Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
298s -
max time network
292s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09/01/2024, 23:25
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://commbanks.us
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://commbanks.us
Resource
win10v2004-20231215-en
Behavioral task
behavioral3
Sample
http://commbanks.us
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral4
Sample
http://commbanks.us
Resource
android-x64-20231215-en
Behavioral task
behavioral5
Sample
http://commbanks.us
Resource
android-x64-arm64-20231215-en
General
-
Target
http://commbanks.us
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133493163711102780" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2568 chrome.exe 2568 chrome.exe 4244 chrome.exe 4244 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe Token: SeShutdownPrivilege 2568 chrome.exe Token: SeCreatePagefilePrivilege 2568 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe 2568 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2568 wrote to memory of 3080 2568 chrome.exe 64 PID 2568 wrote to memory of 3080 2568 chrome.exe 64 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 2504 2568 chrome.exe 91 PID 2568 wrote to memory of 1248 2568 chrome.exe 93 PID 2568 wrote to memory of 1248 2568 chrome.exe 93 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92 PID 2568 wrote to memory of 4692 2568 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://commbanks.us1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2568 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffc077c9758,0x7ffc077c9768,0x7ffc077c97782⤵PID:3080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1860,i,11995049809432473170,14439522911874294891,131072 /prefetch:22⤵PID:2504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2168 --field-trial-handle=1860,i,11995049809432473170,14439522911874294891,131072 /prefetch:82⤵PID:4692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1860,i,11995049809432473170,14439522911874294891,131072 /prefetch:82⤵PID:1248
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2968 --field-trial-handle=1860,i,11995049809432473170,14439522911874294891,131072 /prefetch:12⤵PID:5000
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1860,i,11995049809432473170,14439522911874294891,131072 /prefetch:12⤵PID:452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4584 --field-trial-handle=1860,i,11995049809432473170,14439522911874294891,131072 /prefetch:12⤵PID:1624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 --field-trial-handle=1860,i,11995049809432473170,14439522911874294891,131072 /prefetch:82⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 --field-trial-handle=1860,i,11995049809432473170,14439522911874294891,131072 /prefetch:82⤵PID:4564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2256 --field-trial-handle=1860,i,11995049809432473170,14439522911874294891,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4244
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4540
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD5768aee03a22a8e13100039ebc5deb28c
SHA1e7eb7b7e55ea30006bbdd5a1971792413eb222be
SHA25647b29cb7c194da668a7e9d5f5d596dd66681d88e8b0b7914f073ec937b9c6a48
SHA512881852192cc569d85614573d1d8a04d152b121e51c67d3382e23ebe793bf5e7e1cde77898ae42030325d6c01b15903198b0e2bd2864e23de7428ace114495e94
-
Filesize
2KB
MD5855761d0f20c8073a480368a72626f8a
SHA19054029727d8039ccd5f79e97074607e2249339c
SHA25690d5fbb505091e07612a1a832037d6233ff66aa78428cb70411ba1adb273320d
SHA512e06276dc5de0007a6f4dde2273b509ef3d1cd0b3c49f178182478a5a28031187e33a435896526e626a041ad3a720424879d9f00ae31bbe05aff781ef01730452
-
Filesize
2KB
MD5d9e2a0185384d3d8206ac1740b6e92e4
SHA12953039581551989388e681b5139eb0a68cc4fd2
SHA256c0673398872ae88d589dd67c56bd8d63c951d6a08400878f9872bbcfdf8e7715
SHA512363a74258e20df589850e4a0d040f3c62642b0298ecb8d4359b64073e10dd61359657bb75792fc68aa82903874b5b3be5df21b98e0914d00f559b031a8d2a1b2
-
Filesize
371B
MD5a7ce8fc89b51b9a698587a194e96b74c
SHA11eec83de87197dd2febd3c4ad747f8b319e292aa
SHA25679cb17ccd47ca6c8247eeb6fa48a9d20f27d2860fcf31b4217d782c5e491324c
SHA5128b6ca8dd39b4c1d9b80f873dd5ccf12e457f10ef9b71cbbf538414d9f9dc68324fcb415359fb6059f13582bc682893133158c44770bd6f66b831c14981aa0652
-
Filesize
6KB
MD5bf8c79475380a171b0abdc7d2c023798
SHA10297bd6f5dc36a56b6f9fb6c978e0ff97cc93eb8
SHA256e2c1a8db60b5982f94c93afa3ceb183be427844c714a834635ef0fa813fb619a
SHA512eb36ff592ae41144bfb9c2fc03056eafcaa4859d8efc621569cde6cdb1ad675b2b0cf78e779e3439d8476b453d3d59f30f9293dbaa58047e25c6f748c6304854
-
Filesize
114KB
MD579c435be875c206347c17d3ab5e3ab04
SHA11302756def5ab1ecacc88aacafbbcc11cb44912d
SHA256ec52efcedacf3b51b5cfb1d30108af8ef499902f596fcd7fbb7c56e876c1b878
SHA5126f917bb37fdf3b54c4f65d152d057d6135ad3ee22ab4146f5d12b1f18194d865ed0f33d0120106c7a9fdb9d987e5971cc67825d9ab67e7da3c11cd511a9b5ee5
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd