Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
22/01/2024, 17:42
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://matrix-radar.com/
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
http://matrix-radar.com/
Resource
win10v2004-20231215-en
General
-
Target
http://matrix-radar.com/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133504189481537035" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3696 chrome.exe 3696 chrome.exe 988 chrome.exe 988 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3696 wrote to memory of 2796 3696 chrome.exe 88 PID 3696 wrote to memory of 2796 3696 chrome.exe 88 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 3916 3696 chrome.exe 91 PID 3696 wrote to memory of 4516 3696 chrome.exe 93 PID 3696 wrote to memory of 4516 3696 chrome.exe 93 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92 PID 3696 wrote to memory of 4984 3696 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://matrix-radar.com/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff8639758,0x7ffff8639768,0x7ffff86397782⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1640 --field-trial-handle=1852,i,15523078813562397814,8669583235866871976,131072 /prefetch:22⤵PID:3916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2200 --field-trial-handle=1852,i,15523078813562397814,8669583235866871976,131072 /prefetch:82⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1852,i,15523078813562397814,8669583235866871976,131072 /prefetch:82⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2836 --field-trial-handle=1852,i,15523078813562397814,8669583235866871976,131072 /prefetch:12⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2828 --field-trial-handle=1852,i,15523078813562397814,8669583235866871976,131072 /prefetch:12⤵PID:2792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4936 --field-trial-handle=1852,i,15523078813562397814,8669583235866871976,131072 /prefetch:82⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3980 --field-trial-handle=1852,i,15523078813562397814,8669583235866871976,131072 /prefetch:82⤵PID:2200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5048 --field-trial-handle=1852,i,15523078813562397814,8669583235866871976,131072 /prefetch:12⤵PID:4372
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3196 --field-trial-handle=1852,i,15523078813562397814,8669583235866871976,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:988
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192B
MD56eb8f1ced183f6fabed81bd3920c6fff
SHA16ea54af1bdae4fd929746ce803b8bb3a91d6c04d
SHA2566084aae99f52e2e379f5313e10db2f5995b728b59cac8b5924d61f7e6611d03d
SHA51214f0df559daf954def6ceaae59b67cb84a81828d00b082c21e073a42df996a14959cadb7946908623a02265a63e6d936e2ab03213529535d7ec31988fd738749
-
Filesize
1KB
MD51ffd3a50bcf7690af71a89e7915b45b2
SHA126e7d8722cbb4cf1425a25bc5493c650b14c519f
SHA256cb110bc46f9a30fcf2f4454e3a0b889542ae2ef2b56e4af789737be63bf17b6c
SHA5127c0a1dba3ec9eee76a29dc9555a041c5b30f49fdc18934dda91029de96ff52e0b3fcc700856dd49c6ae298551d583afe04aaa947b3339ee4bfafddc22aebfb72
-
Filesize
1KB
MD5237e4c10443702995818fa35bdd85e7b
SHA17304ad4539d7cbda5e0bf76932856957c1807919
SHA25656da3f9bb309ae959fd911f3aacf7cb2fa99ab1e1c4263f8005c34f731ecd938
SHA51276e45db2eb7f8f3962d13081279b89efa9a9102df734962ec68228237595b8d32f3eb5c01d71c312c83ed386e505a7b4262144516027bfd75c2546150df7f5ee
-
Filesize
873B
MD5395b1502d4a9337fb2ed297f2213f1d3
SHA198b2d7160cd31476ebf0f1e118cd4832c8c73ab1
SHA256ea14573d36afb84b50a64ef87a9a4336bd9793b8e0d794d5d1bb606c689d8029
SHA512a6b3f710adfae32e5c6cb89a86af89ee0f4726b562ef483c54fc7273f15d6bad3b871f3c52d1534aee68441ae687e2b449859033b10dc5760df1248569624be9
-
Filesize
6KB
MD598f3974fa8450b8bd5afc860cc9b9e0f
SHA1da135d0cfced99333424df921b59cb661991eb3b
SHA256d40814d44a0737feda228d2db9ff346655dca5e9e0a98a2bf30d0f3cbf4c78e6
SHA51277fb31398249e41c5743c0b792b1661167477dfd990b6d1bedd736267451defcbee3d98fb5d741d012e80565ef94152834bfffa74464de4421b0323b79d178ff
-
Filesize
114KB
MD5b433f7e158c69c7134f5b9ee3694f348
SHA1a393c0ce8bdd73fe9c30d82659cdd30d33aa897f
SHA2562f5da229fb453e40bfb4fe55a2778a8a1ae08f35f9cebefb1711936a57d8d3f9
SHA5126954fbd170ccb9f2c698e78367978751c4806519f2c7746838f0f2a0e2984d54478d82c3e858593b4b3ed9552fcd003392645e7698f78ad15b24faa21221cef1
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd