Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
599s -
max time network
485s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 11:26
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://LEXMAN.ZAPTO.XYZ
Resource
win10v2004-20231222-en
General
-
Target
http://LEXMAN.ZAPTO.XYZ
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133523836089016702" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2948 chrome.exe 2948 chrome.exe 4584 chrome.exe 4584 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe Token: SeShutdownPrivilege 2948 chrome.exe Token: SeCreatePagefilePrivilege 2948 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe 2948 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2948 wrote to memory of 1896 2948 chrome.exe 84 PID 2948 wrote to memory of 1896 2948 chrome.exe 84 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1596 2948 chrome.exe 86 PID 2948 wrote to memory of 1788 2948 chrome.exe 88 PID 2948 wrote to memory of 1788 2948 chrome.exe 88 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87 PID 2948 wrote to memory of 1412 2948 chrome.exe 87
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://LEXMAN.ZAPTO.XYZ1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9ea2b9758,0x7ff9ea2b9768,0x7ff9ea2b97782⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1784,i,9921053511675533368,12165524336111042980,131072 /prefetch:22⤵PID:1596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2212 --field-trial-handle=1784,i,9921053511675533368,12165524336111042980,131072 /prefetch:82⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 --field-trial-handle=1784,i,9921053511675533368,12165524336111042980,131072 /prefetch:82⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2872 --field-trial-handle=1784,i,9921053511675533368,12165524336111042980,131072 /prefetch:12⤵PID:3064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2844 --field-trial-handle=1784,i,9921053511675533368,12165524336111042980,131072 /prefetch:12⤵PID:964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4472 --field-trial-handle=1784,i,9921053511675533368,12165524336111042980,131072 /prefetch:12⤵PID:3752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 --field-trial-handle=1784,i,9921053511675533368,12165524336111042980,131072 /prefetch:82⤵PID:2360
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1784,i,9921053511675533368,12165524336111042980,131072 /prefetch:82⤵PID:2400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=992 --field-trial-handle=1784,i,9921053511675533368,12165524336111042980,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4584
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
824B
MD58925ba510bd7a43018b156358cf5e08f
SHA12948b16e4c02ec8fa19661d29dfd41d38eed5686
SHA256c007cd106725e848af1df918846cd51e6d8575ee194a8d42742c1e0c807d6ff7
SHA5124f02397cfa72f7e42ad3d07a761d3635709fb7ab417a2ad730f4060991a7c94e792618337e8152fe53ebd14b9fcf236d10482243d0abfe5b2ca6471456b0b8f4
-
Filesize
6KB
MD52e37560516ef213d0251cf39f463909d
SHA1ce3a2fd35c734f3e3f36f03b27229c55c37caabf
SHA256ec4fc148b95d6b33c058fc539cb4039d799ab2d5d217cd4bab875c20635dd073
SHA5121a337a4e547ae0363ba4aef923911e73338782d6fe6b03abe55d24c7b4e56d90b52233840b4f65f591deefe35500ebb17052dc55534787ed453758d72d00abe8
-
Filesize
114KB
MD5b38070a2cd6140575f5298a14c15033a
SHA174d4ee60f34d70cddb0fe2a5dad13bc9ece8ba39
SHA256e1b5dece0df63e1309fd6810bac2521a36ced84465edb6d58878d783699da807
SHA512a3878940da052d0adde490723ea3c0bd78f7bc6e56d2f8b8c03557b4bb5ba42052df7d06073d919f12a927fcc89dfc101a4065ebcaadabcb0e46377929165641
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd