Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
381s -
max time network
378s -
platform
windows10-1703_x64 -
resource
win10-20231129-es -
resource tags
arch:x64arch:x86image:win10-20231129-eslocale:es-esos:windows10-1703-x64systemwindows -
submitted
10/12/2023, 21:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://epsilon-spaceworld.com
Resource
win10-20231129-es
Behavioral task
behavioral2
Sample
https://epsilon-spaceworld.com
Resource
win10v2004-20231127-es
General
-
Target
https://epsilon-spaceworld.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133467186685177749" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4436 chrome.exe 4436 chrome.exe 1556 chrome.exe 1556 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe Token: SeShutdownPrivilege 4436 chrome.exe Token: SeCreatePagefilePrivilege 4436 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe 4436 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4436 wrote to memory of 2300 4436 chrome.exe 16 PID 4436 wrote to memory of 2300 4436 chrome.exe 16 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2648 4436 chrome.exe 28 PID 4436 wrote to memory of 2868 4436 chrome.exe 25 PID 4436 wrote to memory of 2868 4436 chrome.exe 25 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24 PID 4436 wrote to memory of 2436 4436 chrome.exe 24
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffd77379758,0x7ffd77379768,0x7ffd773797781⤵PID:2300
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://epsilon-spaceworld.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:12⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:12⤵PID:1620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:82⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1748 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:82⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3820 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:12⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:22⤵PID:2648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3972 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:12⤵PID:200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5428 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:82⤵PID:5028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5568 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:82⤵PID:1848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3204 --field-trial-handle=1808,i,9644854765223118286,11591858168022141969,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1556
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4472
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
480B
MD5f007b20c1bc9545b3c480c4380000657
SHA1eba01a7417bf7fbdee03dc0b503c637b157c7a37
SHA256005f359dc9f227813e2b6ff5e4ff6deb616306457bf70b1b3962ac0dd791a648
SHA5128db9cfc6bb8c8380dd15ffc57614a05874c2352b540a0563908da2956825b146de04fd02f67c719b4032d77462d72a71919c8117ac4a5d9dfbafa080db14a660
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
1KB
MD5c4c6f3d114f509834f3540af12f266dc
SHA163a4ab35b66165d9d4f48c0498f0f6392558a6f1
SHA25618f882090c9fa815939994337ce6834afac8b5410f6c05c5d58a3bdc5049b100
SHA51223b95910a9d808cc188fe997857338c94389cdffded16592d42993b7f82af2d9ef31854744411411fb4e8ad4d9ecbadcccd7ceead0a20e878227289ad52bffb3
-
Filesize
5KB
MD5bff588049d737adc37824c439a43c59b
SHA14601f30e141a4d7ed60fd4e0604f1367da833332
SHA2564d90c2ef640f98b50f446692788cf799562855b4d8ae42e4cea6ea78eb8f5aef
SHA51217e470d5e617094ae3ecdb992f5c7aa15032500f9454933cd7d71efdec490c513acc461e5e49dcb5dee4d169d5f79b003ff2aa8aeba2a27840046e9ec71a49f0
-
Filesize
5KB
MD5980b8092d83a3de37b20f395b004ba32
SHA1fe2ea690e36295526476699003d928b0664c20d8
SHA256dbb6d0d26dc09508ac9a9f3d7cdfa1d53c53a5fc3a785adc05376b1a88317ec5
SHA5124f8431d9578232b78e6279a606966b852c00386c79e831cc1d4fd822ceaee701b78191359b09bb749615364e3ba6ca423d54033867c4fec3d9dffd6aadc67369
-
Filesize
5KB
MD5fbe5414ef9831bcfdf3291354e069525
SHA1f2da50ef80b8c67d39363b8ea25c225ef211a78d
SHA256c0506e835285d35ec6d764b3401956046555a9e1358d37980147d68dcf59f0c8
SHA5126401b713f75c286d274828e542cd3dc96ae3112f03838beb84b88862905c4242bb3e82d16117bb3cea08ad37f350ed6299f6cfce17f51a245ac32596d6dbd17a
-
Filesize
5KB
MD55957a15a4245728dc24e8e3d08186b86
SHA1aab70e9716051b6e9ca69ae50e2305e5e2cb9cdb
SHA2564c7e372e20c1262afc2efd079f2de68302923c8be509173e71b40e9efa3a51b4
SHA5126eb988f5eaa0b3777f07bc2f55f2ec03828c24fe991ea89d27a7a4a24322fafb161a1d1695fd41e457b1a5465fbcad9054dd1962b2c9b10c10793423fcb4dfdc
-
Filesize
3KB
MD540ff593557c5a10f7d814fc13bfd866a
SHA10d9451a5642ac76df10fd0d19afb77049a3eaf55
SHA256da127d8f3830f0355c0ca3dff417e1c08d01efa3655bd812fd399e6d91485924
SHA51202f0bc91016154913db03595a05d1fc67cc4a43335b75c01b2a9020f7e8de1199ebe7995ecc5b7c36c95fdacb07d59abf4983e607b8868d573202ebe75a7d152
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd