Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
23/01/2024, 08:48
240123-kqkq3aheg4 823/01/2024, 08:45
240123-kn67aahef5 823/01/2024, 08:08
240123-j1xypsgffl 8Analysis
-
max time kernel
299s -
max time network
297s -
platform
windows10-1703_x64 -
resource
win10-20231220-en -
resource tags
arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system -
submitted
23/01/2024, 08:48
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://stats.sender.net/link_click/NssHPgqwkq_LMXim/6c2e336604abee32f8d27926f4ed689e#YWx2aW4uZXN0ZW1iZXJAaW5zaWdodC5jb20=
Resource
win10-20231220-en
General
-
Target
https://stats.sender.net/link_click/NssHPgqwkq_LMXim/6c2e336604abee32f8d27926f4ed689e#YWx2aW4uZXN0ZW1iZXJAaW5zaWdodC5jb20=
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133504733187921379" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3568 chrome.exe 3568 chrome.exe 4652 chrome.exe 4652 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe Token: SeShutdownPrivilege 3568 chrome.exe Token: SeCreatePagefilePrivilege 3568 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe 3568 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3568 wrote to memory of 1792 3568 chrome.exe 70 PID 3568 wrote to memory of 1792 3568 chrome.exe 70 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 1844 3568 chrome.exe 77 PID 3568 wrote to memory of 4852 3568 chrome.exe 76 PID 3568 wrote to memory of 4852 3568 chrome.exe 76 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78 PID 3568 wrote to memory of 3844 3568 chrome.exe 78
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://stats.sender.net/link_click/NssHPgqwkq_LMXim/6c2e336604abee32f8d27926f4ed689e#YWx2aW4uZXN0ZW1iZXJAaW5zaWdodC5jb20=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffb92ab9758,0x7ffb92ab9768,0x7ffb92ab97782⤵PID:1792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1816,i,5415891313549948655,10818715945313470715,131072 /prefetch:82⤵PID:4852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1816,i,5415891313549948655,10818715945313470715,131072 /prefetch:22⤵PID:1844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1940 --field-trial-handle=1816,i,5415891313549948655,10818715945313470715,131072 /prefetch:82⤵PID:3844
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2832 --field-trial-handle=1816,i,5415891313549948655,10818715945313470715,131072 /prefetch:12⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2840 --field-trial-handle=1816,i,5415891313549948655,10818715945313470715,131072 /prefetch:12⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3748 --field-trial-handle=1816,i,5415891313549948655,10818715945313470715,131072 /prefetch:12⤵PID:4672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3100 --field-trial-handle=1816,i,5415891313549948655,10818715945313470715,131072 /prefetch:82⤵PID:1980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3056 --field-trial-handle=1816,i,5415891313549948655,10818715945313470715,131072 /prefetch:82⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=860 --field-trial-handle=1816,i,5415891313549948655,10818715945313470715,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4652
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3796
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD51e9c558de41adc6a5823653ed680d9e2
SHA13ced90c7d032343223419e848ee4d67e5f694155
SHA256756d6dbad9a98f05f754eaa01d5e2267b294b765a27c5e6158b5e72b89d2c9fe
SHA512e5ec9af6fb6573d3a905774c20de3f1c4c74b7dbb7771ae60ce670f153a21ee6d2b0cbf0cc0dba6c7c3e20f23763e753037a453a70ac8c2554dc0f35b2f973da
-
Filesize
1KB
MD5cc3b4457a2ed523f7cac6db94d14e1fb
SHA1d2df10a99114efa4de77f445546fbb333f2b2063
SHA2563eccf4e7dbf67205b6d93422d84d84d5a6135420a9d974f25b559aead388f214
SHA5122e7677b8c7ac72bbd679f5a9f24aee162c8710ebf91e1a98b4e4bf352cd2c0e8754495f6fb80047b4c8e76c02d37a127c99c35afb36d298747c93ebd7ce65098
-
Filesize
706B
MD51847524f10d5105eba805dd6e79cb78b
SHA16cc39261cff6c48905574623c11d11005ee3112c
SHA2564f35ee4a7e26ef4c0fa5f3810846cf797687826bbe27df2f67a91c9b4c6d196b
SHA5125eacd43451cdda2a5576a20c3143d24a0c21542e4f20ce195f43dba903e6dd50370c341dd6ad71e33214e3c73dd0001325a78c250c0086cd6f9462da24dfaabb
-
Filesize
6KB
MD554975175064da3d8b1c25dc1f7f9b371
SHA15e63449eb701da9b8999c9aa5888116f40baf471
SHA2566253a9f2dd6138eea99e16bdd921e1c511e6676f209685adf52a7ce482b7636b
SHA512d7fce607de14a1f3ddd39e38f7bf873cd657867d79719bb0d486be3e9e20fdd223e77bef221fcb57dc50226b2b9d32982f44753470f269854e8142b7a45a80c8
-
Filesize
6KB
MD54892b500208cfda1074ca4fbcdc5a039
SHA1c0ea4917bd10838b849ebde0eb6a2d520e6eca4a
SHA2566f9e019f6897a30a9cb9726238a644d6548aebf6fe0f80cf614dfd160238c5d0
SHA512665096fca31008aaa2ffc277a713741f5a9642c9a9e52aa31ec74783df5be3203f55eca12e28ef71282cd431a2edceb26d5b3a85f5d0b80298e823805ae36343
-
Filesize
6KB
MD5ad5e2d616aadb2c85853889e01c53e62
SHA1882d7f17f2bea86833feab9f993ac2c59bd75688
SHA25636ca0103dffb96c498b4c987c15bb1273b1274d34123defa2c7d5ced7a28b52e
SHA51267309554bbae0854f003faabd16abc24f0cf4828ec11cd536d05844c6f1bfb208a1a8734bb986edd19c6f9e30c89307c62871935fcd05a96ddd68c0abc019fad
-
Filesize
6KB
MD5d309c937b88dc0f793d05a133e7f8e3b
SHA10b3b0fc6dece42a3e079a546974f50df1f7da89c
SHA256e37d062bae3c108e349fd78822fc1bf935c76f265885e1c1fb337da5c0fb3018
SHA5125b67054e27a61dbfd129e281e0d4ccc95236688c315f641f9b7635ee9ac7d1d58f33d887d01cec192f87697aa47fc7921f1c44f24a5c402bccf55267190ef04e
-
Filesize
96KB
MD509426ff60d8139b049998e64e6991cce
SHA1ffe5a26c24a58eab2927c5c2d135946ebd6097c6
SHA25618bacae17e1806cf8278f6e4ae3981db3756aeb726acd9356ca16ebcdbf4b110
SHA5125b6a8661ce96dd0875562278962ef0224ed8e4fe093c549370871f71fa09c51c568a7cb14f07c138a5b51eb1ed65886aaf993f8bd028544b61223cfc30f879f8
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd