Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
299s -
max time network
297s -
platform
windows11-21h2_x64 -
resource
win11-20231215-en -
resource tags
arch:x64arch:x86image:win11-20231215-enlocale:en-usos:windows11-21h2-x64system -
submitted
15/01/2024, 02:11
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://r20.rs6.net/tn.jsp?f=001zxo5wPWhmwaUZGOG6tGBAVknKyL5R98U6OoNq_0gnKA-H1Pj_UU6A7TOQNfY913EFjNwpoJEDR7FpBJsb4cRGSaSMzcGrOUO78sc2XZOQ_X_o3TzlrlFH1EWDZkfCb3UODeg2TIsSmRKyENevdC__z3fjafNr9aA&c=NOQkHv9YeiGOQBjzJEuBE59oRBKqeynPyiTXe6wJNjT-qRMeEoyePw==&ch=ddsRVcMTsVMTO2b5ShXiRMASjMQW3TTu8iNTItuK_hQWpYwiR-dS8Q==&__=/1871674/amF5amVldC5zaGFybWFAaW9uZ3JvdXAuY29t
Resource
win10-20231215-en
windows10-1703-x64
8 signatures
300 seconds
Behavioral task
behavioral2
Sample
https://r20.rs6.net/tn.jsp?f=001zxo5wPWhmwaUZGOG6tGBAVknKyL5R98U6OoNq_0gnKA-H1Pj_UU6A7TOQNfY913EFjNwpoJEDR7FpBJsb4cRGSaSMzcGrOUO78sc2XZOQ_X_o3TzlrlFH1EWDZkfCb3UODeg2TIsSmRKyENevdC__z3fjafNr9aA&c=NOQkHv9YeiGOQBjzJEuBE59oRBKqeynPyiTXe6wJNjT-qRMeEoyePw==&ch=ddsRVcMTsVMTO2b5ShXiRMASjMQW3TTu8iNTItuK_hQWpYwiR-dS8Q==&__=/1871674/amF5amVldC5zaGFybWFAaW9uZ3JvdXAuY29t
Resource
win11-20231215-en
windows11-21h2-x64
8 signatures
300 seconds
General
-
Target
https://r20.rs6.net/tn.jsp?f=001zxo5wPWhmwaUZGOG6tGBAVknKyL5R98U6OoNq_0gnKA-H1Pj_UU6A7TOQNfY913EFjNwpoJEDR7FpBJsb4cRGSaSMzcGrOUO78sc2XZOQ_X_o3TzlrlFH1EWDZkfCb3UODeg2TIsSmRKyENevdC__z3fjafNr9aA&c=NOQkHv9YeiGOQBjzJEuBE59oRBKqeynPyiTXe6wJNjT-qRMeEoyePw==&ch=ddsRVcMTsVMTO2b5ShXiRMASjMQW3TTu8iNTItuK_hQWpYwiR-dS8Q==&__=/1871674/amF5amVldC5zaGFybWFAaW9uZ3JvdXAuY29t
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133497583099752566" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3436 chrome.exe 3436 chrome.exe 4160 chrome.exe 4160 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe Token: SeShutdownPrivilege 3436 chrome.exe Token: SeCreatePagefilePrivilege 3436 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe 3436 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3436 wrote to memory of 2456 3436 chrome.exe 65 PID 3436 wrote to memory of 2456 3436 chrome.exe 65 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 4556 3436 chrome.exe 82 PID 3436 wrote to memory of 2900 3436 chrome.exe 83 PID 3436 wrote to memory of 2900 3436 chrome.exe 83 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84 PID 3436 wrote to memory of 1356 3436 chrome.exe 84
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://r20.rs6.net/tn.jsp?f=001zxo5wPWhmwaUZGOG6tGBAVknKyL5R98U6OoNq_0gnKA-H1Pj_UU6A7TOQNfY913EFjNwpoJEDR7FpBJsb4cRGSaSMzcGrOUO78sc2XZOQ_X_o3TzlrlFH1EWDZkfCb3UODeg2TIsSmRKyENevdC__z3fjafNr9aA&c=NOQkHv9YeiGOQBjzJEuBE59oRBKqeynPyiTXe6wJNjT-qRMeEoyePw==&ch=ddsRVcMTsVMTO2b5ShXiRMASjMQW3TTu8iNTItuK_hQWpYwiR-dS8Q==&__=/1871674/amF5amVldC5zaGFybWFAaW9uZ3JvdXAuY29t1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3436 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff86fcb9758,0x7ff86fcb9768,0x7ff86fcb97782⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1560 --field-trial-handle=1824,i,13926169196105627840,1091754398873551214,131072 /prefetch:22⤵PID:4556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2068 --field-trial-handle=1824,i,13926169196105627840,1091754398873551214,131072 /prefetch:82⤵PID:2900
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1824,i,13926169196105627840,1091754398873551214,131072 /prefetch:82⤵PID:1356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1824,i,13926169196105627840,1091754398873551214,131072 /prefetch:12⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2992 --field-trial-handle=1824,i,13926169196105627840,1091754398873551214,131072 /prefetch:12⤵PID:4288
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3688 --field-trial-handle=1824,i,13926169196105627840,1091754398873551214,131072 /prefetch:12⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1824,i,13926169196105627840,1091754398873551214,131072 /prefetch:82⤵PID:2204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 --field-trial-handle=1824,i,13926169196105627840,1091754398873551214,131072 /prefetch:82⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4584 --field-trial-handle=1824,i,13926169196105627840,1091754398873551214,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4160
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4840
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824B
MD5158b6dd320d7f8ea36a79230eba971f0
SHA19f1b0464337cd498a816531f5e4d5e98721e42d5
SHA2568ef6a900ff2f7cb1abc1647a43e987cac8dd1fb93f84256bb696140821968805
SHA5120a83ff2afc2fe311a29ba9a360d763c71517f0000176fb89648057625407caf168b2a439ffd3a24ea55b4dc6632ebb3eb7ed4014f468119432b3feacb5380329
-
Filesize
6KB
MD5960326903ae83b060cea330500dcdfa4
SHA1232f8667b3bd8d0a78c422506bcc8e5ace129ce8
SHA2569e076353415726d95b74656fa9eec4f036d38030a5363d07b52523efebafa727
SHA512f9515d42dca0ea3fb070ab7fddf5649511dc4fbe0d5ab9ae70ec62f68df86a90588129662669a26163df208f6c131d6261a3bba1f2acc58dd02186bfb11420e3
-
Filesize
6KB
MD513ce06af67f857dc64d55a311a9cdfa7
SHA14778aeca638da82aa7abcbd7c677ec9e4048ae71
SHA256183a640ea0ad7d7259de885d66c203ba4a0ca608876dc46c59ebb7593f2d080b
SHA5124c4df0edb682818830419afa078f0f51672cd760375064b8eb6f78c2b1b42e273dc2b47ab695a223b9f8f9eed1ffc3efcdf925c866324c964b08158d7bd419e2
-
Filesize
114KB
MD5ae8919c8abff5e5dc804b35ceb0b1aae
SHA146ab70b3deed8394719fac82a59a18291fa9a1ed
SHA256ab1e20e92f2a3611bedc84da6c8823f8c5d061c27b2cd25260124a11a1993203
SHA5129f50dea9ae4e7aa9dce97af60e4b9c962689f3e23eb2892435fbcb9f8a9365b1c0fd1eafd83e59c33057e674ffa033d6a48fbf4f34a45e1f71d9257da6631980
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd