Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
31/12/2023, 01:35
231231-bzx83segbp 1Analysis
-
max time kernel
0s -
max time network
102s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 01:35
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.ihateannoyingorange.com
Resource
win7-20231215-en
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://www.ihateannoyingorange.com
Resource
win10-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral3
Sample
http://www.ihateannoyingorange.com
Resource
win10v2004-20231215-en
2 signatures
150 seconds
Behavioral task
behavioral4
Sample
http://www.ihateannoyingorange.com
Resource
win11-20231215-en
2 signatures
150 seconds
General
-
Target
http://www.ihateannoyingorange.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Suspicious use of WriteProcessMemory 42 IoCs
description pid Process procid_target PID 4892 wrote to memory of 4456 4892 chrome.exe 14 PID 4892 wrote to memory of 4456 4892 chrome.exe 14 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 220 4892 chrome.exe 25 PID 4892 wrote to memory of 3856 4892 chrome.exe 24 PID 4892 wrote to memory of 3856 4892 chrome.exe 24
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe7699758,0x7fffe7699768,0x7fffe76997781⤵PID:4456
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.ihateannoyingorange.com1⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1892,i,5631896465430269427,5313045381972714059,131072 /prefetch:82⤵PID:2268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1892,i,5631896465430269427,5313045381972714059,131072 /prefetch:12⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1892,i,5631896465430269427,5313045381972714059,131072 /prefetch:12⤵PID:2172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 --field-trial-handle=1892,i,5631896465430269427,5313045381972714059,131072 /prefetch:82⤵PID:3856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1892,i,5631896465430269427,5313045381972714059,131072 /prefetch:22⤵PID:220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4900 --field-trial-handle=1892,i,5631896465430269427,5313045381972714059,131072 /prefetch:12⤵PID:4464
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 --field-trial-handle=1892,i,5631896465430269427,5313045381972714059,131072 /prefetch:82⤵PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 --field-trial-handle=1892,i,5631896465430269427,5313045381972714059,131072 /prefetch:82⤵PID:1640
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4736 --field-trial-handle=1892,i,5631896465430269427,5313045381972714059,131072 /prefetch:22⤵PID:3772
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:532