Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
300s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 01:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://royalrumble.prime-video.stream PAGE URL
Resource
win7-20231215-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral2
Sample
http://royalrumble.prime-video.stream PAGE URL
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
http://royalrumble.prime-video.stream PAGE URL
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133507076728497935" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4036 chrome.exe 4036 chrome.exe 1736 chrome.exe 1736 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe Token: SeShutdownPrivilege 4036 chrome.exe Token: SeCreatePagefilePrivilege 4036 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe 4036 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4036 wrote to memory of 4708 4036 chrome.exe 33 PID 4036 wrote to memory of 4708 4036 chrome.exe 33 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 2208 4036 chrome.exe 81 PID 4036 wrote to memory of 4364 4036 chrome.exe 85 PID 4036 wrote to memory of 4364 4036 chrome.exe 85 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82 PID 4036 wrote to memory of 2400 4036 chrome.exe 82
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee4b99758,0x7ffee4b99768,0x7ffee4b997781⤵PID:4708
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://royalrumble.prime-video.stream PAGE URL1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1752 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:22⤵PID:2208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:82⤵PID:2400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2820 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:12⤵PID:1500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2128 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:12⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:82⤵PID:4364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3844 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:12⤵PID:3584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=2128 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:12⤵PID:4180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4956 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:82⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5080 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:82⤵PID:1156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3724 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:12⤵PID:3048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4148 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:12⤵PID:3776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=4088 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:12⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1876,i,10044376307227187471,4113885770312873116,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1736
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1732
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824B
MD59c3192c1f32fa20f9167316e4aebaf03
SHA1c7414e1d3904c03e8d88e20244c18270231fd06c
SHA25631d0b839365cc62e692b9c2fcb8908a3d6cd305ef8a339920bdda358fc705215
SHA5123ce6f5efb45c7124cc0dc76175a1e37731d7dc08b585a64be5d00e2c1a94da22bdc77218539aa239b0687e96c6fea388480451dfbfc57024ae4991d3f52c2d19
-
Filesize
6KB
MD5bed7fc8b3c6056942a8b124a55c4aad2
SHA1579e76f6ec76fd219be053c17cba5a9d6c2d24ee
SHA256c51a095322cb18470f55872a4943c49f7f5e1a31408b313229855df6205e54f7
SHA5124b83a15af49926d5c467519377399572d4a497ab4e18e759de4424867d68c93a7d839c950bf30de81ebe9c6f554321a114a25bcb0e93825ae98f63ce2b05f2ba
-
Filesize
6KB
MD58f6c33a56543631dae1814515d9676bc
SHA101d1f816b42138db7936a10677c081383d562e49
SHA25626346119161a2f962102ae48f7128c0e434e3c276eab35c78d8f4e9f1d752175
SHA512d0ea76125e9443460987431e5e22c3c6b9c9c12c88cce721f33532f204c8d6264c69d05e82c7187a0d5b31ebda3bda4f387d93d979588056952c97c51e1fbe30
-
Filesize
114KB
MD59b8a6e7a1ebe5ba8fbec57dff07ad8b0
SHA1c6d0067eca3815caaa9b48f6f0cdd35d06b019f0
SHA256393e780741e6a8f71400a4cdc85fd943c571b5438a4334d00e6c0bd77fbe927e
SHA5120135d13354fa3502ae29b0078adcb40816b87c29803c7926e8d317f15309f43adcca4271d081b21ea2438b7cfd564265308f270380f1e49626b7c2e99265248b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd