Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/12/2023, 22:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://vmwarecloudss.communityinsightinitiative.com/survey/s/mmm4xw8w/mmmmwecv?campaign=24f7f3258f634797aeb3991a959ad60e
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://vmwarecloudss.communityinsightinitiative.com/survey/s/mmm4xw8w/mmmmwecv?campaign=24f7f3258f634797aeb3991a959ad60e
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://vmwarecloudss.communityinsightinitiative.com/survey/s/mmm4xw8w/mmmmwecv?campaign=24f7f3258f634797aeb3991a959ad60e
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133474992062768863" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 716 chrome.exe 716 chrome.exe 3680 chrome.exe 3680 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 716 chrome.exe 716 chrome.exe 716 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe Token: SeShutdownPrivilege 716 chrome.exe Token: SeCreatePagefilePrivilege 716 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe 716 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 716 wrote to memory of 4472 716 chrome.exe 86 PID 716 wrote to memory of 4472 716 chrome.exe 86 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4116 716 chrome.exe 88 PID 716 wrote to memory of 4360 716 chrome.exe 89 PID 716 wrote to memory of 4360 716 chrome.exe 89 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92 PID 716 wrote to memory of 3604 716 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://vmwarecloudss.communityinsightinitiative.com/survey/s/mmm4xw8w/mmmmwecv?campaign=24f7f3258f634797aeb3991a959ad60e1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:716 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff43759758,0x7fff43759768,0x7fff437597782⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1864,i,3862274384672345628,7469751248197972371,131072 /prefetch:22⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1864,i,3862274384672345628,7469751248197972371,131072 /prefetch:82⤵PID:4360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2804 --field-trial-handle=1864,i,3862274384672345628,7469751248197972371,131072 /prefetch:12⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2792 --field-trial-handle=1864,i,3862274384672345628,7469751248197972371,131072 /prefetch:12⤵PID:448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1864,i,3862274384672345628,7469751248197972371,131072 /prefetch:82⤵PID:3604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3936 --field-trial-handle=1864,i,3862274384672345628,7469751248197972371,131072 /prefetch:12⤵PID:3788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 --field-trial-handle=1864,i,3862274384672345628,7469751248197972371,131072 /prefetch:82⤵PID:1580
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 --field-trial-handle=1864,i,3862274384672345628,7469751248197972371,131072 /prefetch:82⤵PID:3628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3712 --field-trial-handle=1864,i,3862274384672345628,7469751248197972371,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3680
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4060
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
72B
MD51cbd8436b7b5d8e0d5c1c8fde4f20e0f
SHA14db1fb8320fd5a5476b91900480dfed9b8e40296
SHA2562c30e9ad4ea66411de7f8cf32c95e247bb6fc64719da5c58a1ef57e8b960d442
SHA512799c0eea2df367487b77ba9bacbc484688598af439ac3a5ea853ef8d48d4b0fc2238bb6fcde4ea44b00a45c2f755b233c8b3655ba2fcb174e9efa04bc870210a
-
Filesize
1KB
MD5baa085d5b12baef452d07bc597bc81b3
SHA134cebf1718811d9caae12d890905f677564ba9c5
SHA256a46fd1fa87f1896313bd7df9fd08c7da03eb4b55ddadcf9d60df8c76a37c9156
SHA5124dd21a30ed231cf47092e3eb793f5783bd4b6b2681adfdf45f0672f727978497f4c82f8c63afad6f7047833aea7e343c3cb9755f1fe99f791eed8312ceccd510
-
Filesize
1KB
MD5e485d01fb33cdf77b21228f2bdefa9b0
SHA18ca5a5092e1b34bf9078d3fe2474738972cce31c
SHA2563a1718d794d1ee7473795e001602c512a24ae6850e2ce96f0c70f029a20a704d
SHA512319be0113e28b370e534df0aa0486ab766d8f63c45379ee75a3361e0af179d8e2c156bf4ae8222ea96d039200a66cf2abef139669d4684ebfd17f595c9972a56
-
Filesize
6KB
MD59d0ae704cea2a678623c6b2258e61225
SHA1d2088124471057e06dffa0ce488b584992550d8a
SHA2560cd97940e5c348b94b9441a1d1a4e3575f91825563147fac628a9041babfc2d3
SHA5126fc3150b8c649d56a1569123c4d1431d4a32636b7605fcbe8f247e589df488fba3b43b70bb0c3f230c4f4a28a2f5887650d0b1f4ec9c8fc81f85e439fac150d1
-
Filesize
114KB
MD522310ac6f94e03eebc6b067f7ca7d67d
SHA196060d3e41125a554739e3ba8f3e3f13bd9b7e70
SHA256ab7771906cdf6139e9336e63ca16b69cf2199a1464df7c50fe4246ae25b5be95
SHA5126d94b112166909f4049f01e23943a02ef9a5752f0141439178f98e1c1f975ca3225d002b2addd8f6fbb72fa402e0406989bc4c8d16902e546a8df8dc20f29176
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd