Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231020-en -
resource tags
arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2023, 15:51
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.sevenlab.nl/
Resource
win10v2004-20231020-en
General
-
Target
https://www.sevenlab.nl/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133453146908462116" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4580 chrome.exe 4580 chrome.exe 4796 chrome.exe 4796 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe Token: SeShutdownPrivilege 4580 chrome.exe Token: SeCreatePagefilePrivilege 4580 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe 4580 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4580 wrote to memory of 3784 4580 chrome.exe 83 PID 4580 wrote to memory of 3784 4580 chrome.exe 83 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 4680 4580 chrome.exe 86 PID 4580 wrote to memory of 3552 4580 chrome.exe 87 PID 4580 wrote to memory of 3552 4580 chrome.exe 87 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88 PID 4580 wrote to memory of 4496 4580 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.sevenlab.nl/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9cef89758,0x7ff9cef89768,0x7ff9cef897782⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1820,i,10479666818136009445,4043960105134473470,131072 /prefetch:22⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1820,i,10479666818136009445,4043960105134473470,131072 /prefetch:82⤵PID:3552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1820,i,10479666818136009445,4043960105134473470,131072 /prefetch:82⤵PID:4496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3048 --field-trial-handle=1820,i,10479666818136009445,4043960105134473470,131072 /prefetch:12⤵PID:2548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1820,i,10479666818136009445,4043960105134473470,131072 /prefetch:12⤵PID:5040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4844 --field-trial-handle=1820,i,10479666818136009445,4043960105134473470,131072 /prefetch:12⤵PID:3600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 --field-trial-handle=1820,i,10479666818136009445,4043960105134473470,131072 /prefetch:82⤵PID:2028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1820,i,10479666818136009445,4043960105134473470,131072 /prefetch:82⤵PID:1864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4776 --field-trial-handle=1820,i,10479666818136009445,4043960105134473470,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4796
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1168
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186KB
MD59f61d7b1098e9a21920cf7abd68ca471
SHA1c2a75ba9d5e426f34290ebda3e7b3874a4c26a50
SHA2562c209fbd64803b50d0275cfd977c57965ee91410ecf0cafa70d9f249d6357c71
SHA5123d4f945783809a88e717f583f8805da1786770d024897c8a21d758325bcd4743ff48e32a275fe2f04236248393e580d40ae5caf5d3258054ea94d20b65b2c029
-
Filesize
528B
MD55b151be51b9208c49d27abdc09c22ba7
SHA1681e51d11c64482ac4bf9e7e206bf6c93d04257c
SHA256cf08f4db6f850bf58f16ddee3e25200c513d8d0cf9dd2fce51966e6b172b64cf
SHA51228f42ae338571d4ec4ae4d42aa0742e4b952e0f9545177594762da963ecf194b116134e37b53361dd48cefd7278ded49f60b37973314a530bd5df2ef17d969ac
-
Filesize
3KB
MD5cdcb8ea86af65cd9afaac39a2186d042
SHA1bb6a509ac3362dcaf953d9d9e9a524e9690f3e5f
SHA256943b896ffa3a64047d0a17dff033a8c4e80fa8ad64f053bed42d76c4286a3e0d
SHA512d153eeed892d1b49de0b34416fc8735404f51ca51238a3b02b2a55af5f89756ebe1c5de9d246fa03dd601be1f168dcf6ea03764c3d3e87250582db4c20259357
-
Filesize
1KB
MD50bbd0aa03b40549fe492f21f567aae73
SHA136680f5c746e71662b722cc14297fd549f60214b
SHA2561c88910804f202c95080dd187d58980ccccea9020e5d42c5f4e4cacb87ee73d9
SHA512858be11fc0f3820eff41ecdfc0311045b6e1d1f1861976cdce74ae7b47529260a341c50e201743a4393b07e540a845e318ee42045e960e2e3955f4df49278c88
-
Filesize
6KB
MD5cfb3637915c837a3db000ecd9c98b867
SHA1f07df337d41b7b6583bd78becb3fcd3b19146bf8
SHA256b00d4f094898045c9840baed433f6a0defb04751428c65ed6c943511b793ab88
SHA51236bb6e503950a593a850765b93ef6378253d51158bdb36ac621924cca8aba079f5c2171d57f60f2b670caf8276e3c4a1f99990f488b7bd8e538d2bf2693fbe04
-
Filesize
6KB
MD51aab448026ccd09f1fe09c4df2067159
SHA15c9b0f75281f095a2554d96388eae63615912303
SHA25666218552ec160642efe91f1a4b36cdd1cdb8667d27eaa7b1a89a34e201366930
SHA512d406396b3b307e5d716a300131c44122c3776cdf62cf405f0afb455203067fee9d412d5b252d3150343a67b223336def9e35e1b752b4e880092c0b153123b8d5
-
Filesize
109KB
MD5d9d9b5440411527a50af05cff4e54f88
SHA1d7517f111dccdbef8b8772ccf8983ccfabe8ef3d
SHA256826564801884a0e6e779cf1dd38679f91e5c208653c80fa57042fd7d987ed992
SHA512706e7175d13cd22309236388697ccb88571f07fadee47951fdecc0248e15984693570ff7499abcacc1499a85bed00ec566915dafcb75f8a3ec3c858b07115e38
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd