Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
268s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
20/02/2024, 02:55
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://t3kzfhdh.r.us-east-1.awstrack.me/L0/https:*2F*2Fassistancefeesettlement.com*2Fsubmit-claim/1/0100018dc28c5678-454e3c6c-b9d5-4712-bf2e-fc1cfeed0fb1-000000/K9OtWeIOsdIjyMIxgpso8qPEaXc=361
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
300 seconds
General
-
Target
https://t3kzfhdh.r.us-east-1.awstrack.me/L0/https:*2F*2Fassistancefeesettlement.com*2Fsubmit-claim/1/0100018dc28c5678-454e3c6c-b9d5-4712-bf2e-fc1cfeed0fb1-000000/K9OtWeIOsdIjyMIxgpso8qPEaXc=361
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133528713736991025" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 636 chrome.exe 636 chrome.exe 4872 chrome.exe 4872 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 636 chrome.exe 636 chrome.exe 636 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe Token: SeShutdownPrivilege 636 chrome.exe Token: SeCreatePagefilePrivilege 636 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe 636 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 636 wrote to memory of 2024 636 chrome.exe 83 PID 636 wrote to memory of 2024 636 chrome.exe 83 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 4024 636 chrome.exe 85 PID 636 wrote to memory of 5108 636 chrome.exe 87 PID 636 wrote to memory of 5108 636 chrome.exe 87 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86 PID 636 wrote to memory of 3216 636 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://t3kzfhdh.r.us-east-1.awstrack.me/L0/https:*2F*2Fassistancefeesettlement.com*2Fsubmit-claim/1/0100018dc28c5678-454e3c6c-b9d5-4712-bf2e-fc1cfeed0fb1-000000/K9OtWeIOsdIjyMIxgpso8qPEaXc=3611⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:636 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b73d9758,0x7ff8b73d9768,0x7ff8b73d97782⤵PID:2024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1636 --field-trial-handle=1880,i,3929670254613066411,16512942745288033562,131072 /prefetch:22⤵PID:4024
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1880,i,3929670254613066411,16512942745288033562,131072 /prefetch:82⤵PID:3216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1880,i,3929670254613066411,16512942745288033562,131072 /prefetch:82⤵PID:5108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1880,i,3929670254613066411,16512942745288033562,131072 /prefetch:12⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3076 --field-trial-handle=1880,i,3929670254613066411,16512942745288033562,131072 /prefetch:12⤵PID:3648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4624 --field-trial-handle=1880,i,3929670254613066411,16512942745288033562,131072 /prefetch:12⤵PID:3340
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 --field-trial-handle=1880,i,3929670254613066411,16512942745288033562,131072 /prefetch:82⤵PID:852
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4884 --field-trial-handle=1880,i,3929670254613066411,16512942745288033562,131072 /prefetch:82⤵PID:2888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3760 --field-trial-handle=1880,i,3929670254613066411,16512942745288033562,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4872
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\329574eb-f0e8-46e4-9121-acb6bb9289f9.tmp
Filesize6KB
MD58c1bf05288d7367a3d068cf250b2b47b
SHA10730076ae7ee0a702cc5edc08e07dbde5977b5c6
SHA256aabbc014cdef026da5f0573c01c39980f348874f605ab7aa5bdef09c45942e09
SHA5122860c4b459e800da3bcff45905b207cb8ae52898256c5bc49129e3e618c391bd5836a35a4bc89e69d0f3425c6b6f59e06151a232c91f866e02fce1c3781f69ad
-
Filesize
824B
MD5bd721a8846f00406da99f05c39f78408
SHA12582109014ca4c04c96a8655fdf7843341baf91e
SHA256a4667fd56f2ec8029625bced3a0c4d6cff3cd5cca94289172861c8957f9aae0c
SHA512ea25003079708705b4d08ac83353cff685a56323422db0f6986d7231e0b9e2c23b18e87b6733f55f3940dca1ff0f9c50c8914404f593f81f31117e53e0eed6af
-
Filesize
6KB
MD5c2b0b3dc1bbb25db65f80d1685becbb0
SHA1a364bd942cb9e6e6c51d2bc94d04a61c43cdfcc8
SHA256148ad8d1ec0ffb7c3941f16f778deb4dcb96f80e2ea4d9b73a0e3028f9e89a55
SHA5125087d9fdf186d7655746c839f6e53cb15b16bf44cf1dc4ce8b3ef05515f2d4cd344a328d0f2154aa405901cb02d34bc12b124965ae2ae5453ebb658af29376b2
-
Filesize
114KB
MD5e4e87006c9cb858e34db00885d4a2b75
SHA1ef4e2c173192f0b99e0b4d20f6fd982d8d53fb4a
SHA2565969fccf9db64fb7d1e72613a62db4cb6d7c630b0b7cd185b5c185fb4e3d2204
SHA5127d8d0eaed05fc4fb3b7b0c96c141cb25f52bd4efcf8c71c99e47169c5fc768b5caab742b1c5badca48521f1dfab92d79982358ec783a12018aac33bb8bc1c66b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd