Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240220-en -
resource tags
arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2024, 14:15
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://cs.openwebmedia.org
Resource
win10v2004-20240220-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://cs.openwebmedia.org
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133529985079330156" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3408 chrome.exe 3408 chrome.exe 4800 chrome.exe 4800 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3408 chrome.exe 3408 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe Token: SeShutdownPrivilege 3408 chrome.exe Token: SeCreatePagefilePrivilege 3408 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe 3408 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3408 wrote to memory of 2964 3408 chrome.exe 36 PID 3408 wrote to memory of 2964 3408 chrome.exe 36 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 5116 3408 chrome.exe 91 PID 3408 wrote to memory of 2312 3408 chrome.exe 90 PID 3408 wrote to memory of 2312 3408 chrome.exe 90 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94 PID 3408 wrote to memory of 1532 3408 chrome.exe 94
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cs.openwebmedia.org1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3408 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff81c889758,0x7ff81c889768,0x7ff81c8897782⤵PID:2964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1828,i,11830246572971530599,9512363508740415568,131072 /prefetch:82⤵PID:2312
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1828,i,11830246572971530599,9512363508740415568,131072 /prefetch:22⤵PID:5116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2792 --field-trial-handle=1828,i,11830246572971530599,9512363508740415568,131072 /prefetch:12⤵PID:1820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2784 --field-trial-handle=1828,i,11830246572971530599,9512363508740415568,131072 /prefetch:12⤵PID:2080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1828,i,11830246572971530599,9512363508740415568,131072 /prefetch:82⤵PID:1532
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4840 --field-trial-handle=1828,i,11830246572971530599,9512363508740415568,131072 /prefetch:82⤵PID:3940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4836 --field-trial-handle=1828,i,11830246572971530599,9512363508740415568,131072 /prefetch:82⤵PID:4260
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3404 --field-trial-handle=1828,i,11830246572971530599,9512363508740415568,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4800
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2212
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD5fe5036052df336af54c0dde600b67a26
SHA19986da8c5e808ddf41d7d3e7c1dc191058eccebe
SHA2563b48368b3bc8e37af5e9a5a90beaf452f8a182052cb8f2241d39e7494edeb000
SHA5129767f27ea686b5d5611e344671f86dad620e0bb4caff258c611446d775c4cdccb4ab613a879c819f730f4a570f4208cd5a6e5263988551e5799cd9725fc23cb3
-
Filesize
130KB
MD56833292a06296588a3bb048d0c7f45c9
SHA1ccf853b73df44dd2d15a4a7de9edcd25937ffab6
SHA256f4dc4ced9b8421e912778d1bacaff0ebc66401b181cc4b6cca7885d05b5f1c14
SHA5129ab6a8c2f49e68298869a3c7429baaa770e0ae20b415141525c494b24503437c4152e29c3ffce4c7e79ff40445b355ffeda3349e63e7e62422da402f975a0cdd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd