Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
22/11/2023, 01:16
231122-bm924she63 105/06/2023, 18:52
230605-xja99sag8x 601/06/2023, 19:18
230601-x1b8wsgd5x 1001/06/2023, 17:57
230601-wjvhgaff56 1001/06/2023, 16:56
230601-vfpx5sfd87 601/06/2023, 16:38
230601-t5dqqsfc93 1001/06/2023, 16:19
230601-tsv49afc46 1001/06/2023, 16:10
230601-tmev3sfc22 10Analysis
-
max time kernel
300s -
max time network
270s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2023, 01:16
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://34.101.154.50
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
http://34.101.154.50
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133450894390443658" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2848 chrome.exe 2848 chrome.exe 1808 chrome.exe 1808 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe Token: SeShutdownPrivilege 2848 chrome.exe Token: SeCreatePagefilePrivilege 2848 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe 2848 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2848 wrote to memory of 2860 2848 chrome.exe 52 PID 2848 wrote to memory of 2860 2848 chrome.exe 52 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 3144 2848 chrome.exe 91 PID 2848 wrote to memory of 4696 2848 chrome.exe 92 PID 2848 wrote to memory of 4696 2848 chrome.exe 92 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93 PID 2848 wrote to memory of 3888 2848 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://34.101.154.501⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2848 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff32ac9758,0x7fff32ac9768,0x7fff32ac97782⤵PID:2860
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1060 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:22⤵PID:3144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2084 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:82⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2204 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:82⤵PID:3888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2944 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:12⤵PID:5048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2936 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:12⤵PID:1604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:82⤵PID:3520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:82⤵PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4776 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:12⤵PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3872 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:12⤵PID:1880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3856 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:12⤵PID:4644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4900 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:12⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=1472 --field-trial-handle=1872,i,4553962618083142230,6879201656725031532,131072 /prefetch:12⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5036
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5ced20b7bfd6b35b3f189c66361f44e63
SHA14dddadb76d56a5b4190dac9925a0252c3ea46b24
SHA25667e47b2f173ce43cb2e8b49a95023eba6673c09d0a6839ddb554afc3d1aa3c2f
SHA512a1f669a17b13361ccd090d926dba0d0aa71fd7bc6a8fed524c24f6a73ca1d79ba9aa9b6d86eb4dd56bf391fac5ca5adff28b055f3e012ae0faf17db5592804fb
-
Filesize
6KB
MD5b889d7631dabb3abfe22a241fe531e3c
SHA1928910d1750117a9f5440fccd4e5232f7713e928
SHA25625d81fa9f2e8685f79de854e445246fa5e9109768ee789db2407e5057eb67a0e
SHA512c088a4dfe28cd25e968902ab05f280c7957e95d04425bcffa119f30ef279572f35ef016e5482b0848d602d4c5fe0486a0e1575e1740e5d5fece0815ac4c02092
-
Filesize
6KB
MD5a809302192f5adcd3e8a56e42e29668b
SHA12cc486c1a11139a2257b92c9eac5db58aa620a72
SHA2561190714cea9b482d6942c4e40b4e6716f2792ff8d829f2a598dd38dd4222909a
SHA512676de0a11ce772601a09da8043512e55b193ba55c205b3c77cc82f8eb56974ba733cc4f79fa5c4bd4d46fdf043cd64112b4986d5ac5607cd3f3fc9b20b27cdf7
-
Filesize
109KB
MD5b8f6d83b1fa807bdb1a736d7e4cf01c7
SHA191acd5e7f5fee4c0ee75589b6756b8116480ef75
SHA25684081c2bac74dc5660b34b0c277d00ab7bb7c2865dac1adc0d5d888a8135c594
SHA5123dd8fdfdfd66a3250ad15de01741bc7ad4be139296d57b1269637c6d1ba29dd68b99540f0c2507b75785e65a1c534258d4630ce596f37818725cc07718ba651c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd