Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 17:15
Static task
static1
URLScan task
urlscan1
General
-
Target
http://[email protected]/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133524045466751784" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5060 chrome.exe 5060 chrome.exe 3112 chrome.exe 3112 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe Token: SeShutdownPrivilege 5060 chrome.exe Token: SeCreatePagefilePrivilege 5060 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe 5060 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5060 wrote to memory of 8 5060 chrome.exe 22 PID 5060 wrote to memory of 8 5060 chrome.exe 22 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 668 5060 chrome.exe 86 PID 5060 wrote to memory of 4664 5060 chrome.exe 87 PID 5060 wrote to memory of 4664 5060 chrome.exe 87 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88 PID 5060 wrote to memory of 3100 5060 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://[email protected]/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5060 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffa9b7b9758,0x7ffa9b7b9768,0x7ffa9b7b97782⤵PID:8
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1900,i,9235187641519467332,5444960006038672373,131072 /prefetch:22⤵PID:668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1900,i,9235187641519467332,5444960006038672373,131072 /prefetch:82⤵PID:4664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1788 --field-trial-handle=1900,i,9235187641519467332,5444960006038672373,131072 /prefetch:82⤵PID:3100
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2860 --field-trial-handle=1900,i,9235187641519467332,5444960006038672373,131072 /prefetch:12⤵PID:5104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2852 --field-trial-handle=1900,i,9235187641519467332,5444960006038672373,131072 /prefetch:12⤵PID:4936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1900,i,9235187641519467332,5444960006038672373,131072 /prefetch:82⤵PID:2856
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1900,i,9235187641519467332,5444960006038672373,131072 /prefetch:82⤵PID:1064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=1616 --field-trial-handle=1900,i,9235187641519467332,5444960006038672373,131072 /prefetch:12⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3836 --field-trial-handle=1900,i,9235187641519467332,5444960006038672373,131072 /prefetch:12⤵PID:2132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4944 --field-trial-handle=1900,i,9235187641519467332,5444960006038672373,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3112
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4132
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\17260fa4-dfaa-4227-a09a-e59e1e94ed17.tmp
Filesize6KB
MD5d3e593f1b606365033d8149d47789f79
SHA1566123759e11dd5e4e48ac528893f0b39ad3f6d5
SHA256024ee0628425658a7e8ed4eb36a78eedcedef82f764f2b0808bcf0fda0d8c500
SHA5123b45e417686b1ec3b254c3b55ef4e1d0a860f4ac4d7f3403940a158ccca0c80443fac75c61d7070a7c6bb44c1b61ca532fddabf8f7da45ced5b365fe3c7ae0f9
-
Filesize
972B
MD514026160d2289869b8840fbdc2b458a7
SHA1fbad1bc6d75eb08b1afeb84bd7e38fa725afd64f
SHA2562651ff92b5f06e37bc074935a6a81502f7077f9f31072da50ff5466202c9d9ed
SHA512381fdd3257cc09ce0e227e5439e3d05d7bee1a917e55080186fdb67bb9e9d4a819d47c561ba224d815a2c7f9397afc67fbd24ffdbc846c36c4813c46197ac1bd
-
Filesize
823B
MD5911c27d2ec7b2728b3348440276e26d5
SHA1ede14a9dba9d774bbd6264f2ae0ddf932836f492
SHA2561a5a9800ef4fdd791cdaeb8ccf06f610a0a0c819e50166a54579a41a7b2d8ece
SHA512193056405c1f1f5b9807f53ef00403a57e9a3f2d2b2278893e62286eb07ef6ad7993cf654bbb25b314722b4032df60c30388f195b3967105dfdb889ec116b0d2
-
Filesize
371B
MD5f4d2db81a4ead43542988a3bf285096a
SHA1a319d44e7b88ff4032df9fbc29cf898e69116aec
SHA25613cc827be4b601664486466f5b0e4d99ec90a4138b51d5837bcce544ecd062d4
SHA51217e33f082f63cc75978a5c1085bf5de967b94e4c9a2792cd49f9fed493d54dfdc6a5135aebb45dbb1d9ed55060bbf849eaa454c740a14857934aff52c61eba77
-
Filesize
6KB
MD5bf7dc2bc07643991a4970ad896e91844
SHA1f3c4b8cde6067b45a7c811c6a55c75f458f682a1
SHA2566897228fdedd268d39954db34259466ab7e972f8bd39954344c802b8f7d9df7f
SHA512e3c1a9ac343dfff4d0b80a7fd01fe35fb78956efad6138fcd7c23c83e7d8a87427abfa55a76eff543d95c01ad058b7f120b7969048754f70378fd882d3438a1a
-
Filesize
6KB
MD5c05860005dc8b05be9eee3b41f262667
SHA1075a269959a38e91c2030cb35ac489868941ae80
SHA25673eb7b766d968f7f2e60e23ad15edcc757d87b7f4db8a532f9063cf79b3e67ff
SHA5124752b61e28618d93444309a6ba93ce8704fa11c46ca98fd1fc961fc95ebb00019722ae937a6c4ee6c098424a52f16b7946652ca9a6c07df9c3cd1157c4ca7506
-
Filesize
6KB
MD52c76266b0a23407b748507de5bc9a63e
SHA1b3acd0139363e24c39cfb9f4201bc88444c52e6b
SHA2565da26ab3818af71df8ff34974d592e8b9c58522d8bd6947227c5ff93280c96d8
SHA51236e6c1b8524054a04d13eff9c859f27dd1bf5a8550a01650f87602806deb79740e61aac3856d83348850d5b1d3eb3a2cf21f1e5c55044003e59accae73cefc0e
-
Filesize
114KB
MD5a27c60432860ef1cc650417069c46ac5
SHA111e0b9ed21e3045f73e805c82feebc734be7b579
SHA2568e78b1ec5a418ad9a2299a545bfe95ed503ccea3d20a117db9c066c8bf73fa14
SHA512165dd23636f257517035f522eff44d8b97ca6f863793f95791ffc87d08d7fe5de5f3d8d0d90fcce2d8b2b41420c0e7aa52d7336f43f43cbeafe22363b9c5d0b0
-
Filesize
114KB
MD5b8331c41510b7b1b5f6bc575ca4cb53c
SHA185b6f87a7ee1463331300238d8c80b958dd468e2
SHA256f7c51f79ded11cd91f03f1c48d674feb1caf0157f1817fa14bc6ffc947d9a2fc
SHA51213bbf8254ff602ff031421ee2241596659dc1fa44043ef941b41afa67226e3d5a1c2a166b9de80c9a08652de1e5901dbe4b92b43c88ae67b43d3dcc390e14c4b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd