Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
278s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/01/2024, 15:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://case-83768954.help-desk -information.com
Resource
win7-20231215-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
https://case-83768954.help-desk -information.com
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
300 seconds
Behavioral task
behavioral3
Sample
https://case-83768954.help-desk -information.com
Resource
android-x86-arm-20231215-en
android-9-x86
0 signatures
300 seconds
Behavioral task
behavioral4
Sample
https://case-83768954.help-desk -information.com
Resource
android-x64-20231215-en
android-10-x64
0 signatures
300 seconds
Behavioral task
behavioral5
Sample
https://case-83768954.help-desk -information.com
Resource
android-x64-arm64-20231215-en
android-11-x64
0 signatures
300 seconds
General
-
Target
https://case-83768954.help-desk -information.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133497205999425436" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2856 chrome.exe 2856 chrome.exe 4764 chrome.exe 4764 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe Token: SeShutdownPrivilege 2856 chrome.exe Token: SeCreatePagefilePrivilege 2856 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe 2856 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2856 wrote to memory of 3032 2856 chrome.exe 79 PID 2856 wrote to memory of 3032 2856 chrome.exe 79 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 1008 2856 chrome.exe 88 PID 2856 wrote to memory of 4972 2856 chrome.exe 89 PID 2856 wrote to memory of 4972 2856 chrome.exe 89 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90 PID 2856 wrote to memory of 1848 2856 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://case-83768954.help-desk -information.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa9fb79758,0x7ffa9fb79768,0x7ffa9fb797782⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:22⤵PID:1008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:82⤵PID:4972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2144 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:82⤵PID:1848
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2824 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:12⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2832 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:12⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4060 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:12⤵PID:864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3344 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:12⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4924 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:82⤵PID:4268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:82⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4036 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:12⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3944 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:12⤵PID:3760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3440 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:12⤵PID:2632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4092 --field-trial-handle=1800,i,13325421503353053406,15505530954045254313,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4764
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d4960e2b321250d78cb9cd702db2e0b1
SHA1867b7eebbbbbedc53f0b7f5200e29e6623c34bb8
SHA256c093babcdf8a1bc27b6049f99d7e7157cc321f7e43d12e3f5a2d692d9e861f16
SHA512640b0f97de6111d0e199fc731685abc9418795913cd7cdfab3f05b5d96009738ac0e8a11b9db6ca23d001bb1d13a3248d0ab4ef31e9d4026241e4a5ba0a99c86
-
Filesize
824B
MD580dabe6aaf35cc7cf026c56e20e3bd49
SHA15d32e537aa8294bcb2e26927e9419d08cd36ba53
SHA2565be4b269c8b6d191942dac7d2b46d14f7bb40a1920e62c9645b4ed89ad994fb5
SHA5126d9b730724bbce5191c5b1b00ff5d3134e1dcca91b8e0b74a4f6ed2470700672d7ddc56a8f44ff7e4bcaa4b0837ea6adb68152a1a041d2c0e7f898e63d73f631
-
Filesize
6KB
MD5973cb313ea1883e719f3378335f13f11
SHA142e8fcdc26f38dacb3ce4bca58052242482f5bc3
SHA256c37fb41f2f8ee34c115a70ab18982c7a5da1ff920e8f034251824b5ad85a6ffe
SHA51214b32798c94c2fb9034194c4402558f2b3b028e27cb318cc042afd6d07501ed209667e472cc06c38d6522ed9e3d012a68c56cc9f2fbe80a6666a94d956f5bd4d
-
Filesize
6KB
MD56fc8586b762a75b51a5dd14e1d41c136
SHA1d9a4d7b6350f7ef52f919565879d8a306185f367
SHA2565c04db9bf3f225afbd7a7ea23bc86c136e4c1ff461f4d8de1c0a753e87a0cfde
SHA512a5b12d6dc36ef12d9890f33b89363d61edbab9fb6164902cc244a27986acb66ad16737ca87092a78d9234ca6fc8cd0c2811dcf8bd6cd72984fa214dfe429ab43
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd