Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Resubmissions
12/02/2024, 13:21
240212-qlwwesgb76 6Analysis
-
max time kernel
59s -
max time network
52s -
platform
windows10-1703_x64 -
resource
win10-20231220-en -
resource tags
arch:x64arch:x86image:win10-20231220-enlocale:en-usos:windows10-1703-x64system -
submitted
12/02/2024, 13:21
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://iaict.org/
Resource
win10-20231220-en
Behavioral task
behavioral2
Sample
http://iaict.org/
Resource
android-x86-arm-20231215-en
Behavioral task
behavioral3
Sample
http://iaict.org/
Resource
android-x64-20231215-en
Behavioral task
behavioral4
Sample
http://iaict.org/
Resource
android-x64-arm64-20231215-en
General
-
Target
http://iaict.org/
Malware Config
Signatures
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 20 api64.ipify.org 23 api64.ipify.org -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133522177127528981" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2156 chrome.exe 2156 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe Token: SeShutdownPrivilege 2156 chrome.exe Token: SeCreatePagefilePrivilege 2156 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe 2156 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2156 wrote to memory of 4820 2156 chrome.exe 59 PID 2156 wrote to memory of 4820 2156 chrome.exe 59 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 1132 2156 chrome.exe 77 PID 2156 wrote to memory of 4184 2156 chrome.exe 76 PID 2156 wrote to memory of 4184 2156 chrome.exe 76 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78 PID 2156 wrote to memory of 376 2156 chrome.exe 78
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://iaict.org/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffacf319758,0x7ffacf319768,0x7ffacf3197782⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1760 --field-trial-handle=1840,i,10305487217912423314,2431546772130395650,131072 /prefetch:82⤵PID:4184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1512 --field-trial-handle=1840,i,10305487217912423314,2431546772130395650,131072 /prefetch:22⤵PID:1132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2024 --field-trial-handle=1840,i,10305487217912423314,2431546772130395650,131072 /prefetch:82⤵PID:376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2696 --field-trial-handle=1840,i,10305487217912423314,2431546772130395650,131072 /prefetch:12⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2688 --field-trial-handle=1840,i,10305487217912423314,2431546772130395650,131072 /prefetch:12⤵PID:2444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1840,i,10305487217912423314,2431546772130395650,131072 /prefetch:82⤵PID:3036
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4500 --field-trial-handle=1840,i,10305487217912423314,2431546772130395650,131072 /prefetch:82⤵PID:4980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4748 --field-trial-handle=1840,i,10305487217912423314,2431546772130395650,131072 /prefetch:12⤵PID:872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 --field-trial-handle=1840,i,10305487217912423314,2431546772130395650,131072 /prefetch:82⤵PID:4020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4976 --field-trial-handle=1840,i,10305487217912423314,2431546772130395650,131072 /prefetch:12⤵PID:3980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=5160 --field-trial-handle=1840,i,10305487217912423314,2431546772130395650,131072 /prefetch:12⤵PID:4968
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1300
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5a49555532350e1611a128fb6c47f6d79
SHA1382dbe71f46f13c67d8f9e27e447b5f2a10b6a69
SHA256f2999b2fb887da8d33708384ed8f1218a2a751c7b3e8ba62ed2bddb9d2712506
SHA512b88c60fc03c82e427dff28fdc89360a9b742fcc9c8435dd5a2b03f971a6c9a5f94a301b21bc92d8dd3b295e88b90cc91f3a02f0244ca580797fc87315cd034ec
-
Filesize
706B
MD51b0c1aa37a748de97f6838ecf7f27916
SHA1217db7449a8ecc9ce32468a881a82439782d977e
SHA2567fc339a47d830737441509351d509fc438b4860da8844330875e5e77a5b65514
SHA5123a845104babfb5593e41bfb69337592a10161c9a5ce86a7406c100601a2b7f67582adbc05308daebb36132fefd5ff09831d9fd04422ebed481a7eca82d607689
-
Filesize
1KB
MD533fe1f059d1d0a9cd92b5c1acc58ae71
SHA12dd4b120e4f1642f391668acce8fc2e7f736408a
SHA256c767bbb0591ee421d1fbbaa4b6cbec58fb5c4575cf804f5bb200e9c1681a0e91
SHA512bc848818d17f71941c2775fca409d6192b98189b9eee0d0e05481be5ffbcd91ad70fb6bc8d4406edb10a691845d4e498c49139dc73db4e6be449165388eabd19
-
Filesize
706B
MD5b86d3c620a24123e8de02bf32fa7bf66
SHA1805ce3de50f43ceec05067a1f72829c9cbfdae83
SHA25604e39f816d9689e1d9df21d5e4ae97d16b4e152cec9f69fff9818f14064f9f3c
SHA5129afcacee1cc58d469b484c22a709b31fe122b923acc00d735312d41b0513ee6921bda603daf05e90e2ac2f5fc300d663135a7e4359a8612511077ff14df3ba80
-
Filesize
6KB
MD51307c5a6de7c451c552f40f72ae0d37d
SHA1f728b59bb9062dedd3744fdf0346ffa6c30d6ea8
SHA256c169877e47614be0e2f0586064d1cd23db359877c60df120261c86760efe8134
SHA51283f84ed09e32045a163788948a9e6abe6649da5748982ab15b5bff19917aa79794e8d0c4c6f8ecd6084f9e822a1b08e3f92023bbc72d9c853bd19314c57594b3
-
Filesize
6KB
MD5c6f0e684e16905cd706588a35b5d037f
SHA1cc47f50ee2e7b38f33cf2f04e67a107ea7089c49
SHA2563c7816370bb37aef90de5249130f1b544baf85e9894453c2e9f1c24f390ff423
SHA512bd38bf579756f46566f5e4c64c068ba78f41ed5657eb784b127abedf576b3525d8a73fdb56e4807c1ddbd3b0e21ff164c8ef281445edc98e362440db2a77386c
-
Filesize
6KB
MD563dc5885291af1f889bb4fedb5063e1f
SHA12e11942497a224403b3f54a95264a051a0a9d01c
SHA25620df515c30306def2087faf03b7f85db97d1c8da481db0d7f93d28728f35ee84
SHA512c8115683d5610ac2c6391214a83071cf6d4ed3c06be3b611afcbb655c1087f0db95dd798b7b5a9c20a254064b70960ffe911a2d0954cefed6827fc20e521bc0d
-
Filesize
114KB
MD5481b0ee63e33625b3e57e93a189138ee
SHA1979de6669f6812173fe0f50656c52606733fb21b
SHA256e536ffa680b4df2bf9c6e658dcbb86d4c13b6621f0923f1da0f6213b318223f6
SHA512339b0a9615d925e2c03df3034d96e205a2c381359c5e2dd2142790e760e15c90e2718042354d7d524a36a664f9b390ffb93de3b687c094e07d8ca2bb7b04d22a
-
Filesize
98KB
MD51396946fc465c59bfd70148e7208267c
SHA1b7a4166f585975343bc743d7ace1792198630070
SHA256936a9977a91983b2eee3b63e72901208919c6b70267e9cc6edddb52b2e63af2a
SHA51241382788fe333d0203a530e01a862a8770e4127d9f5be4d97a335a2061c0483569abd280bbcff28b1aac0f448fe5c9eeae0c3198edceb3abc25da5f445bc1f8b
-
Filesize
93KB
MD5f78b997263a49dc523470f57a2c05b5a
SHA1b3aac755d55e1367ff8ab5bae3e2da952d195fb0
SHA2563c967d53046bc1193f5cc5b7b86941b711126f306074dc9a883edbe30b906b2e
SHA51289df03ef187654cfd2f2287f9019bdaf0c0b80a97de9a95208a77e9ee8570ab8667787f9c1659d9422f9880edf8fc03ca2c88ede9f911c5ebb14b1eb7e6b880c
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd