Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1199s -
max time network
1165s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
02/01/2024, 11:35
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://f186.i.mail.ru
Resource
win11-20231215-en
windows11-21h2-x64
8 signatures
1200 seconds
General
-
Target
http://f186.i.mail.ru
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133486689785961601" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1500 chrome.exe 1500 chrome.exe 4740 chrome.exe 4740 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1500 chrome.exe 1500 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe Token: SeShutdownPrivilege 1500 chrome.exe Token: SeCreatePagefilePrivilege 1500 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe 1500 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1500 wrote to memory of 4356 1500 chrome.exe 14 PID 1500 wrote to memory of 4356 1500 chrome.exe 14 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 1492 1500 chrome.exe 26 PID 1500 wrote to memory of 3244 1500 chrome.exe 25 PID 1500 wrote to memory of 3244 1500 chrome.exe 25 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24 PID 1500 wrote to memory of 1408 1500 chrome.exe 24
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fff1b309758,0x7fff1b309768,0x7fff1b3097781⤵PID:4356
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://f186.i.mail.ru1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1500 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3052 --field-trial-handle=1812,i,13383806469842302302,6672925433712705934,131072 /prefetch:12⤵PID:1748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=1812,i,13383806469842302302,6672925433712705934,131072 /prefetch:12⤵PID:5052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1812,i,13383806469842302302,6672925433712705934,131072 /prefetch:82⤵PID:1408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1812,i,13383806469842302302,6672925433712705934,131072 /prefetch:82⤵PID:3244
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1560 --field-trial-handle=1812,i,13383806469842302302,6672925433712705934,131072 /prefetch:22⤵PID:1492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4240 --field-trial-handle=1812,i,13383806469842302302,6672925433712705934,131072 /prefetch:82⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4364 --field-trial-handle=1812,i,13383806469842302302,6672925433712705934,131072 /prefetch:82⤵PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3528 --field-trial-handle=1812,i,13383806469842302302,6672925433712705934,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4740
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4896
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5bdba898a3ee12753fb0b2abfff04b189
SHA180f798350ff1b05d5269e8e9b2dd5df8513dff21
SHA25610166ae803ec76b659820d3534c9ed32ebee6911fbc99b0414b7be9f2bca81f2
SHA512b9f3ff4c139fac4cb72d959d668d43350172c15e7e6cb3892ce3ef984d6aa2c2e8079b30333e5f298dd8d918d6600ce7035a8d3f201c0b67b1f68d23458e79c3
-
Filesize
6KB
MD5381100baee43358f68ceb64e1dc2ef5b
SHA1f3adb07a584f0e71a0ae9c06a52a9f0557adfb57
SHA2567891cc5c71ea21b271256133104407d2d5e4384ebc837e808838a41a781116b2
SHA512c0c99883e0745e044255628d8fe71d87c21b67347cc88602727bd06f4df8e445ab48feb9606c49fbd607b9f44addcf97c8f092d8b986cb93230076c69a87a963
-
Filesize
114KB
MD5ba7bff7c7f3159b8d1bbe0b5c69db03b
SHA14e46afdd380314feff69ee93c3b032d11ef84d45
SHA256654dac39c237806b9d2326a18dc40aa5f19428446fd8a66b0cb0f4852384241c
SHA51242cd59e5c48c5ac204d1856af64db84bcd087f24a8d4fd0f35e8a9dda83574382e95a41caca5ec09005f7d3e0b288b64f2a74598558af7af28b55b36305b599c