Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1803s -
max time network
1701s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04/01/2024, 05:45
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://fghfghgf
Resource
win7-20231215-en
windows7-x64
6 signatures
1800 seconds
Behavioral task
behavioral2
Sample
http://fghfghgf
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
1800 seconds
General
-
Target
http://fghfghgf
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133493511040322592" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4576 chrome.exe 4576 chrome.exe 2980 chrome.exe 2980 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe Token: SeShutdownPrivilege 4576 chrome.exe Token: SeCreatePagefilePrivilege 4576 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe 4576 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4576 wrote to memory of 2016 4576 chrome.exe 89 PID 4576 wrote to memory of 2016 4576 chrome.exe 89 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 3172 4576 chrome.exe 92 PID 4576 wrote to memory of 1260 4576 chrome.exe 91 PID 4576 wrote to memory of 1260 4576 chrome.exe 91 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93 PID 4576 wrote to memory of 1088 4576 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://fghfghgf1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5a829758,0x7ffb5a829768,0x7ffb5a8297782⤵PID:2016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:82⤵PID:1260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1680 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:22⤵PID:3172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:82⤵PID:1088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2776 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:12⤵PID:4144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2768 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:12⤵PID:700
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4108 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:12⤵PID:4344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3020 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:12⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4280 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:82⤵PID:2876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4256 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:82⤵PID:4372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4204 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:12⤵PID:4800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=1236 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:12⤵PID:2300
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3596 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:12⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2524 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=1068 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:12⤵PID:4924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3316 --field-trial-handle=1848,i,13193444816612334174,16382355683987827593,131072 /prefetch:12⤵PID:392
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5064
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD565d256b5ffe51df90f07b712aaae96ce
SHA134d263025c34af06c466d15977277eddb7d2d600
SHA256af9db4af16d82d7e7a2cb1f006d56ddd1f88a66e7e08025af74ff5c4da0e765d
SHA5125dcb95e274a8354c9e0800ce029acad36b5de859805743e65163bd14e94363ece82630dc2ed06549070cc68560b0694a903fb107f67009e72feab5c43c121ea9
-
Filesize
5KB
MD5398f3ea10c4a931aff33e472acdcaeb2
SHA13b2d33d4d2cbf77aa4a5b253c97d28e59ad3efb4
SHA256664554f8b0cd4090f5a696d49c8e70213cc40f3af22ad443c0bd3b9caf39146f
SHA5125d26136aeb5566b68d65845ebaa9cfd2f80978168672e9adb66bfec4f3423730662e5f1eea599c3118f1eb29444d82925f39e4d77d2d942c75507eb2d20d5f8d
-
Filesize
5KB
MD5f05253db3dd714caeb45602f720064d2
SHA1cac1fcec5ca7dfcd83561e043e3e63e352ef2f9c
SHA2567d4adf0ddfddf35e3b29d7141936599661be4bb87f1dda1d23a87630e3dc0f2b
SHA512be4b94890d6a272d0fda1631f2ad6f17fcbd2783c090e5ac4eaa586ed37c9c6758226d8c24494b4c46cb10594a4d9e27de621929467565e9188eaabccb1d8e2d
-
Filesize
114KB
MD580b2a480dddf8eaf4e1097f5b4055129
SHA1a891737ab8188fe61f0eaf81ffa4835cc32dfdcc
SHA25623e98a1a7e8c51fbdf05fcd8f958a26ea9fa88095a1a15b6a6e8261c66fdac59
SHA512dff54738a89169d9056ae09cf5d67f600851c904458404e3d9cf9860994cfe7a6510079a456d9a8c0c808a9d878e9b8486e4b019c75e445ffd8821d0f11cf0d8
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd