Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
15s -
max time network
20s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-es -
resource tags
arch:x64arch:x86image:win10v2004-20231020-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
22/11/2023, 16:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json
Resource
win10v2004-20231020-es
General
-
Target
http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133451458970641368" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5560 chrome.exe 5560 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe Token: SeShutdownPrivilege 5560 chrome.exe Token: SeCreatePagefilePrivilege 5560 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe 5560 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5560 wrote to memory of 720 5560 chrome.exe 64 PID 5560 wrote to memory of 720 5560 chrome.exe 64 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 3972 5560 chrome.exe 86 PID 5560 wrote to memory of 5464 5560 chrome.exe 87 PID 5560 wrote to memory of 5464 5560 chrome.exe 87 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88 PID 5560 wrote to memory of 3868 5560 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.x-arf.org/schema/abuse_login-attack_0.1.2.json1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5560 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb848a9758,0x7ffb848a9768,0x7ffb848a97782⤵PID:720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1792 --field-trial-handle=1856,i,7791644789540862368,15999600056586880750,131072 /prefetch:22⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1856,i,7791644789540862368,15999600056586880750,131072 /prefetch:82⤵PID:5464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1856,i,7791644789540862368,15999600056586880750,131072 /prefetch:82⤵PID:3868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2968 --field-trial-handle=1856,i,7791644789540862368,15999600056586880750,131072 /prefetch:12⤵PID:5296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1856,i,7791644789540862368,15999600056586880750,131072 /prefetch:12⤵PID:3900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4540 --field-trial-handle=1856,i,7791644789540862368,15999600056586880750,131072 /prefetch:12⤵PID:5504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1856,i,7791644789540862368,15999600056586880750,131072 /prefetch:82⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1856,i,7791644789540862368,15999600056586880750,131072 /prefetch:82⤵PID:2748
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4368
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Filesize330B
MD5bada64518674583b1612c8b77316f4cb
SHA106d43e6ad9c03f2fe158a4c465daae70ee31f4dd
SHA2569f2e1e08e426d9a8ff0181b08b304e102c084e0478b9252ff896d7f30db415e3
SHA51206a1e31cdec40c6def813c531832855f509c7961e98124030ab6b6bd8e63e352332fed6dfc02a36d21c893761348b1d743797ad7187df309e0e7522b30dd0830
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
1KB
MD5363ed6325905e2f5550fee7ed9be76bc
SHA19c1fa1070797007bffccbf091cb735c21b99e688
SHA2568e1166fc45d31115550baacb3494717fbc88493324fa7d5262e9e22ca2df5379
SHA5125e489c96451593a2694b9ad16abb2e092b98e8ff6a4b559f680afcd7177ca3737b5e30884c783b194d4baa3bea64ffb7698b3985177ae08c35de4591d1c87737
-
Filesize
6KB
MD57769a1d8dc1c34e01e334faef2bd4015
SHA1eb9cb6db05fb547d66a8c91c9ad1f89b6fb4c0ed
SHA256cc073f4dca7278d6db62075918bc22985e2d9f6a06efd069eda077b799b0ec3f
SHA5124938fa9ca1913895a266db862c90af610bdf204629efcf64cf4e998fc54291870aef9bcca4e55a06e96966b71f98c0db5d06afbef3c55fef394e539c2264c17b
-
Filesize
109KB
MD59faaec6c06bafef628fd1deac214435a
SHA1911bb8f86d20254a22222a40b9986102eeaec022
SHA2566eb5978bb483f08e34d51efebf16c4f0efb71d5ecf15427a3caf6827d979b06e
SHA512ffe30ff255604f8560f977b5af11c553a652f8e731563140ed96ea016f843acec0a1267b66b4e45c01dad533a653993dc3a1e807bb2175f5615cc770ae10acac