Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
599s -
max time network
533s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2023, 02:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://109.248.158.32:8080
Resource
win10v2004-20231023-en
General
-
Target
http://109.248.158.32:8080
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133450072474320520" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2256 chrome.exe 2256 chrome.exe 2196 chrome.exe 2196 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe Token: SeShutdownPrivilege 2256 chrome.exe Token: SeCreatePagefilePrivilege 2256 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe 2256 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2256 wrote to memory of 5000 2256 chrome.exe 86 PID 2256 wrote to memory of 5000 2256 chrome.exe 86 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 972 2256 chrome.exe 88 PID 2256 wrote to memory of 1932 2256 chrome.exe 89 PID 2256 wrote to memory of 1932 2256 chrome.exe 89 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90 PID 2256 wrote to memory of 2044 2256 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://109.248.158.32:80801⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2256 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe129a9758,0x7ffe129a9768,0x7ffe129a97782⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:22⤵PID:972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:82⤵PID:1932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:82⤵PID:2044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:12⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2844 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:12⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4408 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:82⤵PID:3508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3940 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:82⤵PID:1660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4516 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:12⤵PID:416
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3156 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:12⤵PID:3036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=748 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:12⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2672 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:12⤵PID:1100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5112 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=3580 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:12⤵PID:3296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=2152 --field-trial-handle=1900,i,13360982960906247030,15877372469741328427,131072 /prefetch:12⤵PID:1624
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD52ca57852cf6266e53a1790c5265e3da2
SHA1dd8fa97f3591ae91c925bbb2006003555f2acc5e
SHA2566f471fa0cb26c91b2f26c1bf14e5d168b147ce642042f8bf44cba0ac7b71ed93
SHA5120e80b6f3808091e52e6b7c4df6e92aa9ef693d1d0d77993c2a843dcc1599b72e1da72f1685eb65514fb48e2a07f0b8e2b5730f7d46914e9c884288eb9f7805d0
-
Filesize
5KB
MD5bca004fbda54947c9e922b73f393eeb8
SHA1c439ef5b63157909471a4d86ec677c68da46220d
SHA256ba2a9fb78ec7d9a3d2c83d3429333de75d16f2cd661a9ff6756f22f68b446694
SHA5128ca1a5ba6561a1fed7689343927b9915deccdd43e0057ea7e14defbc3c160b9629dcbaaa2d77fa5991c10d30cc67834a6ba94e11daeff31ae6967e35cab9215c
-
Filesize
6KB
MD56a046c10a38b60fd20765c7044a3fb82
SHA1259de44022d0747abbb2998fec38204d9c9e868c
SHA25609ee8c7f7ea55bdcfa87fd8bfa6b5f4e7660c39c7f4778bfd952ddc007ecf9ff
SHA512be68c3dfbe0165c3604d5ad793c0e27734b93fa5d1ce43f37afb3723ad3e2b9a2fe71e3da848a78ccc9f46e7171cb1e71c8ebbc2c6295c06bc8ffdc3b292ea7b
-
Filesize
5KB
MD505befedc34af727de3f0c51910309e89
SHA1f30dc73ead41a2c542818c0c65a98093a4833820
SHA2561c7b7dc7f69c8adbda7e0b3e3dc625d8f3de1edc66c3e3b5126347d37ce28920
SHA512f8db43e346291fe4170361729aa03b86ac595af74182945921667507c6acfbe5b6a52a71c3cf7a7038a359366c98aff76ab483102e2de60c28300fa3ef6d1d34
-
Filesize
109KB
MD5dc9aa81c1eb80f7d54ce81b43c68d225
SHA14bbf9f7e89bf952b563957acb1c90e7f9641e290
SHA256b292178e148cacfaa74001051c5098dd412bea5541b482d5555069d0cd989010
SHA512ccb24273230c7032b1ce8cf2e23da00c82be1d20e82c574e1d8ae4dbf14c58a0ae36746af88c55d0aa5841bb5bbc81993902967809de248c3baa15232b5a0272
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd