Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 21:36
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://campaign-statistics.com/link_click/NvVW1fWPG9_LRkAk/fe50752240d4e200305ed89f50e50f06#bWdsZWVAbG9ja3Rvbi5jb20=
Resource
win7-20231129-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
https://campaign-statistics.com/link_click/NvVW1fWPG9_LRkAk/fe50752240d4e200305ed89f50e50f06#bWdsZWVAbG9ja3Rvbi5jb20=
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://campaign-statistics.com/link_click/NvVW1fWPG9_LRkAk/fe50752240d4e200305ed89f50e50f06#bWdsZWVAbG9ja3Rvbi5jb20=
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133506057828048288" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4892 chrome.exe 4892 chrome.exe 3816 chrome.exe 3816 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4892 chrome.exe 4892 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe Token: SeShutdownPrivilege 4892 chrome.exe Token: SeCreatePagefilePrivilege 4892 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe 4892 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4892 wrote to memory of 2836 4892 chrome.exe 86 PID 4892 wrote to memory of 2836 4892 chrome.exe 86 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4980 4892 chrome.exe 90 PID 4892 wrote to memory of 4696 4892 chrome.exe 91 PID 4892 wrote to memory of 4696 4892 chrome.exe 91 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92 PID 4892 wrote to memory of 2932 4892 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://campaign-statistics.com/link_click/NvVW1fWPG9_LRkAk/fe50752240d4e200305ed89f50e50f06#bWdsZWVAbG9ja3Rvbi5jb20=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff870129758,0x7ff870129768,0x7ff8701297782⤵PID:2836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1944,i,7146360711434218396,10914804617524254263,131072 /prefetch:22⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1900 --field-trial-handle=1944,i,7146360711434218396,10914804617524254263,131072 /prefetch:82⤵PID:4696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1944,i,7146360711434218396,10914804617524254263,131072 /prefetch:82⤵PID:2932
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2980 --field-trial-handle=1944,i,7146360711434218396,10914804617524254263,131072 /prefetch:12⤵PID:3796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2988 --field-trial-handle=1944,i,7146360711434218396,10914804617524254263,131072 /prefetch:12⤵PID:2660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4780 --field-trial-handle=1944,i,7146360711434218396,10914804617524254263,131072 /prefetch:82⤵PID:4708
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1944,i,7146360711434218396,10914804617524254263,131072 /prefetch:82⤵PID:4276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=824 --field-trial-handle=1944,i,7146360711434218396,10914804617524254263,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3816
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3480
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5797b284f172e17eccf16fdc6dbeb814e
SHA1b8ea3ffc25c9705761c9a186ab076f299f9303ff
SHA25699a66fef5a437d29b92ea07dd91c290b1294c6dda360b0ced0e9f803239a3d52
SHA5120216fe4989a2553db70aa9b12101d3751d36d9d6bc71e09868407bc3f6d1936cfc5b0884c69095569b67e5c62fc55c3c2b7f851d5a6fe45a3fa1f976207241f7
-
Filesize
538B
MD547c9f46866c828019bd10559e68a8096
SHA1f8bae3eaca416378d8174cfd5641414600551d77
SHA2565f69eac1e96eb27af0d5d5d063a57305215fa9eb0c8736628901731e1cbdb7b9
SHA512c3b23a6d600ec18d5ed3dd17657296a002f5627b74a12ee2e11a3fae3e6c08b42de52054bb679711ac2310e46ced2298d5dfe996003d1fd213c39fe557824dcd
-
Filesize
6KB
MD5122dab9214c29cf817d7f08df3da3572
SHA193699ad41da19d170df72308081acd5b3193722c
SHA256edb02ef004fc03334b121306396302299fb00de13813a5684f9a19783c239650
SHA51283b2139f50923e51f954b03f3da858847cf03f0277eca79d8d10ac974793a5089dfb415dd555f190463dfcbac4d0a621ba9678570a11700201424bdaf86ddd9f
-
Filesize
114KB
MD5eaa7396abaff6c60c5c1cdc09e6cd780
SHA1df13ce3187cb6b3cf778b85463413e8e8cf77cec
SHA25611db01892094c3846ffdeaef17a3edb0c2df3d1c008766e4318437312ce2cc46
SHA512f576cea4a91523d351d1d02589e33127c4c3966777f8fb43fab93a296f73c072907bfcc95ccd8525b74dfdb0aefc3c8ed778a0c69f0cf3a1fd1f5a594503b74e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd