Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
24/11/2023, 21:02
231124-zveg6sfa5y 124/11/2023, 21:00
231124-ztrq4sfa5t 124/11/2023, 20:56
231124-zrc5yafa2x 1Analysis
-
max time kernel
110s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
24/11/2023, 21:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://docs.google.com/drawings/d/1EqOh5yIttLejR3FMx8VDfteOKOn18MpVDdJaHlg8RuE/preview#L7EngXXlklu0R8PaJy1yT2E
Resource
win10v2004-20231023-en
General
-
Target
https://docs.google.com/drawings/d/1EqOh5yIttLejR3FMx8VDfteOKOn18MpVDdJaHlg8RuE/preview#L7EngXXlklu0R8PaJy1yT2E
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133453333450499208" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4432 chrome.exe 4432 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe Token: SeShutdownPrivilege 4432 chrome.exe Token: SeCreatePagefilePrivilege 4432 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe 4432 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4432 wrote to memory of 1616 4432 chrome.exe 54 PID 4432 wrote to memory of 1616 4432 chrome.exe 54 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 2476 4432 chrome.exe 87 PID 4432 wrote to memory of 3164 4432 chrome.exe 88 PID 4432 wrote to memory of 3164 4432 chrome.exe 88 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89 PID 4432 wrote to memory of 3064 4432 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://docs.google.com/drawings/d/1EqOh5yIttLejR3FMx8VDfteOKOn18MpVDdJaHlg8RuE/preview#L7EngXXlklu0R8PaJy1yT2E1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4432 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb46cf9758,0x7ffb46cf9768,0x7ffb46cf97782⤵PID:1616
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1892,i,10824293786706037489,14452145806193949280,131072 /prefetch:22⤵PID:2476
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1892,i,10824293786706037489,14452145806193949280,131072 /prefetch:82⤵PID:3164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1892,i,10824293786706037489,14452145806193949280,131072 /prefetch:82⤵PID:3064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1892,i,10824293786706037489,14452145806193949280,131072 /prefetch:12⤵PID:1104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3032 --field-trial-handle=1892,i,10824293786706037489,14452145806193949280,131072 /prefetch:12⤵PID:4780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4844 --field-trial-handle=1892,i,10824293786706037489,14452145806193949280,131072 /prefetch:82⤵PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1892,i,10824293786706037489,14452145806193949280,131072 /prefetch:82⤵PID:4124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3496 --field-trial-handle=1892,i,10824293786706037489,14452145806193949280,131072 /prefetch:12⤵PID:4760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=988 --field-trial-handle=1892,i,10824293786706037489,14452145806193949280,131072 /prefetch:12⤵PID:4312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=5148 --field-trial-handle=1892,i,10824293786706037489,14452145806193949280,131072 /prefetch:12⤵PID:1416
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2904
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
186KB
MD59f61d7b1098e9a21920cf7abd68ca471
SHA1c2a75ba9d5e426f34290ebda3e7b3874a4c26a50
SHA2562c209fbd64803b50d0275cfd977c57965ee91410ecf0cafa70d9f249d6357c71
SHA5123d4f945783809a88e717f583f8805da1786770d024897c8a21d758325bcd4743ff48e32a275fe2f04236248393e580d40ae5caf5d3258054ea94d20b65b2c029
-
Filesize
168B
MD5a5708b99b5c8a608ab0d517fe691d191
SHA1847a9456a1a2f03f7c2efe11ca6470523a266ebd
SHA256e5f20a814dfe84b7a7d1cc777d0bdbbcc49d521195bcfd0ee43b8fd834875b27
SHA5126dfaf89c95d14c42e1b60340ea2ae40a46ac69e4a407c0c563399f32d74c25b02d9d7a6bb6918bd10a0ab439358ffc820586c932e5e89378d2dee684874e06ff
-
Filesize
2KB
MD5610bffe32baaee800ec15e4f22f73ee5
SHA1446192250a86dc827bae85147246732b5516b574
SHA256c0db13be46e6d7052f376c18342715ef2d65bae57d55951a3c12fe16ec822258
SHA51290d52afbfc95184200b07e089d9b39ccc6f5de5b29481ead218d63e4ecc9b6f9ac69af844c5ded8e312fa8cd44b4b5de926116a9d2747cda2a8ce7ba4f7d2ce6
-
Filesize
538B
MD5e52b1621d8b3a1ebfad84d794ba6b597
SHA19d69aad01d4da5d3cd48b09fb55333eba55ebae0
SHA2560a6037f90906055adfa8b9cabc3cd7dfca92b69d31c2acc5ef47cb19f63d00b7
SHA5121888fb1c2a005c11c3d097a6c0f75f832b185cc02053cfbe17b2646c2cf84960d1639c877c62f81baa638f3e4247c8e09897b3bbb71bdea42953986191547566
-
Filesize
6KB
MD558a4f99bcce7704d2850f4ff7a361afe
SHA19240fde5158971fb940f9f053d45e796acd1d49a
SHA2560e8f46cd3238d6442a4586ccc2bf0dc2f6e7cc52206fb8370124155fc68b7be4
SHA5129bb58b0a58dbd7560e5648db19f91eef22a710d18225ac4081f2028bce191b5f4b37c526c3eeb376af284ae828de5409d34e746a4cf96889506ff61d6bd5d616
-
Filesize
6KB
MD59d40e86b7d096b482603806dcc788ecc
SHA1c4058e46cdd088f1bf8634e0507c47e9daf4d259
SHA256c4e9a7fc20631f7e67fa2f8ab645ca6c1fbc37c843194fa46eabbfccff62b864
SHA51247b8e1e71997ef3e324a745d7f397d328edc4cdad0f67b1cd0ffc6b089b8cd47cb9168de9e2645e4ebe8b2384ef235bfc4981e2df5cd575243afdceebaf3e303
-
Filesize
214KB
MD5892891cc973d7ce98bffdfc9d09b6426
SHA15109122852f03d8f9ee662e36107dd22d26ec72c
SHA256f5dd125539b0d3b19118a9ce33369514afc417094f4ce680499011e635d1d22d
SHA512be1ab5b00be7ee54121ca2d248015fcd2e63e90f24223989f8aa625f0883da4a4e8dc2c5d2d20be45473b9380eadfcbd7c1bed6cfaa8ac6165b6dd52bba1a265
-
Filesize
214KB
MD57b92a07480e8162ba69ce0a22433c1a3
SHA162fec16ce5593804f75a0d621c76061501cdb866
SHA256f63831341d8de9efdb37a713d807da76c58c3daec8313fe009c4761ec268eabc
SHA512008d8878b9658d85be1cc614aeb0f148cfb5bbf2c3ace49fbd465a17c48059935d79b72dcf288a83cbe6b456d97702d704dd28e13d17b2cd3fa4229036baa822
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd