Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
87s -
max time network
79s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
21/02/2024, 15:46
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://codeload.github.com
Resource
win10v2004-20240221-en
General
-
Target
http://codeload.github.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1612 chrome.exe 1612 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe Token: SeShutdownPrivilege 1612 chrome.exe Token: SeCreatePagefilePrivilege 1612 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe 1612 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 4624 1612 chrome.exe 68 PID 1612 wrote to memory of 4624 1612 chrome.exe 68 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4164 1612 chrome.exe 86 PID 1612 wrote to memory of 4776 1612 chrome.exe 87 PID 1612 wrote to memory of 4776 1612 chrome.exe 87 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88 PID 1612 wrote to memory of 3828 1612 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://codeload.github.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95f269758,0x7ff95f269768,0x7ff95f2697782⤵PID:4624
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1756 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:22⤵PID:4164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:82⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:82⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:12⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3108 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:12⤵PID:3184
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4556 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:12⤵PID:3240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3848 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:82⤵PID:180
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5116 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:82⤵PID:2888
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 --field-trial-handle=1896,i,2849315768897250419,10389389889444404624,131072 /prefetch:82⤵PID:2332
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4980
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD57a113cbfd8f40773f51c25409df84295
SHA1ecfd6665c5d25d72dd56538d472bcbcb2d04e13f
SHA2567ba061c3a07dc3009fcc74d707b9fd239e59895b962f893723142b81458c6ecf
SHA51217703db6eba972f0e3edfaaa646dc8bf2f3f4b4f542fc53324b09896129dfcd8f794bd3dc162aad4ded356230be71fb26e3ca7a45f989a693701dbce44f31b75
-
Filesize
1KB
MD563273fc639136f3c4a976f74aea620bc
SHA1063f4c4bbe4b4a59f45df434f8b4b5fe7c9a9617
SHA25677fbec30d72a81bf717c05f243663c420448967edf039cfedf2a0bacc2850809
SHA5129361ef22eae7100e9ae9d97c7748cee4051cb32ac93128c7ae48251a1d54ecd05e8549cac26c9466b9855b9ad1f83df75c3f62bcff84c188b3117f9be60fbfb4
-
Filesize
1KB
MD53518448a857db3baaca8811fcbeb1435
SHA121d306b07de120807cb935995f0c9aef531dfa64
SHA2560e928f36380c9b06c46580f221d3dc80ec8357fd6cfc739d01d69ea017ce8708
SHA5127129951414d8e52339b5298ede2786787d3cdb3b35812792505cdf45cf08bfdea0362ce766edc9a752c40ed0f538580fe06a296ada1470fae10e0c4872210c02
-
Filesize
1KB
MD564e69d088d5cae188775b7b52353df73
SHA13e64efa7aaf8d6cf65cacd6e571ac790d05d28ad
SHA2560a2ac2bdd858523d5df1f8ba3ed4d740896e527656a9af882010cdf54ff59462
SHA512f66e39f057c7dd912ef71cd16857f082f32198034b6edb700ce43c0e50db97bb8cc848ed803aceedc6c884c35b03ecbb0dc238734c1a48b355d4242eea985d79
-
Filesize
1KB
MD562c22b3027370d02112ceaeda6c7d139
SHA1cfad55bc3d04ec87e8cc0d851e9c450442f248e3
SHA2562b272cdda4ba5e64278bc55ff892649f2f475d8815ec368954c88ebe7635a076
SHA51206fbf458f76c9cb65e6e0724915dfc33e9fa3fc5da38b5e40b3fd59889b8655318e8ad72d43072c32a389b64ece9a079cc175e4f6a89aa8d6047a52d913c9438
-
Filesize
1KB
MD584aa5d0fabdbdf7634fb0f63679f0eb0
SHA10873a9bd809d6baaf71cced7ff885f58ee5c7b8e
SHA2560889f43aa33e8f481fa6519a1a2f979d5d5eaebf07f8da9dc91268ff5a858399
SHA512614cedc52cf0049471426fe6453922d2cb76002207a3574ce37e2f81327fde1c16cd0e174aefb1da960d6687dd1a1ffc2b141f30eb4cca03426d924e52827636
-
Filesize
1KB
MD588a135f7f5cbd0adfb3721773529212f
SHA1c1e2819b71409e55dfe784a3dac9f8fda8a444b1
SHA256d9f8a71bdd6234a38726e716f2cba892b7dfac28ea73e16a13afe04c92c3174c
SHA5127075e345c8ed106f0139828b50bedab45a27cee25525f5d5efb82e455ab606555d28cbf83bff4333d67c9aa374219cb590b5b790abea5ad6a583b1d67ddc93ec
-
Filesize
6KB
MD593ef72851b452dd853bed47f13d84501
SHA1f4314cac2c9bd63bf0e375aad0767b8dc7645f19
SHA25689f696371b83bbd38d8707b83048b96df67fec84b0d5f29e3e4b064e7ea60e18
SHA51201ad6401fda81f110ced5a503e7e4e973a4c0258aafb7312dc276aa3a6896eaa7abe7d8dda2bda1510850d11850310706dc0cf90cbd12677ed75a821fc4a6924
-
Filesize
6KB
MD507e510266b2b18494c16496454ae71c7
SHA15d488242fcf163ae007367d8ff16fcb1a9901387
SHA256c822aa847d02e1154c966c2d805ca4ad29efaba3dce6dd0c645c4ec29ecb89bb
SHA512487b8c0c1b11c0f2a2fe8a26ec7e52e98ec802886bd1ae8cf1fdf4af61dd1529bc9e87027b2c4c96b19fc59468d0e0d74224d9e74fda6f1522bff4fc785af06b
-
Filesize
6KB
MD5f9b4e780213df624068f6fc516e9c0ff
SHA1799aed679aaa128c8097e25dc881d4d99d60a8d6
SHA25647f45a01a91f30788765d18e0987146aa7c2f03b2cae28bc9d66f7634ac0f7e8
SHA512d20cc4cc68db246588d3ae31ffdf44f4b0f232236be38a5adeacd3ac15ebadfc1729405f62f6bada34dc22944922918c61286a861fba309ee56bbce2f3213b09
-
Filesize
130KB
MD5ef80c8c2e5b4b68087f35067b458dfe2
SHA19528f271e2103f7e1d358d1bd24cf019a4863733
SHA25628b999c8e9c6de414d3612f638949184b508ef1173c4531bfde5cd14b7b5a0d4
SHA5121c8f176e55c73482b551cabbd4f4e86ac8c9072db05217db1a5dae7bf03c39a0a013d424542e4ca61c32009f3eac891f237c7c43e0d1041c92ef8868aa0a4f7b
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd