Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1692s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
11/12/2023, 19:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://!rYno1QoaobL@
Resource
win10-20231023-en
Behavioral task
behavioral2
Sample
http://!rYno1QoaobL@
Resource
win10v2004-20231127-en
General
-
Target
http://!rYno1QoaobL@
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133467968462518838" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4428 chrome.exe 4428 chrome.exe 3848 chrome.exe 3848 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe Token: SeShutdownPrivilege 4428 chrome.exe Token: SeCreatePagefilePrivilege 4428 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe 4428 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4428 wrote to memory of 3700 4428 chrome.exe 47 PID 4428 wrote to memory of 3700 4428 chrome.exe 47 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 796 4428 chrome.exe 88 PID 4428 wrote to memory of 2396 4428 chrome.exe 89 PID 4428 wrote to memory of 2396 4428 chrome.exe 89 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90 PID 4428 wrote to memory of 2956 4428 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://!rYno1QoaobL@1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa45ff9758,0x7ffa45ff9768,0x7ffa45ff97782⤵PID:3700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:22⤵PID:796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:82⤵PID:2396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:82⤵PID:2956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:12⤵PID:4044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:12⤵PID:3176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4548 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:12⤵PID:2728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4692 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:82⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3876 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:82⤵PID:2640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3672 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:82⤵PID:2440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3884 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:82⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5112 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:82⤵PID:2300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3876 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:82⤵PID:4184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 --field-trial-handle=1936,i,7742792642229917283,10251554075387349924,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3848
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4420
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d8726ab8c893d1ce29465719d0fd2c1d
SHA102c14ab19b8821227fc7da2940ee4888eaa3282a
SHA256abed5258fcac9e3c2f7faac2eff26772c85fd89e699bb7f72ee40086fa8de814
SHA5127ea8bc012970bbb928f173220ba10b63bab2a3786978dcb179bba640fec52bbdad50f891274327ead9633d1c18e3b32a225ba6e2e2fa742fdfec434fc364b492
-
Filesize
1KB
MD526b59a1dae5f155bc683152289dc9df6
SHA103dd3b60612539bf412ae57d47bc6e5836bb7e14
SHA25603ecb623e88084248fb02059736d147e87b82dc7841c477e9ab593c77f77d8b3
SHA512c1628bd434d9aca5f84df806565517b4ac76b5775910c6ff9fe8cf7b2662fcd89b13c019131d2a5b04e3b4be3b100caba6ac3552ef64ea7cbd9dc7ef3178002b
-
Filesize
1KB
MD509d651129435f7b305a3ee97a1b28b86
SHA13faf0985956450d3cce4dc68493555277cc2f45c
SHA256d063e152acbe863914fc9da3a78674576aa270aeb01ce8a8e5b53189abaf5a80
SHA5120655cc3989bec671e837470bae983e49380676c22dde4451345ad55402d9990b2a0b27ccb980b761b4ce69b76983dc449c91a68986aa2668546c20a8000bb6dc
-
Filesize
371B
MD5db04052eba56c1c55aaa57f8ea58223c
SHA16b92ef399b03bd71bde295d460f6873802ba30bf
SHA25698d75512f6bb365a9c2b78e914dfa0f9f3f663d741426cbc65bbbf026360ca0d
SHA512483b21bdb667a0d6e9373f8ac8c3ce8db8180b520f70e7f74c077cbe7775e0e4ae85ac5e7a1bf92c2ceedf43ad214aaa8596cde280a2beca08d050c43f1213e0
-
Filesize
6KB
MD53d039648a71f77d58e7676ef7a91110d
SHA1d96da1808861f8bbe582c52146635778107da576
SHA256d3a0629a92aa4a9bd8822d6ce27a27cda4c546e0070c52935bead5b9e3a4ae42
SHA5125e164ff2f09cc5d294a2873d3ace6a54f37e7d52b141e151c3a5671e8ebe7a416bc784778396a9a90ad6dac89529fa2b220d7831fc95211fb152cd01e76eff14
-
Filesize
6KB
MD53596fe53519c7cd93b83574d5f995be4
SHA1e15d538de4b8e8a3141851e1e51d765e8d9e7344
SHA2560223e7f2b131a62efeed759028fbf67ef8f91ae587ff444685e0a2dc929b33e7
SHA5125710561845a0bef1d1754d6e6249b1039c699b0e934e16114bebfbd391cdc039c9c1d2c31603fc6b5eb7eb100b6a548cb4ae58b7140dbbb0360fa336a417e594
-
Filesize
115KB
MD58ca98684974d48cef280b540b4fdc2ba
SHA1c5df2b6b75695997ba5f2f0923bbf897c9d24204
SHA2562e92b1002438dd5603397d66ba15bcc008c91888877f89f429a5d1bb28c3193c
SHA5121f4d9d29a8098120141c954a72ee5f357a833e1a7e819fe97ae74551c64fd2df4a80156c23b6e749851a2352d181c66c095acfc6d13aa7b909d5bce162a5397f
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd