Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 22:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://account.riotgames.com
Resource
win10v2004-20240221-en
General
-
Target
http://account.riotgames.com
Malware Config
Signatures
-
Drops file in System32 directory 11 IoCs
description ioc Process File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jcp svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.log svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.jtx svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00001.jrs svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.jfm svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSTokenDB2.dat svchost.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSS.chk svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSStmp.log svchost.exe File created C:\Windows\system32\config\systemprofile\AppData\Local\DataSharing\Storage\DSSres00002.jrs svchost.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133532868531229650" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2132103209-3755304320-2959162027-1000_Classes\Local Settings mspaint.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2396 chrome.exe 2396 chrome.exe 3460 mspaint.exe 3460 mspaint.exe 2724 chrome.exe 2724 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2396 chrome.exe 2396 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe Token: SeShutdownPrivilege 2396 chrome.exe Token: SeCreatePagefilePrivilege 2396 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe -
Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe 2396 chrome.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3460 mspaint.exe 3432 OpenWith.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2396 wrote to memory of 2432 2396 chrome.exe 64 PID 2396 wrote to memory of 2432 2396 chrome.exe 64 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 4984 2396 chrome.exe 91 PID 2396 wrote to memory of 872 2396 chrome.exe 92 PID 2396 wrote to memory of 872 2396 chrome.exe 92 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93 PID 2396 wrote to memory of 892 2396 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://account.riotgames.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2396 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb08999758,0x7ffb08999768,0x7ffb089997782⤵PID:2432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 --field-trial-handle=1816,i,11970429238159338951,730930102045569487,131072 /prefetch:22⤵PID:4984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1816,i,11970429238159338951,730930102045569487,131072 /prefetch:82⤵PID:872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 --field-trial-handle=1816,i,11970429238159338951,730930102045569487,131072 /prefetch:82⤵PID:892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1816,i,11970429238159338951,730930102045569487,131072 /prefetch:12⤵PID:3004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1816,i,11970429238159338951,730930102045569487,131072 /prefetch:12⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5000 --field-trial-handle=1816,i,11970429238159338951,730930102045569487,131072 /prefetch:82⤵PID:1396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1816,i,11970429238159338951,730930102045569487,131072 /prefetch:82⤵PID:4572
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3716 --field-trial-handle=1816,i,11970429238159338951,730930102045569487,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:2724
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4504
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ApproveRestore.jpeg" /ForceBootstrapPaint3D1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3460
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s DsSvc1⤵
- Drops file in System32 directory
PID:4920
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
PID:3432
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5316df48efeaeac47a961293aacb12798
SHA176e128ff0c8ef0f0ace95cb34d13c5e71317b89d
SHA25674fea7ebf5f5be20136fcb755f8a80a11532b07fb4a81313fefb71f7ec21ec71
SHA512b398c0dc4cb86b5ba6b2f222e646906e641ecd012136ea65a8499cfec29f891b7e505c9c0009596eb1724dc6d30e12d46b9aa1d1029cc94865946cdaaec18aa8
-
Filesize
6KB
MD516fb75232e796966b937e6f6cb6ceee2
SHA19148b91c06b72ca2fb618285bc905ade1c9eec36
SHA25649ef9617f17bccea2ed57e16508899f9d6d08c1ceb0446a12b7ceedb756503bd
SHA5129a211c369ad2f190d489af2b9e4458132f6c6e5eeaf1c9a6808b7d29361289a8b3579852a23b10ae630573256be631d6a4f8fc52760a381fbc002abec3c52c76
-
Filesize
6KB
MD529a22e12671a89f8f5f14fba90bb7150
SHA168bae0d5e5468abe35b9c6343ab46b3831d9066d
SHA256bb3bdbbcacbf279628b020cd0014a07e48fe64e2f0ecb8f38b76cb302c0300b1
SHA512c905f100e41366b6b1ab40209f2177e5bf5d79507fcd99889e624057829bcb39a22e7b8d62d85ec64069a4380536e989671bda37671432df19946610c09a0e07
-
Filesize
6KB
MD545b23b735bb2287d70e29d2f7ec775a6
SHA1e5712d3fbb77fd2ce17cd14baf820e6f7d6b20f0
SHA256a238f674bf684b8f2d6d9380152810a1e0e511f187129e63d566e60be46475a2
SHA512b4d18df2b017565e38ca1afa2218683483d443e10ca3c4a3ef9830c20b536567e0281269493eb1bfc75a54a3eac1a276e9e8646187b9612d31cf4b3c19257eb6
-
Filesize
6KB
MD5c26e5a65083c2b809ed8634f095c40f9
SHA11d4c5469f85eaa1b1ac91ce6cfd9ba24ed792356
SHA256dde5d099e215071751064043dc6b57f77ce8dda4b99c27b8de314f32bf9764b4
SHA512828b736b46b227587d7ab9b568bfa54e1cdc99538f926a34b74d524a29008f26a65d26df32c2aacfff200fdced117a1354b098d36509f7944e5bec47127ef9c7
-
Filesize
130KB
MD5790c09d8ab234b76113241d383c03a73
SHA1d101ff3966ec919cb324ceccb1b84ebf659c2708
SHA2565f110c69f55593d047228495af490bb85daa94a99b5ed0ceacecb0d77ff9cbe4
SHA512fe4256677e287df6f14e905cfcc6e4f8928ef85788486b41830f7ce357a88c8fccef29cea0571468558e6e2753a0d5bff01e084ea2fc58b71186bd9df4ac2019
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd