Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
313s -
max time network
266s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
23/02/2024, 21:18
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://dg01.redatatech.com/onprem_image_fetch?dep=Qz6O%2B%2FJoS%2Bpmqie31A7C5A%3D%3D4QQFAnvp4NhC9ea3MgLh0zbMwpoN%2B6fItuCCUa9IyxT0gmxNTNFqylLbXhtGpFAbq7AighVgnSUo0xCrUTasZqGopHaEVWibV5JmK4ctXfTw7ZtoMov5%2BJmsXp9JLv1Qlyv1x6G51MvJEsXggwgfNhL96aTvTDXYY1PkM9KEa%2BvcRO37KhhQFNn1QAAw6Nc3H13KOWK8tEPmTviF%2Bq8xEwyAHor0VamCnPhirNK062mG%2FOzm2pyyTXiCdBCJ%2BnCRw%2FCtfUFY0I%2FU%2B%2BTqCu6oEhnEaZ36T05jjbmYw%2B9AuxsrqISaYu4NbAum27aL3uCjxroQopAEcIS6%2F9MZpDMltKxzdhP6e52f03BN%2FFxElXRGtPd7wm6gkAnL1Jynie3kReZxz%2BvXEacCqkpYejWo1Q%3D%3D
Resource
win10v2004-20240221-en
General
-
Target
https://dg01.redatatech.com/onprem_image_fetch?dep=Qz6O%2B%2FJoS%2Bpmqie31A7C5A%3D%3D4QQFAnvp4NhC9ea3MgLh0zbMwpoN%2B6fItuCCUa9IyxT0gmxNTNFqylLbXhtGpFAbq7AighVgnSUo0xCrUTasZqGopHaEVWibV5JmK4ctXfTw7ZtoMov5%2BJmsXp9JLv1Qlyv1x6G51MvJEsXggwgfNhL96aTvTDXYY1PkM9KEa%2BvcRO37KhhQFNn1QAAw6Nc3H13KOWK8tEPmTviF%2Bq8xEwyAHor0VamCnPhirNK062mG%2FOzm2pyyTXiCdBCJ%2BnCRw%2FCtfUFY0I%2FU%2B%2BTqCu6oEhnEaZ36T05jjbmYw%2B9AuxsrqISaYu4NbAum27aL3uCjxroQopAEcIS6%2F9MZpDMltKxzdhP6e52f03BN%2FFxElXRGtPd7wm6gkAnL1Jynie3kReZxz%2BvXEacCqkpYejWo1Q%3D%3D
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133531967229273308" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4860 chrome.exe 4860 chrome.exe 2556 chrome.exe 2556 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe Token: SeShutdownPrivilege 4860 chrome.exe Token: SeCreatePagefilePrivilege 4860 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe 4860 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4860 wrote to memory of 4920 4860 chrome.exe 15 PID 4860 wrote to memory of 4920 4860 chrome.exe 15 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 1344 4860 chrome.exe 89 PID 4860 wrote to memory of 2488 4860 chrome.exe 90 PID 4860 wrote to memory of 2488 4860 chrome.exe 90 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92 PID 4860 wrote to memory of 3144 4860 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dg01.redatatech.com/onprem_image_fetch?dep=Qz6O%2B%2FJoS%2Bpmqie31A7C5A%3D%3D4QQFAnvp4NhC9ea3MgLh0zbMwpoN%2B6fItuCCUa9IyxT0gmxNTNFqylLbXhtGpFAbq7AighVgnSUo0xCrUTasZqGopHaEVWibV5JmK4ctXfTw7ZtoMov5%2BJmsXp9JLv1Qlyv1x6G51MvJEsXggwgfNhL96aTvTDXYY1PkM9KEa%2BvcRO37KhhQFNn1QAAw6Nc3H13KOWK8tEPmTviF%2Bq8xEwyAHor0VamCnPhirNK062mG%2FOzm2pyyTXiCdBCJ%2BnCRw%2FCtfUFY0I%2FU%2B%2BTqCu6oEhnEaZ36T05jjbmYw%2B9AuxsrqISaYu4NbAum27aL3uCjxroQopAEcIS6%2F9MZpDMltKxzdhP6e52f03BN%2FFxElXRGtPd7wm6gkAnL1Jynie3kReZxz%2BvXEacCqkpYejWo1Q%3D%3D1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9c279758,0x7ffd9c279768,0x7ffd9c2797782⤵PID:4920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1908,i,7211768211071690183,17108184943814369562,131072 /prefetch:22⤵PID:1344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 --field-trial-handle=1908,i,7211768211071690183,17108184943814369562,131072 /prefetch:82⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2844 --field-trial-handle=1908,i,7211768211071690183,17108184943814369562,131072 /prefetch:12⤵PID:1268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1908,i,7211768211071690183,17108184943814369562,131072 /prefetch:82⤵PID:3144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2868 --field-trial-handle=1908,i,7211768211071690183,17108184943814369562,131072 /prefetch:12⤵PID:3440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=5020 --field-trial-handle=1908,i,7211768211071690183,17108184943814369562,131072 /prefetch:12⤵PID:1520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1908,i,7211768211071690183,17108184943814369562,131072 /prefetch:82⤵PID:4884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 --field-trial-handle=1908,i,7211768211071690183,17108184943814369562,131072 /prefetch:82⤵PID:1412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1080 --field-trial-handle=1908,i,7211768211071690183,17108184943814369562,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2556
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4364
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5861ed8ef686d4ff93543545139a1a1d2
SHA1ceed1a50fb19db294da2606020643e68c4360352
SHA2562be8e571949e33d6c27c752e59c9821c2c30b3747105742f75b65860c8ffd91b
SHA5122f8bba2f9bde9ef719fc2374c21958fc4c75fad05398cef28d8d5548a8cc26e8ca0634068dcdab76bf8da89d11f05ad16a63796f2ce7e557c2327335d032fca3
-
Filesize
1KB
MD55da42a127d35f7529198980c348ff11f
SHA1ae4536b7083818a1c644bd4d953e2abf4fc779ef
SHA256d024ed3ae278de1b861aa150f9303585b3274d553ecd2a5eb6dad459f9aeb3b9
SHA51205db278bccb281ca15131f84b24409ff8b3c1799e303738e1bc1ab066004ac72f76c6fff74a37c21c848f3a391d9fccb0f8b740bc772acde49d621fcac4abce3
-
Filesize
6KB
MD578db089d92352e1899bad60e031ae854
SHA10e5163cc426dd90a8471425f37e418a0518e92b1
SHA2566bece3b899935aa150b989b64d3063d4cdfaaef9a953ff658f0942869ff53e9d
SHA512b4a3d8eb3bafa3bdac6982bab7b27229b5f9cfe97613c319d89ffa6b95d064062ce897f2e773cbfcaaf0e7401d973940c9db1881ab3d306b3689f343e27438b4
-
Filesize
130KB
MD5eae0119feaa8d2278622ffa293f3b988
SHA19bfda6a5db1bec7580d6bb992a393ace946b23f5
SHA256730ecc8e14c3a6d8f77e05cc33580e6cc388953033266432745403850f7e626b
SHA512fa6e3eb768ece09ef4146fbbb3071d62a2d171ba93fec90ad60f7c86a751ff022e76adbadb73a62da67947e8d14dab6a30755d0f8bd8fe593ee9233000f205b7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd