Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
02/02/2024, 23:00
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://vadria.net
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
http://vadria.net
Resource
win10v2004-20231215-en
General
-
Target
http://vadria.net
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133513884676223876" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4200 chrome.exe 4200 chrome.exe 2412 chrome.exe 2412 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe Token: SeShutdownPrivilege 4200 chrome.exe Token: SeCreatePagefilePrivilege 4200 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe 4200 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4200 wrote to memory of 4320 4200 chrome.exe 84 PID 4200 wrote to memory of 4320 4200 chrome.exe 84 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 3960 4200 chrome.exe 86 PID 4200 wrote to memory of 1168 4200 chrome.exe 87 PID 4200 wrote to memory of 1168 4200 chrome.exe 87 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88 PID 4200 wrote to memory of 884 4200 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://vadria.net1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4200 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5ade9758,0x7ffb5ade9768,0x7ffb5ade97782⤵PID:4320
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 --field-trial-handle=1856,i,7183456700111437741,1496410932418764007,131072 /prefetch:22⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1856,i,7183456700111437741,1496410932418764007,131072 /prefetch:82⤵PID:1168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1856,i,7183456700111437741,1496410932418764007,131072 /prefetch:82⤵PID:884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1856,i,7183456700111437741,1496410932418764007,131072 /prefetch:12⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2876 --field-trial-handle=1856,i,7183456700111437741,1496410932418764007,131072 /prefetch:12⤵PID:1432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4504 --field-trial-handle=1856,i,7183456700111437741,1496410932418764007,131072 /prefetch:12⤵PID:4888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 --field-trial-handle=1856,i,7183456700111437741,1496410932418764007,131072 /prefetch:82⤵PID:2336
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3124 --field-trial-handle=1856,i,7183456700111437741,1496410932418764007,131072 /prefetch:82⤵PID:3508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2496 --field-trial-handle=1856,i,7183456700111437741,1496410932418764007,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2412
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
504B
MD54d842d7e035422b0fab89d3db9cb311f
SHA1d1a72fcfa85932d4fc5b6333efc50cefa3f1b1e5
SHA256dc3b73fac113becec9fdf714e533a66deedc9a6eae38a62a28b940b5d80609a7
SHA5125ea583eaec8663559df2330cd43554a3ff5f146928e450cb88761e5d752f600e7513cbe2f097d651b7c3844bad5de43233098a4bdfb25a147ba900c852eb0b3f
-
Filesize
1KB
MD533418f09fafcf36030ae1405276bd0b2
SHA1b25f18c880c0331ea9984406b62ae74341073e8e
SHA256d5b0f5fa288a22f39f0b953629be4b9f3a64cb991c2586697837fa5edbe7f698
SHA5126eba41908b7777a455fe449595d97e8cbf5de314034e6d3eba5d3d010291526d493b61b2d01e3ab700542044615595c5bf16c094e5847828891d41c89ccffc6c
-
Filesize
870B
MD5d27aa507d54ce2863bbfc01b36e07dd7
SHA15739cd9f5176ac968028aa359d659104bb3b8ba1
SHA256bfac103cd0f50d0ac3a5b3403b926205ec747a092b8dafa810a1a3c3162bd328
SHA5121d378f4640104607de34dddd7acc00c1fd6d74e518bfa4590aa357a55cd0ab6410e19a04e37318b6e349b0b6593a7d9f908d553f10df18e9aecca529a6b268c9
-
Filesize
6KB
MD59d04d1060bf81c2be7262d13dffdb442
SHA11c1e920332b32221937dbc6c8e6b4fca07e63538
SHA25695144fbdefc43275223b5583d5fe603f4686c6e63cf2298c736f4d1e84d50c9a
SHA51207f469ef62f3a036ae234587760a84ba85c073d277e4e7b9f865690a0ee9c8daa1e922c1a5d35f0efb42a887c7529b03ca1bd18d794ad92fb14bcd492c54e750
-
Filesize
5KB
MD5fe91eabfed660fccd2b468b471793f2c
SHA1269e731b8e95ede9e45caab964e32fb3ec7b5f95
SHA256f7289d6d4c2e8efe2b95afed7bb8fc7434e681b992dc54a168bf2233bb70777d
SHA512a32d0fdafde4bc9e896eb2fe58b2346c5e4815cfc96f7603aa15bab137d192a54d23a7ed881538e23b5fef432e187e0defdf33de80fd6b0aa484173d476db784
-
Filesize
6KB
MD55d2e09dbfe83f1f6c53cf5242a3eec12
SHA117cf14275ea6182ee939990dbc078ac3736115ad
SHA2561e6762c99935c50585047111922373e26a08ad47db30f4d42762b618a9e48785
SHA512181ff7feb58831fe9769c7649b9d6672049cf2108b3b481b3c14035a501518d792ff2a9a0dea4e7c214f6914684127ed1cbae1acf08eb392dff4bb934290f353
-
Filesize
114KB
MD5b91efaaf8de33b1a52826bcddb51930c
SHA1ca01e0b8e5166273e824adc3969d6ba48539c870
SHA256d3596646a47d43822d6b3e61304ac9e963ee3da38afd962d3aae03dc19f2fc90
SHA512d7fbec7a72a2985c44d88400d98c5076f3a1f0fa0788512ab881c9c5b1013718e56acd1ab73f34a672ad73b8c9bf682d19c0de7601bd7f1910508e349ea6a5be
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd