Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
292s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
22/11/2023, 07:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.googleadservices.com/pagead/ar-adview/?nrh={""aggregation_keys"":{""1"":""0x7f7e13629199e19a0000000000000000"",""2"":""0xf6a1a643767be46b0000000000000000"",""3"":""0x678b78e69183430a0000000000000000"",""4"":""0xadb6d86d863c6dfe0000000000000000"",""5"":""0x1e7e3af68720c9260000000000000000""},""debug_key"":""16389241126396200640"",""debug_reporting"":true,""destination"":""https://getquickmanuals.com"",""event_report_window"":""259200"",""expiry"":""2592000"",""filter_data"":{""2"":[""706613350""],""4"":[""11-20""],""6"":[""true""]},""priority"":""500"",""source_event_id"":""12894366659002393633""}&andc=true
Resource
win10v2004-20231023-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
http://www.googleadservices.com/pagead/ar-adview/?nrh={""aggregation_keys"":{""1"":""0x7f7e13629199e19a0000000000000000"",""2"":""0xf6a1a643767be46b0000000000000000"",""3"":""0x678b78e69183430a0000000000000000"",""4"":""0xadb6d86d863c6dfe0000000000000000"",""5"":""0x1e7e3af68720c9260000000000000000""},""debug_key"":""16389241126396200640"",""debug_reporting"":true,""destination"":""https://getquickmanuals.com"",""event_report_window"":""259200"",""expiry"":""2592000"",""filter_data"":{""2"":[""706613350""],""4"":[""11-20""],""6"":[""true""]},""priority"":""500"",""source_event_id"":""12894366659002393633""}&andc=true
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133451128754868071" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4052 chrome.exe 4052 chrome.exe 1464 chrome.exe 1464 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe Token: SeShutdownPrivilege 4052 chrome.exe Token: SeCreatePagefilePrivilege 4052 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe 4052 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4052 wrote to memory of 1956 4052 chrome.exe 51 PID 4052 wrote to memory of 1956 4052 chrome.exe 51 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 2316 4052 chrome.exe 88 PID 4052 wrote to memory of 4956 4052 chrome.exe 89 PID 4052 wrote to memory of 4956 4052 chrome.exe 89 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90 PID 4052 wrote to memory of 1068 4052 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.googleadservices.com/pagead/ar-adview/?nrh={""aggregation_keys"":{""1"":""0x7f7e13629199e19a0000000000000000"",""2"":""0xf6a1a643767be46b0000000000000000"",""3"":""0x678b78e69183430a0000000000000000"",""4"":""0xadb6d86d863c6dfe0000000000000000"",""5"":""0x1e7e3af68720c9260000000000000000""},""debug_key"":""16389241126396200640"",""debug_reporting"":true,""destination"":""https://getquickmanuals.com"",""event_report_window"":""259200"",""expiry"":""2592000"",""filter_data"":{""2"":[""706613350""],""4"":[""11-20""],""6"":[""true""]},""priority"":""500"",""source_event_id"":""12894366659002393633""}&andc=true1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4052 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe60a9758,0x7ffbe60a9768,0x7ffbe60a97782⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1712 --field-trial-handle=1884,i,12994207786630522613,14270436964717551489,131072 /prefetch:22⤵PID:2316
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 --field-trial-handle=1884,i,12994207786630522613,14270436964717551489,131072 /prefetch:82⤵PID:4956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1884,i,12994207786630522613,14270436964717551489,131072 /prefetch:82⤵PID:1068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1884,i,12994207786630522613,14270436964717551489,131072 /prefetch:12⤵PID:644
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2924 --field-trial-handle=1884,i,12994207786630522613,14270436964717551489,131072 /prefetch:12⤵PID:3120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4332 --field-trial-handle=1884,i,12994207786630522613,14270436964717551489,131072 /prefetch:82⤵PID:1500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4436 --field-trial-handle=1884,i,12994207786630522613,14270436964717551489,131072 /prefetch:82⤵PID:1624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4504 --field-trial-handle=1884,i,12994207786630522613,14270436964717551489,131072 /prefetch:12⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1000 --field-trial-handle=1884,i,12994207786630522613,14270436964717551489,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1464
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4784
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5b812cb4088c345f81ef35cfef0758e11
SHA1a0560c7c4b24aac2ad1e62011c2695f69d50706f
SHA25697be5a79656fa7d262494613539fdb94549b7f51905ce8b23887a010303d3676
SHA512c8d7ea79f20c7cb897177b65a7f6f11af8548797b668232c99ed3f69285432ae86b6d0975e81cf5ef37f2b415d4fc56d7416ecb4f06dc1250dfe29c46c758544
-
Filesize
1KB
MD5663b7f6c8605a02a0c4aa81f1cc19f3b
SHA1f08902076123fe56af777cf7a36ea1b546e4d8a7
SHA256595e9d0eb8e911a5890d1d1595b1b9a221722dd0e016e4902a5096e3e65453c3
SHA5123a9e15ce77916ba06a362f2cbd142b47a20a84d61fe6f1bbd1f2909a85eff65c550714e57a68b0e91c6705ff0c5fbce5987da505ed8d9dcd1c1fc7d0433c366d
-
Filesize
6KB
MD5642f2d1c3f21ff90e03da155af882dad
SHA13975f2ef0a42aa89af8560343732bbf671cf4c23
SHA256d9eb375731094a9ff0fce8fa2dc7aa8e20337e5ccd6469f966af74cb9cea652e
SHA512abe869de6cb60694dfba3f20a29d45fb5f23f7ec8aaa0ed2dc51f87c2b92234b953864a3f5998db4a3badb99aaaa0e54f094fcf338a7c39e5da3ed43782da1e4
-
Filesize
6KB
MD565a5f76080d677a7d1bd659ea8bf6028
SHA1703dd42259e90ce57e6d9ec1c1aac95d1105f387
SHA2561dfc24f3c57c8a985945a5ba93b4a8e4c0e1205d00c31b3c097d1fa2d4f2c446
SHA51230b6a9d0a1569c8554bcfefde709ebd3dc9ef6dc39eaaf89f12869bc252e6b9bd8ce42c3c06d872cace0d16137bd40b6d3a4bf42ccfc2231a1e679d41090f9fb
-
Filesize
109KB
MD5704c6d233be4122160b82337517546dc
SHA1672a624241c6fc79e64cac825d84177bce2649cf
SHA25615bbcf3c83116ca7cd73ed0946c1c5ac590dc23169114526f3d862d2f51f0da6
SHA512496e32c87e1bffa573f9b459974682912923de8bd0f47fbfcae66aae53f5b25e69401650af6a007e19508c2122c10ef1cfa0209a0143e0c2b4cbe30585dbee7b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd