d5253f916c7c2aa149374c2f53d6b2c1771b58ba20bdbc5984eac326f85c086551ac08d9b6b2e91
-
Filesize
1KB
MD5d075659d2175f15c60f119f3191bbf5d
SHA15029b85b9fdef87ccb9f33d65dd762d7684d9352
SHA256678cb486f73c8b19cd85604e3ab7e8d13c4c339ecf2f160f1927fd9e81c3e87c
SHA5127b37ab8de38dcc0a1097488deaff6fbc8d6cef2a31b85a84ade86d2deb7f8da870403aa21ce4155520f9be1c5aa3345cb58a8bc972288221962d2ef7b8360974
-
Filesize
1KB
MD50d1b9534abc2c1da3e282da684f0475c
SHA14953da5b6168d0b9e7130ed698dcc9fdb851921b
SHA25672c1fa149f07d6fd84fa95a906723184ab4f34393f1466734f6b1374ad5404ae
SHA5123f6289101b78295bc41c3471823303bc46fcee47b910ad704c60d8782cd6198b41dafdf7afadaf8c7388de664abf161be483dc3344d58d9fa64c49be95598043
-
Filesize
6KB
MD50b6ceba7d0fc160a302758fec4dca073
SHA156f9ab8f60adb92bee65682da218a10311f99fef
SHA256ed96f1dc3c3860ab6e5d4937f8569987ccad8c6bdd20c87f9be483419d17ed79
SHA51282ad475f76804c9f34df59a6fc97da985dc83d7b49d970d4f72a8ee19308837277254a546648a8e27c835901240270c56b8f81a95413aded02c391f166a1e8f7
-
Filesize
6KB
MD5f2f852e02d8c94bb876761451236e230
SHA13a1d2b864c6f0ccb3471c8887b10995cc6a20b34
SHA2562578d2f101ee277b6888a7a1535f802c6130fb64b48a316ff16bc2bf307ca7a4
SHA512b8030f4272a626155f5fad774af6587b99df2072e4618652034944945bb9875dce00ed96ee937d98e065d73d015bec31e78dca844cc5692204a2f5f4c0517a72
-
Filesize
109KB
MD58dc2869563c689cc6d17af129520e292
SHA178557d4cb82b302552d50339848b2e518117a5b5
SHA2561e7a626ef362186eb00c832ae5387f27b5061e1e2d43fb7b9cc40f7399e42568
SHA512a1718506fae105f12bdbb71928c0c9c7123045b335b7f4e5c54b599af133412e2a0255c975bee021ecc97eb9667f26082c7e3b87088e7c33f71bc9ce64ac4a90
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd