Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
20/11/2023, 07:13
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ns.apple.com/HDRGainMap/1.0/
Resource
win10v2004-20231020-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://ns.apple.com/HDRGainMap/1.0/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133449380459823410" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3736 chrome.exe 3736 chrome.exe 2944 chrome.exe 2944 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe Token: SeShutdownPrivilege 3736 chrome.exe Token: SeCreatePagefilePrivilege 3736 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe 3736 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3736 wrote to memory of 1284 3736 chrome.exe 14 PID 3736 wrote to memory of 1284 3736 chrome.exe 14 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 1776 3736 chrome.exe 32 PID 3736 wrote to memory of 4676 3736 chrome.exe 31 PID 3736 wrote to memory of 4676 3736 chrome.exe 31 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26 PID 3736 wrote to memory of 468 3736 chrome.exe 26
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdf2799758,0x7ffdf2799768,0x7ffdf27997781⤵PID:1284
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ns.apple.com/HDRGainMap/1.0/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:82⤵PID:468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:12⤵PID:3040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:12⤵PID:1832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4008 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:12⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:82⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1672 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:22⤵PID:1776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2892 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:12⤵PID:416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4916 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:82⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:82⤵PID:2784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4956 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:12⤵PID:3660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2528 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:12⤵PID:3064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4704 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:12⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3188 --field-trial-handle=1824,i,7629992371939170830,121744698992450209,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2944
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2292
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
823B
MD5bc75447b072280ed55966d6212ae8979
SHA1ae542eb408722460091ea03d4a8ca5f33255c6cb
SHA256b961c096e169167b8c3e1f8d6602aabc06d7db4b132c5385eb030d103a9cb235
SHA512660bd40cca76faf63602223fd4b6055eab60be10f32f6b5bb09262561c05fb2e7767e893710af2f15c9200b5e59d28a2e15547043e265f0c47d59f8c8dd43c27
-
Filesize
6KB
MD57d9e4802d15866db8d616213e36c146d
SHA1206f77f7a665c7666e4b8d8f517a485d2b2bc4fd
SHA25662f580255146275352d064103c3d54eab6d9927196e4c44d84ae0ec60052a4ca
SHA512d9fae2c77e5d5a3ec24acefbd78e7769e28ce8c6cb1282231c93536712e24f176a9b780c35b13afa5cb9120ca678be8694c8b68cc80b0171329a094d770418ae
-
Filesize
6KB
MD558f8d7ab7a6abad7af77b96a84f18c19
SHA1c9dbb1b15d02711e66eba5cab39b126b09becb49
SHA256b27246f5c7ff8be7374fd8eb471ef5d59213ca879a93d8bd020979d5b35d8ccf
SHA512d1a66a3e9124d6fe3c6fead8c6789156cc28348e48954f5818bb1ad0f183bbce02e892722d9f7e77e4dec18ee17c31aa0656e11d2067533ee3075acff7b21437
-
Filesize
109KB
MD5e9fc5c540cc1b1c37392d61c994ccfc3
SHA15d4cefd8758138d581b39b5344210c1bd8d0d60b
SHA256b4f18f756ffb01c38e34a18775069a2f063503941f6ce4724d7a6fcd3b52262f
SHA51252f1519edd5f81417b7e5819a0ad7e36020d105c9a62603b60cbaf7fd14e43c6b2346cc991e10937111f9803f80769889a593ec65df3061808b53c84252e8a45
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd