Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231025-en -
resource tags
arch:x64arch:x86image:win10v2004-20231025-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2023, 08:35
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://fhvuqhzade.erchargypi.ru
Resource
win10v2004-20231025-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://fhvuqhzade.erchargypi.ru
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133452885234342382" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1164 chrome.exe 1164 chrome.exe 3484 chrome.exe 3484 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe Token: SeShutdownPrivilege 1164 chrome.exe Token: SeCreatePagefilePrivilege 1164 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe 1164 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1164 wrote to memory of 1992 1164 chrome.exe 45 PID 1164 wrote to memory of 1992 1164 chrome.exe 45 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 2596 1164 chrome.exe 88 PID 1164 wrote to memory of 3824 1164 chrome.exe 89 PID 1164 wrote to memory of 3824 1164 chrome.exe 89 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90 PID 1164 wrote to memory of 3016 1164 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://fhvuqhzade.erchargypi.ru1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1164 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x108,0x10c,0x110,0xd8,0xdc,0x7ffa9a279758,0x7ffa9a279768,0x7ffa9a2797782⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1644 --field-trial-handle=1892,i,13220004413100401095,2982951350680192186,131072 /prefetch:22⤵PID:2596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1892,i,13220004413100401095,2982951350680192186,131072 /prefetch:82⤵PID:3824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1892,i,13220004413100401095,2982951350680192186,131072 /prefetch:82⤵PID:3016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1892,i,13220004413100401095,2982951350680192186,131072 /prefetch:12⤵PID:4828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1892,i,13220004413100401095,2982951350680192186,131072 /prefetch:12⤵PID:2780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4592 --field-trial-handle=1892,i,13220004413100401095,2982951350680192186,131072 /prefetch:12⤵PID:3460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5088 --field-trial-handle=1892,i,13220004413100401095,2982951350680192186,131072 /prefetch:82⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1892,i,13220004413100401095,2982951350680192186,131072 /prefetch:82⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4416 --field-trial-handle=1892,i,13220004413100401095,2982951350680192186,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3484
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4436
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5905bc9dc58c66fe6d548c0f0acfa2182
SHA12dcbe7eb067d0e1138109e1cd3deccf7d5c34c2b
SHA256d491bc286d7109d71acc5b4fe510742e6cbd828936110b6880f94856d59fce46
SHA51279b6bac1bd2fad5519be56aba90005734d16c14597b3346b13326ba08d451892507395bdb7ed89f4e797003d3187a7632983aa80385aa2b167b6be0e59cb8ea1
-
Filesize
2KB
MD5a75ed85429d7689363913cd5e71acc99
SHA15d4c6e886f613db7f60e681f0566aa78fa08efa2
SHA2565feb370838fe1e5176f8deba5cd700e4615095b22db991e874646e897e911f38
SHA51296310e8a8679e242cbe7910491fd4d6c6edf3f69e8efa6c622fef5434a76bff235fbb7f8c8644b39b77fb91f4d9aebc84d4101e42e811de296f4851b02ad9d76
-
Filesize
6KB
MD5db45782e389153bd76da808dd3400fe2
SHA103ae3a1db2c02c74f05c0569a73d711434387569
SHA2566e400e075180b7c6dd6b05356e4c985ac6bd3ae6b0778b1f4ed2fd8aa0353e58
SHA512720877064149c260f65f64bbc3e70102ccd1d7d61c4c95a74ff6e4553f5e4655ebbb68acf0aa307d2dc3a770f92b146b31b987c772f2fe9215e80617637c924a
-
Filesize
109KB
MD5a7dbb859cc1d4cc63f45867ac8858274
SHA1dfe393b3577f025f1c8500568fd5628690ebbc20
SHA2562efbe58923f67316fe68e2ed019333344fd0bbab0a9eeca2e567cef1ed0806fb
SHA512a031df3a33025cd89e00d340557b30fab0613edf8e0986ea9893f1d3ca8e28dff22616d87400c1233c955cff642134c6af0945f4b7ece8bd8b60258fcece4aea
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd