Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
26/01/2024, 03:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ns.attribution.com/ads/1.0
Resource
win7-20231215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://ns.attribution.com/ads/1.0
Resource
win10v2004-20231222-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://ns.attribution.com/ads/1.0
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133507151069825770" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 224 chrome.exe 224 chrome.exe 2648 chrome.exe 2648 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe Token: SeShutdownPrivilege 224 chrome.exe Token: SeCreatePagefilePrivilege 224 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe 224 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 224 wrote to memory of 1188 224 chrome.exe 75 PID 224 wrote to memory of 1188 224 chrome.exe 75 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 4012 224 chrome.exe 88 PID 224 wrote to memory of 380 224 chrome.exe 90 PID 224 wrote to memory of 380 224 chrome.exe 90 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89 PID 224 wrote to memory of 1656 224 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ns.attribution.com/ads/1.01⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:224 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83cf09758,0x7ff83cf09768,0x7ff83cf097782⤵PID:1188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:22⤵PID:4012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2224 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:82⤵PID:1656
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:82⤵PID:380
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2876 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:12⤵PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2892 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:12⤵PID:744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4080 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:12⤵PID:2792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3352 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:12⤵PID:3504
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3964 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:82⤵PID:3592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5068 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:82⤵PID:4460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4032 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:12⤵PID:4052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2704 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:12⤵PID:3592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=3376 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:12⤵PID:1440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 --field-trial-handle=1796,i,1822669098757861645,6532188424063488720,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2648
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824B
MD5a1c88f595024f94549ed31867294c80e
SHA171e28f5b62bb661307151ed85e9f1ede7cee691c
SHA256c1fc7f195e3095f440228e888e591749b1caf06eacb14b01b88ff30148d70abc
SHA512304b54db7632d3cc00780a5c62142d65292b79c493241c689ddd7ace68c6571c9a0eb92f6f4b45503081f7d04ee75a212d40d08bf046757138de79742b1cae6b
-
Filesize
6KB
MD54e5f85b1de7ab03c44cc5b6a7412fd77
SHA1e57fa11dad623987c75d2a1555c5368a460278dc
SHA2567f39e40d81e546b9fd79f11b049149dbcde4eaef433800b4930383f3ace3dd7f
SHA512bb5b717e02ecd3950ba637d3962e58f2753a9583fef9dd5eb14f152fd6b3a335a741529840bdf07b7515c8948d53bfb83eb589051de22e1b6793e95b5371da0a
-
Filesize
6KB
MD5e6418ea3ad51e4619ebcaa5b9e48b736
SHA19a9d9b2e0a1d6a100e07373644fdb04662681600
SHA2564e3de40de8eb11410d2b7ac5fc50f7fd300fada48ff03e21b06847dd88b87610
SHA5127b71ff839b3ff21d42da249670734ce8861ab775be61786150a9e1fb90feea248f564284e1fcfe6c83e1300767684c7745b6fa731bbd8b05e98c9c7b5740358e
-
Filesize
114KB
MD5a9e413f74e951ee3e0579630cfa27f79
SHA13ddb29a326ce15f24e88a2adbc0e494149572f83
SHA256125a7897e54d8d5c316b54e82d383913bc210df999bb3963192e5b111ecf6a14
SHA51276efdceef84c4858a252f0856038d9da6c95981f031fe91ec422c1d182726e657abaf6618029b723f00451af03b65bc8c2a8bd22d2f420bef9b274386ffde28f
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd