Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
60s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
26/01/2024, 18:30
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://r20.rs6.net/tn.jsp?f=001Els6v6Ub3yOHrQKr_iJZpySCDL4mgQoKLrYspQLH-62bJS9Hm7pSErgbfH3NLkoy6JZnfNAhmquuh66YA2r_wbqP1npRzzcRAXmOeWyA3m7Ph-j4GYjGUcg4i0psTy8vjm31AfRO9c_F42X1EOYSZOfORTORO_qSKNSp9FU9xMs=&c=&ch==&__=/d2lsbC5pLmFtYnJvQGdtYWlsLmNvbQ==
Resource
win10-20231215-en
windows10-1703-x64
8 signatures
60 seconds
General
-
Target
https://r20.rs6.net/tn.jsp?f=001Els6v6Ub3yOHrQKr_iJZpySCDL4mgQoKLrYspQLH-62bJS9Hm7pSErgbfH3NLkoy6JZnfNAhmquuh66YA2r_wbqP1npRzzcRAXmOeWyA3m7Ph-j4GYjGUcg4i0psTy8vjm31AfRO9c_F42X1EOYSZOfORTORO_qSKNSp9FU9xMs=&c=&ch==&__=/d2lsbC5pLmFtYnJvQGdtYWlsLmNvbQ==
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133507674244834350" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 208 chrome.exe 208 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe Token: SeShutdownPrivilege 208 chrome.exe Token: SeCreatePagefilePrivilege 208 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe 208 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 208 wrote to memory of 4112 208 chrome.exe 15 PID 208 wrote to memory of 4112 208 chrome.exe 15 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 3696 208 chrome.exe 21 PID 208 wrote to memory of 4264 208 chrome.exe 18 PID 208 wrote to memory of 4264 208 chrome.exe 18 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17 PID 208 wrote to memory of 1088 208 chrome.exe 17
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://r20.rs6.net/tn.jsp?f=001Els6v6Ub3yOHrQKr_iJZpySCDL4mgQoKLrYspQLH-62bJS9Hm7pSErgbfH3NLkoy6JZnfNAhmquuh66YA2r_wbqP1npRzzcRAXmOeWyA3m7Ph-j4GYjGUcg4i0psTy8vjm31AfRO9c_F42X1EOYSZOfORTORO_qSKNSp9FU9xMs=&c=&ch==&__=/d2lsbC5pLmFtYnJvQGdtYWlsLmNvbQ==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:208 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc52139758,0x7ffc52139768,0x7ffc521397782⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2104 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:82⤵PID:1088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:82⤵PID:4264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2956 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:12⤵PID:2340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2948 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:12⤵PID:3808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:22⤵PID:3696
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4532 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:12⤵PID:3896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3824 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:12⤵PID:1436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4896 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:12⤵PID:4020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3080 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:12⤵PID:4976
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4768 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:12⤵PID:2456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:82⤵PID:4296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5272 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:82⤵PID:1496
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=4772 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:12⤵PID:2272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=3172 --field-trial-handle=1776,i,4146686286705779948,4179744441065967163,131072 /prefetch:12⤵PID:1116
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4248
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288B
MD5297c30f12eadb9fef8586cb98f0ac65a
SHA135ffc714d90dae6fb4e8fb83b3e39d78e9a31ce9
SHA256b8cb65c0301188b9a9bc4af3af3a71734882ddbe4a0a143d2f0c3a571db46cad
SHA512f5e4b9cc84fb1f051da453584c8c3eff0bc1897b1a8573933d931c7cd527aaafc17e87d8a129bf6e543f7dd469e30c11059834954a38547b01cb2f8876618fbd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\6c660740-2740-4c58-8f2d-e6fc82ecd950.tmp
Filesize538B
MD5b16398daa42ce3d13d49933812913b59
SHA154cb85ab6bc2e66f27bcee3947e6356873dde0c6
SHA2567a737215899d1fa44d9326386b040d9cc10d7c0dd8d5cf6fcb32992c4fbbec67
SHA5122128cb4c91880c9e019297715a5133b68b4dd164b11c108984596b239dc2b275385b5fefd15cf85b544176609a41cd87b9eca13d0edeaafefeaab2c1c93d7085
-
Filesize
1KB
MD579d63c4f4f91ca169d093a7a332513a2
SHA150d3844381ccf65f7e97858dae314c5e3bcaa3ed
SHA25630a144982611274d7bca06e46256fa1c3d320c76e7623d107af95f7a69e0470e
SHA5129ad55b303fed3fb068b27d26e26911d87b564b9303a216e4721d04ec0cc90cf4a9ee4b2a8dc497746b6aea4bce07f0204ce91d89cba212bfcb01d40c92cc6d89
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\b36a1d93-1a92-43b8-8c44-88b9967fda50.tmp
Filesize6KB
MD5bffc33f041c3bccfc12adae1279197f8
SHA17bcb0427399b350fb3d56669e569a0634650cfcc
SHA256c7cf604f83d7f1fbee9e5f5ed57a2798a3c93d9429e7a3ef0fa7e716bee86e2d
SHA51278cae5c498840bbfc94f19540608563f801711bddb99ae47529cac3f0f41f927f13c769a47234768c20776a29ea56fe822570591441e5dae4fe36b270e96c3b5
-
Filesize
114KB
MD5bc0bbc8a01a0e9c6f499f6d1e69ce7e8
SHA120a353a0483381936efd5d766687bdb8ed568853
SHA2567a30e870e7747e37ceeabd2e29ac7ea9b45bdfd6bc9741f5cfcfd1dba6d8d818
SHA512ce2de48fdedaa4afcee676a31eba797aac28804110d051c718fd3418148b2c1d5de3059a94bd6f11fdbcd89f8a91bfbc3a113ed32cd6ead7569397fd6e7b84b4
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd