Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
87s -
max time network
89s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
24/01/2024, 09:23
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://hosebk.dk/pakkelevering?__s=8wlgl0onprmr4e0uj8l6
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://hosebk.dk/pakkelevering?__s=8wlgl0onprmr4e0uj8l6
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133505618031621494" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2272 chrome.exe 2272 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2272 chrome.exe 2272 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe Token: SeShutdownPrivilege 2272 chrome.exe Token: SeCreatePagefilePrivilege 2272 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe 2272 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2272 wrote to memory of 408 2272 chrome.exe 69 PID 2272 wrote to memory of 408 2272 chrome.exe 69 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 1304 2272 chrome.exe 92 PID 2272 wrote to memory of 4208 2272 chrome.exe 91 PID 2272 wrote to memory of 4208 2272 chrome.exe 91 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90 PID 2272 wrote to memory of 4424 2272 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hosebk.dk/pakkelevering?__s=8wlgl0onprmr4e0uj8l61⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd67a69758,0x7ffd67a69768,0x7ffd67a697782⤵PID:408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2184 --field-trial-handle=1868,i,14771619591622766296,13321913536114599542,131072 /prefetch:82⤵PID:4424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 --field-trial-handle=1868,i,14771619591622766296,13321913536114599542,131072 /prefetch:82⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1868,i,14771619591622766296,13321913536114599542,131072 /prefetch:22⤵PID:1304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2932 --field-trial-handle=1868,i,14771619591622766296,13321913536114599542,131072 /prefetch:12⤵PID:2812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2940 --field-trial-handle=1868,i,14771619591622766296,13321913536114599542,131072 /prefetch:12⤵PID:544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4588 --field-trial-handle=1868,i,14771619591622766296,13321913536114599542,131072 /prefetch:82⤵PID:2752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4848 --field-trial-handle=1868,i,14771619591622766296,13321913536114599542,131072 /prefetch:82⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1044
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD507a7f08890bca7b2a2bd23214e7107ae
SHA1a4e2e1635da50ac446d48351ddd680ae417416a7
SHA2569bb3fb919218225dd141ae3e8b935ec801f2be58d0b4d9532f95cd04ce4780ac
SHA51244af8adc3f423cbe98ae6db452341995a4df5ed4c0751714590705264baaa9d7dfe5f592ed6f7a64da372065d0e5e54460dfd7a7de55a5ad709e875a063627bc
-
Filesize
538B
MD510fa651237ac8d14be42118f6c6f4556
SHA18e83253521ae46213edebdde4770280a43cf2e93
SHA256f434ab9d38f157cf4c430d04268dea729dfba6af87b416ea9983c379325f7ece
SHA512152541a3f46fbd89d454bbf7d5308914279b393ae56086a3c52d491c05b6efad599dc4c5ea8f6a8b2ede6a291e7a8e17e1add93fb48f9943ae4e17fe43fc7ae5
-
Filesize
6KB
MD533096e58a56a483fc7c76b1348680a88
SHA1e30c1069f57cdd1daa25405b111d3e48978f5b1c
SHA25665c0a9a81c4658cef4fec7f867de85ffad7220524c894a19cf221db6dc116465
SHA512e168085878998f65eda617f3333a2177fd382b5800226d2c2d595d886a2c6d8248740d4cb48848021e7f1cec391c1702c27938ba693817a4f18ba662499a2e5b
-
Filesize
114KB
MD5b8a7402fb16c37d655f2f68294c781a2
SHA18bb5c4f328333c836ca661982c2103a07342b219
SHA2561dcead5244677df30aedd276e70d419bf2bfeb1d2001b161d423511b1045acd7
SHA512fcc7b4a6806c6c487b04856de86a1fa7db3c69c2b3e5bf1305c13faaf75524a115205c4457e000567e729ee1c9638b763b3b040481e2f8933ae2f91a08e40854
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd