Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
18/01/2024, 18:49
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://pub.m=rq.com/005ce11d-cb7f-4522-bfce-8079cd4d9bda/__;!!OgNkHJCYlf_CHg!YFUaD4UJ5U=zme2gg5Tm4icHOQaNoEaKp8haySM0tYh5bt8GsrhazFgVhZJGZBoTKgmytN3cPmJz6fiCsNStG=P4x_5luw$
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://pub.m=rq.com/005ce11d-cb7f-4522-bfce-8079cd4d9bda/__;!!OgNkHJCYlf_CHg!YFUaD4UJ5U=zme2gg5Tm4icHOQaNoEaKp8haySM0tYh5bt8GsrhazFgVhZJGZBoTKgmytN3cPmJz6fiCsNStG=P4x_5luw$
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://pub.m=rq.com/005ce11d-cb7f-4522-bfce-8079cd4d9bda/__;!!OgNkHJCYlf_CHg!YFUaD4UJ5U=zme2gg5Tm4icHOQaNoEaKp8haySM0tYh5bt8GsrhazFgVhZJGZBoTKgmytN3cPmJz6fiCsNStG=P4x_5luw$
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133500773762701037" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2012 chrome.exe 2012 chrome.exe 2128 chrome.exe 2128 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe Token: SeShutdownPrivilege 2012 chrome.exe Token: SeCreatePagefilePrivilege 2012 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe 2012 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2012 wrote to memory of 1040 2012 chrome.exe 52 PID 2012 wrote to memory of 1040 2012 chrome.exe 52 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 2120 2012 chrome.exe 89 PID 2012 wrote to memory of 5092 2012 chrome.exe 91 PID 2012 wrote to memory of 5092 2012 chrome.exe 91 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90 PID 2012 wrote to memory of 3764 2012 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pub.m=rq.com/005ce11d-cb7f-4522-bfce-8079cd4d9bda/__;!!OgNkHJCYlf_CHg!YFUaD4UJ5U=zme2gg5Tm4icHOQaNoEaKp8haySM0tYh5bt8GsrhazFgVhZJGZBoTKgmytN3cPmJz6fiCsNStG=P4x_5luw$1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeccb99758,0x7ffeccb99768,0x7ffeccb997782⤵PID:1040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:22⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:82⤵PID:3764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:82⤵PID:5092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:12⤵PID:2760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:12⤵PID:1724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3828 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:12⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3032 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:12⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4476 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:82⤵PID:3188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4580 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:82⤵PID:3732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4504 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:12⤵PID:3976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2776 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:12⤵PID:4280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=2788 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:12⤵PID:3348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4736 --field-trial-handle=1864,i,14732535191023958740,14868051968878457503,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2128
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4800
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD546987004b7dd48a498773c09e189b7ff
SHA1c8b71c415a6aa8f4e060b6381090cdd0c70c907b
SHA256528488f40c155e08c418a43b4f9e8885417ec4b2f6d9255bfe135eed201c75cc
SHA512ae01197806b5daa20eb523ff964bd045266f09d48775ad401fbe4b6d6548849099b62d213ed9903bf06c6a6574d134c5b27bc6830d29537be2275301a2a118f7
-
Filesize
5KB
MD518186ceddc95ca8375b817f2356a452d
SHA1631d5f1ea4282f38cadc88c2bdbb6d96573c2ac6
SHA256918be0b5b374396c4c9c5fd2e6a30634e621bf8f8352e49fcfefd452a69928d2
SHA5127a124d5349ad8b1bcc2f6a5a5e2d62cfb0f7a8c004698ba405e9f7051cefb69171747294cdb1ec88c937e4b3400ddfdef21d279982acdbe2e60500d5ae61e32d
-
Filesize
5KB
MD5be189e62e5c19c222370ec48a2cb460c
SHA1ef8d9c06f59843862f48909b7ca0208f50ea38ec
SHA2569713b18e55317e0a2bea13bf7b2de3fb02c444f681f5144dadf33d078cbae99b
SHA51283be03ffd0b4e61395eb266c377769fc190402b8e5538e27f00800e2ecbd4b210ff162865498c492a6186a329fdfa23fe96ff8d3b242dfb8f505763aa3bf01f6
-
Filesize
114KB
MD5c2f5f130c77d700c0504e152d5430e35
SHA11e39289f10a93e7a5a4f7e5df6fcbd2527351cab
SHA256317cc6b13daeb6c375ed29a6486ed69b77aca392aa18d60345d19c8760de0034
SHA51236ced09129e80c98d6c60c01a0e409a4928e17fe9ca43915d8d98dc4948ead6a25f5243f9e4a371f87bb49ebad5fb340814c09714ddff7704a4269d9c547e89e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd