Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
01/02/2024, 06:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://api.openai.com
Resource
win10-20231215-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
http://api.openai.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133512428025829411" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4408 chrome.exe 4408 chrome.exe 2680 chrome.exe 2680 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4408 chrome.exe 4408 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe Token: SeShutdownPrivilege 4408 chrome.exe Token: SeCreatePagefilePrivilege 4408 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe 4408 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4408 wrote to memory of 2360 4408 chrome.exe 14 PID 4408 wrote to memory of 2360 4408 chrome.exe 14 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4008 4408 chrome.exe 24 PID 4408 wrote to memory of 4628 4408 chrome.exe 19 PID 4408 wrote to memory of 4628 4408 chrome.exe 19 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23 PID 4408 wrote to memory of 4548 4408 chrome.exe 23
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffbfdf39758,0x7ffbfdf39768,0x7ffbfdf397781⤵PID:2360
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://api.openai.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1804 --field-trial-handle=1776,i,6975947487852894464,12699444954232623809,131072 /prefetch:82⤵PID:4628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2668 --field-trial-handle=1776,i,6975947487852894464,12699444954232623809,131072 /prefetch:12⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2660 --field-trial-handle=1776,i,6975947487852894464,12699444954232623809,131072 /prefetch:12⤵PID:652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2088 --field-trial-handle=1776,i,6975947487852894464,12699444954232623809,131072 /prefetch:82⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1776,i,6975947487852894464,12699444954232623809,131072 /prefetch:22⤵PID:4008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 --field-trial-handle=1776,i,6975947487852894464,12699444954232623809,131072 /prefetch:82⤵PID:2868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4904 --field-trial-handle=1776,i,6975947487852894464,12699444954232623809,131072 /prefetch:82⤵PID:2996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 --field-trial-handle=1776,i,6975947487852894464,12699444954232623809,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2680
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2500
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1014B
MD571290b1b1f4f110b809fea0004e2a0d4
SHA18fb5d5555cb453e466f8a2f7a65d2c0832296b88
SHA256770a9e3e3a0e4f07b465067312bf717bf15bafd4a33f90d23e490fd2258a7dec
SHA5124fb4a215b484866fb107248c2859781a28926b44b1180d676cd277d859f5a37174b0fba0ac766209467694d164c4e8a8a87878e13f0434adabd7161221d83582
-
Filesize
538B
MD53eb527d516927a4a1872da038da6225d
SHA163c9292b32a1e26df76e7f1f0cd433633d300e4c
SHA25696c578e4c0c4e178831df0700196207dad11f02027b61c6bc5f9343611a90808
SHA512d74947451b702c2beb9535de7d12279e61c6602ff4cdf93dd1c4d82923c9b04cfae91edbe1b1cc66cd4a68f030e4ff446730e1c1895ef3ff1277c3c37c4ecf8b
-
Filesize
6KB
MD50e934beef97e851ec1f020b3e01a972d
SHA1bb8a8e4de45ad2e84e6d34b6ded3c882cd3b9b7d
SHA2565ad152976ace932eb2bb578f3c995cadc22d44efdfb2c30a28036bda9d368205
SHA512f545a9abc55a7be29675cbcf81b6bac67e046e1f0d62149e207e201b3e0c13f8ab67edf7d0307acd567e36d32b1cbc03c3368d50f16a8da7b5bd67690dd90786
-
Filesize
114KB
MD55bfc3896cbce7137002c146ffc9fb83e
SHA152f05885fdeeaa64216ff106207541214f0ce0f3
SHA256db32bc9f824a2076611e73cdfbbe818029b77981b7777176e2dc1fab88e07405
SHA51293729c317e57a1bca3265d16f80834da4e6d27f6b973eb4af3170bfcbca3c3e4d328d805d5ecb950a09c76136be289795aeaddc73efa53617e7d25b09f9b8dad
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd