Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2023, 06:17
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://github.com/w3c/ServiceWorker/blob/main/explainer.md
Resource
win10v2004-20231020-en
General
-
Target
https://github.com/w3c/ServiceWorker/blob/main/explainer.md
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133451074988522022" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3484 chrome.exe 3484 chrome.exe 2496 chrome.exe 2496 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3484 chrome.exe 3484 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe Token: SeShutdownPrivilege 3484 chrome.exe Token: SeCreatePagefilePrivilege 3484 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe 3484 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3484 wrote to memory of 2312 3484 chrome.exe 29 PID 3484 wrote to memory of 2312 3484 chrome.exe 29 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 2976 3484 chrome.exe 85 PID 3484 wrote to memory of 1036 3484 chrome.exe 86 PID 3484 wrote to memory of 1036 3484 chrome.exe 86 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87 PID 3484 wrote to memory of 4052 3484 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/w3c/ServiceWorker/blob/main/explainer.md1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3484 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff978c59758,0x7ff978c59768,0x7ff978c597782⤵PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1868,i,12729806391075757320,2553971973338386969,131072 /prefetch:22⤵PID:2976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1868,i,12729806391075757320,2553971973338386969,131072 /prefetch:82⤵PID:1036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2228 --field-trial-handle=1868,i,12729806391075757320,2553971973338386969,131072 /prefetch:82⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1868,i,12729806391075757320,2553971973338386969,131072 /prefetch:12⤵PID:2992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1868,i,12729806391075757320,2553971973338386969,131072 /prefetch:12⤵PID:180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5052 --field-trial-handle=1868,i,12729806391075757320,2553971973338386969,131072 /prefetch:82⤵PID:3524
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4720 --field-trial-handle=1868,i,12729806391075757320,2553971973338386969,131072 /prefetch:82⤵PID:3872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4640 --field-trial-handle=1868,i,12729806391075757320,2553971973338386969,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2496
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5048
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a35ae0e491b2337019d4f7108bc545b9
SHA1e1883e876f5a9a04efc98cca18aebe536ed651f9
SHA256ec90c39190f2f03cffa9d3968f5d1934e327ed5820cc35234ece349dee5a7769
SHA51230e5db4be61f7abacdb26260d024deba50cf7ac6650821ce7c92813825608389d14853df35e5d74357846b534f24bf43666790cb5f3aaad51ed9d04da1df000f
-
Filesize
1KB
MD5513be70936e60da4f833263f8cea190a
SHA178dcab67310f053ab987221380f4b78cc2113aba
SHA2560cc02739dfdc2bae2fb28185cd2e519e147a3cd85fda49abf2cb33a0b2407e70
SHA512d1436d3c58148cf482678ead0b8628ce8de40e4d0ac6c6c8e0495ac86b25bb2e9703f8262bcf7de708e3fd3858d7bff0a513e9d06804f5ea6c7f19c363de8119
-
Filesize
1KB
MD502b31db163392e6f23efb8faa1db20b4
SHA1631384f304e52b6c2640930b4b10de1e8fe2fd9e
SHA256914c4dc1eb50e2ab62a95a80614fc13d7ef7aededbfb3f79a6ea342cf92ba8f7
SHA5121f3c7928f47794d05704b6f1204bbe9c34ecc9555b26980cd82920c24da34d61c1108ad0a6c3c469c352e65f0c9d80558b177f41b770fc7f9f6750f3ed7deeda
-
Filesize
6KB
MD5804d5488ad33d122bb8c44bcc9879d7f
SHA1012d28833e0e91c8e32d5e5f75d928594d109c5a
SHA25656607f7682075dd077f999bddf4faa390f699001daf21d286d8702d6d9127dc0
SHA51254f0431dfb8d714b8bd4a202ea75920170e41dc8220a8270bdda16d4af0e2f4bb9c40be1253621c97f05568ba0f90ba6d7d40b1c79218297978c7e6cc16c90bb
-
Filesize
6KB
MD5ae9dfbb1800dd934da854aeebce0b09c
SHA13ba5ce7a40dd5c1d709ca50d19a4fcc9f909ec1a
SHA2565481828d18293a700eee934332377c5f04808f983e6ac2645608ffe4dd8aeb1c
SHA512f11ac5715972e7204c156badf0557390730199c1b93d25fd74b75716a813aa641bd0e91ff70703806417eddf2a3e1d21ba0dbc3374b3e4d66358ddcb7348139b
-
Filesize
6KB
MD5f83a3f9b451bf5ccbda402309c32048c
SHA11d494b7011cc1f901890008efc92f1260b169e74
SHA256a000a0eacacb585cb2cb618d96722ebc9219742cb96b090aca54b2fd82270e29
SHA512b9b9349dd7fc2981bb931609e7484fa7cbc7391f349ab74b814a88d114efe83c1dda4278c2cd7d356bb23112ccee89429c9300456f2085c319aec44323347cd3
-
Filesize
109KB
MD50dab2fbfa57fad85bb8eb01c25b96c24
SHA1e24b4a39506d3ab8c8a5fc174d87304870e5bfcd
SHA2569815ce1b9c180a16cd1ccf39fe7b5465b49d7d6aee4dafb0624229d73386152f
SHA51267261ed66cb1f352af44c34c8a17e6d0861a282d3ae34055e9af1c616e080da63bf60f9c6f2d3be1028c52bda7d0f270ea5943d8617bf967b5af487667bfb9f7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd