Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
19/02/2024, 12:33
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://aabbccddee17.storage.googleapis.com/aabbccddee17/2.html#un/18831_md/72/15079/4043/19027/623455
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://aabbccddee17.storage.googleapis.com/aabbccddee17/2.html#un/18831_md/72/15079/4043/19027/623455
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133528196342305941" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2740 chrome.exe 2740 chrome.exe 4632 chrome.exe 4632 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2740 chrome.exe 2740 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe Token: SeShutdownPrivilege 2740 chrome.exe Token: SeCreatePagefilePrivilege 2740 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe 2740 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2740 wrote to memory of 2928 2740 chrome.exe 84 PID 2740 wrote to memory of 2928 2740 chrome.exe 84 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4376 2740 chrome.exe 86 PID 2740 wrote to memory of 4516 2740 chrome.exe 87 PID 2740 wrote to memory of 4516 2740 chrome.exe 87 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88 PID 2740 wrote to memory of 556 2740 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://aabbccddee17.storage.googleapis.com/aabbccddee17/2.html#un/18831_md/72/15079/4043/19027/6234551⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2740 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe6ef49758,0x7ffe6ef49768,0x7ffe6ef497782⤵PID:2928
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1804,i,16606710317536931895,12920198211561787038,131072 /prefetch:22⤵PID:4376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2036 --field-trial-handle=1804,i,16606710317536931895,12920198211561787038,131072 /prefetch:82⤵PID:4516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2096 --field-trial-handle=1804,i,16606710317536931895,12920198211561787038,131072 /prefetch:82⤵PID:556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3172 --field-trial-handle=1804,i,16606710317536931895,12920198211561787038,131072 /prefetch:12⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3180 --field-trial-handle=1804,i,16606710317536931895,12920198211561787038,131072 /prefetch:12⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4824 --field-trial-handle=1804,i,16606710317536931895,12920198211561787038,131072 /prefetch:82⤵PID:4660
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 --field-trial-handle=1804,i,16606710317536931895,12920198211561787038,131072 /prefetch:82⤵PID:3852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 --field-trial-handle=1804,i,16606710317536931895,12920198211561787038,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4632
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1740
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54b38e91f356177022d6f92e50c5f4a8d
SHA11514ba009fc987b5b497ba640260aa4a3764521c
SHA256abb0d4b14d812f9ac5ed8009ea08fa4bea8abedd76a9284438fc221e85f3a7af
SHA5125d93192332f330787e6e3882fd9681bc2f5ee020211131bdba0911dcaffef9de60422278e3cb2f30a0404415dc0b24ec56c4b2c91adab3e1e76b270f49ac591c
-
Filesize
6KB
MD540fcbec0d86b19afa3cf55e0e139e183
SHA12e3350de308cb20b91c17a6ea5d73f5b3565d82a
SHA2569162b25d65c91e50df9ea76c1595c30aa2e39271342be74bfc5e337e8ee1debd
SHA512a94840bce2f27b1b6ba74a765cc42a7b9e6dd5b96737b44ea82ac492f379dc8b2b354bc96fc7293abb50b3c1ed3d3f698f1015858f31484d8153b50793343a72
-
Filesize
114KB
MD54f113562c706ea25b1e3b83857d5fd32
SHA1718ec793ad90f1185784cc6f53fdb68bafe98dbb
SHA256e986f3e93c9164cf844cb33033017de4bebd39e26f8e521f7069dba4ccbfe980
SHA5123ff6d605f2b8d9cf148613b9851bde883f16ebd85a1288a12e7a6efeedda14a0ecfbe3f9154299b93cf0fee891e63144b5d546782525f0267b6c384720bf0507
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd