Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
17/11/2023, 02:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://arraign.store/oop/1010_md/1/171/684/24/41422
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://arraign.store/oop/1010_md/1/171/684/24/41422
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133446601911520073" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1860 chrome.exe 1860 chrome.exe 5032 chrome.exe 5032 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe Token: SeShutdownPrivilege 1860 chrome.exe Token: SeCreatePagefilePrivilege 1860 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe 1860 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1860 wrote to memory of 4444 1860 chrome.exe 61 PID 1860 wrote to memory of 4444 1860 chrome.exe 61 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 5096 1860 chrome.exe 86 PID 1860 wrote to memory of 3776 1860 chrome.exe 87 PID 1860 wrote to memory of 3776 1860 chrome.exe 87 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88 PID 1860 wrote to memory of 3012 1860 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://arraign.store/oop/1010_md/1/171/684/24/414221⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb9cba9758,0x7ffb9cba9768,0x7ffb9cba97782⤵PID:4444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:22⤵PID:5096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:82⤵PID:3776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:82⤵PID:3012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:12⤵PID:3332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:12⤵PID:3196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4056 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:12⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3376 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:12⤵PID:1784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4564 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:82⤵PID:216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4600 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:82⤵PID:5100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4048 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:12⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2640 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:12⤵PID:4448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2492 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:12⤵PID:224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4656 --field-trial-handle=1892,i,10946491256183327137,4136755787818489933,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5032
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4408
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD530e04ab04e8ccba8af2b82902fe0be07
SHA1964eaefb7b102358898b64376606c5479f9b8920
SHA256f09c4a2d30e05d9c1a0ed44623289606f97067abc3c4d7391eb2782d70c3fab8
SHA5123a226e9ac517569f233b0ff1b8be62fc3c36d0bf5ed83bac9b5823edd63e8f256908c9ea5b2c300e294ab337df832df8729594e5a6ba430002eb6246b4a90c64
-
Filesize
5KB
MD57f92187d0eadffb5b112afa7898cbb50
SHA1ca1918fa2bdadb1e79587e5696efc21b06d322de
SHA256812410d9f5a4bcd10739fd213288d6379c397c9f5f74052e43d87d7cdf2505f8
SHA51204578af894a95864440f5eb5a316ee2c7707f8200d1907e0a228facf425ec9a9218ecbea319bcdf6f7b22c0dea7a3672c54be3000c138e7011798564dfeb1e71
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\f61bbc98-a158-41a9-95f2-57a66d7168f4.tmp
Filesize5KB
MD586447619fba9cf58db46ef79a0997fbb
SHA178c11dc491f27ee20f97d012017f79eaf9da3841
SHA2560cf931bc92d585e203f16ab3ef46b6c684aeae5ebea8c0fe1b035074999b98bc
SHA512cf9a4e1af26adc999755f10466d8114db68f9f3bad848f1a99f3291fed1cc2da3e657bf06055b8d40deb9bbdbc40b2bffe41ddfec4e87b12c5f6fd5146b7f5ad
-
Filesize
109KB
MD5dffaf7f31c497f8751f86ab7a0ffce21
SHA172dd7f3f367e3fe26ea01b62effbfb2f9b4cb9ad
SHA256158d1d12a393a0c1ce9ee6a7ac5182cdbf75466badb8d9af071984109b7f05ed
SHA51294e344eb69ef8dcac314b3e1023f280c6d9021e0edbd77e67dffa771df71912b803e768223782d129d160ccbc9afb9a3d149e39c17843ce4608e224d1b88f83f
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd