Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
278s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
12/12/2023, 17:02
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://interdigital-ground.000webhostapp.com
Resource
win10v2004-20231127-en
General
-
Target
http://interdigital-ground.000webhostapp.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133468741811471355" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 868 chrome.exe 868 chrome.exe 3680 chrome.exe 3680 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 868 chrome.exe 868 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe Token: SeShutdownPrivilege 868 chrome.exe Token: SeCreatePagefilePrivilege 868 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe 868 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 868 wrote to memory of 764 868 chrome.exe 19 PID 868 wrote to memory of 764 868 chrome.exe 19 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 3744 868 chrome.exe 88 PID 868 wrote to memory of 2512 868 chrome.exe 90 PID 868 wrote to memory of 2512 868 chrome.exe 90 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89 PID 868 wrote to memory of 5112 868 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://interdigital-ground.000webhostapp.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:868 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa95f9758,0x7ffaa95f9768,0x7ffaa95f97782⤵PID:764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1864,i,13144486909779372955,3779031648312470751,131072 /prefetch:22⤵PID:3744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1864,i,13144486909779372955,3779031648312470751,131072 /prefetch:82⤵PID:5112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1864,i,13144486909779372955,3779031648312470751,131072 /prefetch:82⤵PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2976 --field-trial-handle=1864,i,13144486909779372955,3779031648312470751,131072 /prefetch:12⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1864,i,13144486909779372955,3779031648312470751,131072 /prefetch:12⤵PID:3400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5128 --field-trial-handle=1864,i,13144486909779372955,3779031648312470751,131072 /prefetch:82⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1864,i,13144486909779372955,3779031648312470751,131072 /prefetch:82⤵PID:4612
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4748 --field-trial-handle=1864,i,13144486909779372955,3779031648312470751,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3680
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3964
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe1⤵PID:5240
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k UnistackSvcGroup1⤵PID:864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
16KB
MD522067b169577dda0b3ed49a80fa50f30
SHA17ff6a9b5cc5d7da3d5bef112d3474473c0452a36
SHA256b12bf79af4594001dc59e2defe775e74565af17bcac7e9e50005268dae85dd6d
SHA51238b3d638bb6da92e944b69221a2c9cb1bad13afe85bdfa6192451f791533a928e56a77e5df8ad87a0dd31eaefe6dea2c670eaa24c05923d32f38f94fa85c46fe
-
Filesize
120B
MD50c56c063d6758d0386164741d06b7d56
SHA1c1401343aa5cce5901d09173511b84a38dd4bb89
SHA256ab60adb145231a79c8e8a9e4ec66b14d2423d145491b2ddbe0999d23af27629b
SHA512a3baf8d9a58bdf189aaf87bdea2a1145560adbb957310a8daf549dc0570d31756bafa3e0e99326c75d0f6f3251dd1486e49119dc94ee1b16c5a65989c53b8a95
-
Filesize
3KB
MD57a5d747c2dda7cd3a9a1367bb8b411dd
SHA1257e948a7023609d31bc06e5911550995a7b9a7c
SHA25665a9549e456d8bd7b206d709378bbe0002eb0bce883bb36e7c7b9630fa0d9349
SHA51245161e53598c485158deafcf121d769f4b4cfec67cd7512247ba2acb441f7a6656b356152561dd71ee095b5731e550c37803188a7042a5e9d8419c69093fb6e0
-
Filesize
1KB
MD5c0f293c36c9419eaaaac024b37703aa1
SHA1dedffcf461774edd5d18e735668238ec5314131f
SHA25696a7598c2a00291f5c895bac2a67bb6268ad9b8fe2b17e343b82f53a06775330
SHA512bc6ece93c14f8d003a3ec3c4a1b8c729e162c48a96f92114c4aad663cfef30426fbb1fb10c614e55b02269ce03131877852686b54774b5d2ea42d13b96b58089
-
Filesize
6KB
MD52b75108dff9fbd39c0660b03de9462cb
SHA163bdce2327061ce7e39252d747920c3243df26de
SHA256be5d97aeff63774f7e9f835fcef1851744e463bcf10a1497654d2611401340f1
SHA5126cc66070256827ecc73c5cb57961f307b14c1bc5b2c8b30b0717365f13914f7ba13f160dcdb56557f0b8e9541d0c57587954b720801d95afba19fb75dffa77f4
-
Filesize
115KB
MD54fd21c64a22638288f0d1997dee5df29
SHA1400537e3eb3d516d46aeed838e924a06d3b4b612
SHA256636f8c0c87f29d6d95aba3e05fc2593f34a451a7f95c8d747aa42c0adce9b78c
SHA512c3bba67c0e0a8fc406ea828bbbca3dbcf4e77db9dd122bb86cb47d6b6199219412b1825255f0aa41a34b581959575a49f3bb9f0b41e58e821bcc783b525a7f40
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd