Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
15/11/2023, 20:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://myuslewns.com
Resource
win10v2004-20231023-en
General
-
Target
http://myuslewns.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133445529714733090" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4024 chrome.exe 4024 chrome.exe 4380 chrome.exe 4380 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe Token: SeShutdownPrivilege 4024 chrome.exe Token: SeCreatePagefilePrivilege 4024 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe 4024 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4024 wrote to memory of 1680 4024 chrome.exe 43 PID 4024 wrote to memory of 1680 4024 chrome.exe 43 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 2028 4024 chrome.exe 87 PID 4024 wrote to memory of 3552 4024 chrome.exe 88 PID 4024 wrote to memory of 3552 4024 chrome.exe 88 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89 PID 4024 wrote to memory of 3644 4024 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://myuslewns.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c45c9758,0x7ff8c45c9768,0x7ff8c45c97782⤵PID:1680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1868,i,12184023123490346750,1499201220260700021,131072 /prefetch:22⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1868,i,12184023123490346750,1499201220260700021,131072 /prefetch:82⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2232 --field-trial-handle=1868,i,12184023123490346750,1499201220260700021,131072 /prefetch:82⤵PID:3644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1868,i,12184023123490346750,1499201220260700021,131072 /prefetch:12⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1868,i,12184023123490346750,1499201220260700021,131072 /prefetch:12⤵PID:4324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4316 --field-trial-handle=1868,i,12184023123490346750,1499201220260700021,131072 /prefetch:82⤵PID:2608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4436 --field-trial-handle=1868,i,12184023123490346750,1499201220260700021,131072 /prefetch:82⤵PID:3772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4308 --field-trial-handle=1868,i,12184023123490346750,1499201220260700021,131072 /prefetch:12⤵PID:3928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3888 --field-trial-handle=1868,i,12184023123490346750,1499201220260700021,131072 /prefetch:12⤵PID:3024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4476 --field-trial-handle=1868,i,12184023123490346750,1499201220260700021,131072 /prefetch:12⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4408 --field-trial-handle=1868,i,12184023123490346750,1499201220260700021,131072 /prefetch:12⤵PID:2548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1868,i,12184023123490346750,1499201220260700021,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4380
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5038641bf323ef2229cd057c5abce175c
SHA19086f6182ed4b99f865e89bb28d2c80f7384dbc3
SHA256c20d9365bcec6ccd18dc1a544e3351066f1b963dc5f8dca3bfd9e581f420360d
SHA5127f329021bcc2d114ea6198e860555f70d26a5467b9e1e6792c1a5954acb08adc54b7fdcf18647f6223e07d32f910231e3af2ea4851d46601f6a55fa33b564266
-
Filesize
5KB
MD5c29a3c46ae33bc12a4ff628d5294497f
SHA10505e432dafa19bd6a7ff8bb8734a29f8501cefa
SHA25636c5fc8c9580bbdd5afc125a2111207f95c8dc158cff0a323d79fc3f77f8535f
SHA512d0f2ada86447c4c7e22b64c476b5ce9fe828dc3d3a27962bea60a4dc94dadbb3ee3d0f96d1e8a2dbfb5ad3abead20df2c4a1048c25b8a93ca876c3b7099db996
-
Filesize
5KB
MD5791e8624eeb0deb462e0543db94b6613
SHA12d2e665de7251ed0ad4eba375ef95fdda1124616
SHA256ab620a58bf686a362e420b76807cc754726cd08835ad108373a1f92d4b4390a8
SHA51292504d369e68f06c3a7789d3876f2345e8f9ab3db785caa2a95a0f0aabec678cc9a993664aa148019aa3debfb16f8f57d4025e39a5b5795f204905006a5242eb
-
Filesize
109KB
MD58ecef8579c979b21e8f3a6a88202eea5
SHA1a18f05c2b48275178ed766a6ba4715b736c61b1f
SHA2569a088feda55c8e219105f8e91f2e3e49ed5b79a30ba9cb23d732bd4d5405a388
SHA512895c651decda1e1bb8c05143ef2fda301d6d85e33fa2d72f33f8b574bd7571d6b72a0ab0bdab6bd05b4e6c0583cb61cd803a609bb12dbc136fa50f0116a1f5be
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd