Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 22:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://options.shopapps.site/v2/john-doe-us.myshopify.com/generate_option/6768349708382?tmp=1667431004
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://options.shopapps.site/v2/john-doe-us.myshopify.com/generate_option/6768349708382?tmp=1667431004
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://options.shopapps.site/v2/john-doe-us.myshopify.com/generate_option/6768349708382?tmp=1667431004
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133494854046113837" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1804 chrome.exe 1804 chrome.exe 4428 chrome.exe 4428 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1804 chrome.exe 1804 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe Token: SeShutdownPrivilege 1804 chrome.exe Token: SeCreatePagefilePrivilege 1804 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe 1804 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1804 wrote to memory of 5068 1804 chrome.exe 65 PID 1804 wrote to memory of 5068 1804 chrome.exe 65 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 2156 1804 chrome.exe 95 PID 1804 wrote to memory of 4752 1804 chrome.exe 94 PID 1804 wrote to memory of 4752 1804 chrome.exe 94 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90 PID 1804 wrote to memory of 2704 1804 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://options.shopapps.site/v2/john-doe-us.myshopify.com/generate_option/6768349708382?tmp=16674310041⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83cf09758,0x7ff83cf09768,0x7ff83cf097782⤵PID:5068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2216 --field-trial-handle=1864,i,1622841468796313905,6505550835861084302,131072 /prefetch:82⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1864,i,1622841468796313905,6505550835861084302,131072 /prefetch:12⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1864,i,1622841468796313905,6505550835861084302,131072 /prefetch:12⤵PID:2436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1864,i,1622841468796313905,6505550835861084302,131072 /prefetch:82⤵PID:4752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 --field-trial-handle=1864,i,1622841468796313905,6505550835861084302,131072 /prefetch:22⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1864,i,1622841468796313905,6505550835861084302,131072 /prefetch:82⤵PID:3420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5172 --field-trial-handle=1864,i,1622841468796313905,6505550835861084302,131072 /prefetch:82⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5028 --field-trial-handle=1864,i,1622841468796313905,6505550835861084302,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4428
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4620
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\bf1f0392-2b10-4b9b-a5da-7cf9d7d9e3f3.tmp
Filesize6KB
MD54ecc6f6b08d7909044751d79f8e69d15
SHA1cbc63cfa068be0973d6603c77f0373f08f155715
SHA2566d4e9f6034bd6b6cd6cead44979adb86f9bbf83dfeb473eb6aae0b714b7c2775
SHA512e7490915f0fc0e5e41787b2870489b929d07a040556c9be4defadae324ed17b0c5e61274c3b92af00ba038a58bc853481c550ac11193115bed875a64f14a65a3
-
Filesize
114KB
MD5e689c3cb9d1d2ac44f646509a8af53ed
SHA1254060e121f97a1daf39f2ac09115e8b682ee182
SHA256d1b1f0509ca61bc97dabcccc513ce496c8b18533f6635a562aafc32a916ca7fb
SHA51230aec956d31e47c2408ef537f68f6a08addb1963656d1b001661ed2a2d932120e17347ea6eaa431082497a9a4f781440be23d1148b2a1185745928ee7afb6839
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd