Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
278s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
21/11/2023, 04:03
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://jkap-mapkitjs-demo.glitch.me
Resource
win10v2004-20231023-en
General
-
Target
http://jkap-mapkitjs-demo.glitch.me
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133450130321432453" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 728 chrome.exe 728 chrome.exe 5732 chrome.exe 5732 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 728 chrome.exe 728 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe Token: SeShutdownPrivilege 728 chrome.exe Token: SeCreatePagefilePrivilege 728 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe 728 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 728 wrote to memory of 3876 728 chrome.exe 66 PID 728 wrote to memory of 3876 728 chrome.exe 66 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 2956 728 chrome.exe 90 PID 728 wrote to memory of 4804 728 chrome.exe 89 PID 728 wrote to memory of 4804 728 chrome.exe 89 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91 PID 728 wrote to memory of 4800 728 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://jkap-mapkitjs-demo.glitch.me1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffabc8e9758,0x7ffabc8e9768,0x7ffabc8e97782⤵PID:3876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=1912,i,4435576339669490943,16835926715581120355,131072 /prefetch:82⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1744 --field-trial-handle=1912,i,4435576339669490943,16835926715581120355,131072 /prefetch:22⤵PID:2956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1912,i,4435576339669490943,16835926715581120355,131072 /prefetch:82⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2884 --field-trial-handle=1912,i,4435576339669490943,16835926715581120355,131072 /prefetch:12⤵PID:3996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1912,i,4435576339669490943,16835926715581120355,131072 /prefetch:12⤵PID:4484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 --field-trial-handle=1912,i,4435576339669490943,16835926715581120355,131072 /prefetch:82⤵PID:5336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 --field-trial-handle=1912,i,4435576339669490943,16835926715581120355,131072 /prefetch:82⤵PID:5424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2616 --field-trial-handle=1912,i,4435576339669490943,16835926715581120355,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5732
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2596
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD557f7eb9934d790a34a457d65657ec1b7
SHA1278fa3ec4078cdfadfcd952db378bb6820d35172
SHA256200b2b86f966e5bc0323963ab69998c65d41ba5ec3d7c78750893eb42e460b00
SHA5124ac23bc64a5bf46f349887db147b246380b9d14943cae78457d6c3273d46ce9b10d9f31e71af9766dfa8219dc9184da75c98897791eeb79ad75d95b48accebf7
-
Filesize
1KB
MD5edbe1a9a916fdbd29dda731265dc3874
SHA1946d1208d3d391b5b400c1a9ce19e20fbb139776
SHA2560c55862cc2f3f109b76709cf7499e0b140e19cf1494606d240fc69e675a830d6
SHA512fb36e65ebb643e78e1f9a5cfa2698d18cbf788cae6e52124318592441c797d3302ff20dfd2086746a147a21e28987e7076c133b24b23e62f8965ae7827b0523f
-
Filesize
1KB
MD584f29ff3486e8f2129efb5676fd8220c
SHA10e7d2c46b3e5c07dbd7086eba402cd8da3f7e139
SHA256bb198788eaf12f3cb7e46a159c98fb109cb7eaea94e0a112109b2ce1420edda4
SHA5120ba83ccac41a5a5a2bf4d79caf762da225bbd407279a5b0840ce4ee0c929792f391d59650457ac863b3dd1c094f7cde8016c5b74f29b77026e4fa9d630500970
-
Filesize
1KB
MD55b9b5ee0e432024528445f006f68a9b9
SHA1ec8936d2714c07fb2d89f5dc20b695b15017273c
SHA256a579f447948449435974feb81111407a201c4475104ff732f21923e4656b4277
SHA512f5469e7c761bf28d9121c19bd4d2694f1c40554aa83225f6bea74afa7dc44c452ebff8920a4b63fabc04cb5c756e7fc60d29ea9688aa06c1f00e353a07e32c24
-
Filesize
1KB
MD55903557eff6accaa50d6987800371596
SHA19d61f50b59976bcf42d256d40ff92960dd118be5
SHA25679e32affee7afc3072ab9a867e054bf30f5c1cfdd4905cfa81fe80cefe7a58dd
SHA512d2e05cf5e2aa7e073f113a8b8dab551e04f763c98eb6e5c04a21d2c9af1b08dde1882abb02d9b30f3125e730c6b8d6c0977d25616babfc545a09f9f354900a88
-
Filesize
1KB
MD5e1f531b9cbe7165251b37d4b696ef90f
SHA1063e56fb9862ff818d313562fc2bcfc9c623289e
SHA25651cb323fb47d1148a995256643b005bf79b8707818cd9758650053f474b3c390
SHA51295fc2fb94b88a5f204776852202528a197dac39023fa3193b4a46cebaa06109e6cde1801b2be1ad8ba0de7be8a2f980dae745a13defc46e80ca3ce9a4b44382e
-
Filesize
1KB
MD5bc7fce657a79d1062ea64f55e3e8317d
SHA1ef2bfcc474501b0b75bb7590adecef83c397861e
SHA2562600fcf4380345c15e802566cc365f6d49db735ddda29bdf66540d04ce8fded3
SHA512817726ae20de3287a5ac7e49eace43ceedb9a0ac685c3edead695307a523ad45eef7de92d63f2153c805f259b234ee3112fb4a1faf9c9cc98b8e46945ee96f19
-
Filesize
1KB
MD58265bb781c0d6deb54d39329cea6ac4b
SHA1ccebb185c98a9f330dcdd264cd242a70fe4aefba
SHA256d44effd803ca887247e420539bd16061d256fe3478e09e4b76563e90f274ce1d
SHA512e4217c35a5c9808c3420d5e531b063bb87134c97b7b9bae46f60b9a0639039c947202d7564e59ed1eff266b30a77cb316a9daccc772b02b7066105fc9c71a236
-
Filesize
6KB
MD5cf435f6fa793c837f1ae05a0a847d943
SHA1cfb33ccb0cd33f4a5f1ddd094c5e82386b5ac47c
SHA25669571d676ebdfc4152c924c9c5afa39bc57b531649263f623722244c73252305
SHA5129e61d2d554e36885926a7035114c1ee339228c23fecda1bf7c2b2b49cd88b3b192e82c3bad496208ec53c389b89ae72a949ef1c5b2543526c913f5c5eba828ed
-
Filesize
6KB
MD52808ebc5748acb7577d7431a1e687cbd
SHA191022373bd547eb98e4eb2fc32d9e58d81a13892
SHA2563bd7aba4898628bf582d6327cca679e132f106e77146e02518a8f391ce93736f
SHA512f1643226032813dd73a2e3bdbdbcaacd7c6d94f821b6162d99199ce5c5313745932c6a421159f6656ca2345987319f9ace203807adcacd8731bdcf04f9d91f13
-
Filesize
214KB
MD50dd7c55fc9e35eae91ddfac6d8af386e
SHA1446c8a07e0342d337eae590f1b531173a498d496
SHA25654fdb38f671953215dfe21e140282cb63c39705ce694b8ea41fe5e651688ea5a
SHA512e0aacbd63dd39ecf86532f370a4288109d76ba6bf5df925187f8573001d4e5a57b5c63fd09db8dc2a33ec86a1998cfa23da11ce164a6ba812d5586e1bdfcf2aa
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd