Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
24/02/2024, 19:24
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.oningroup.com/images/signature/onin%20staffing/oninstaffing.png
Resource
win10v2004-20240221-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://www.oningroup.com/images/signature/onin%20staffing/oninstaffing.png
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133532763080495842" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 964 chrome.exe 964 chrome.exe 4580 chrome.exe 4580 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 964 chrome.exe 964 chrome.exe 964 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe Token: SeShutdownPrivilege 964 chrome.exe Token: SeCreatePagefilePrivilege 964 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe 964 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 964 wrote to memory of 2016 964 chrome.exe 57 PID 964 wrote to memory of 2016 964 chrome.exe 57 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 4500 964 chrome.exe 90 PID 964 wrote to memory of 1576 964 chrome.exe 87 PID 964 wrote to memory of 1576 964 chrome.exe 87 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88 PID 964 wrote to memory of 1420 964 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.oningroup.com/images/signature/onin%20staffing/oninstaffing.png1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffbe7699758,0x7ffbe7699768,0x7ffbe76997782⤵PID:2016
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1880,i,9089777907526979180,6035940228663092805,131072 /prefetch:82⤵PID:1576
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1880,i,9089777907526979180,6035940228663092805,131072 /prefetch:82⤵PID:1420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2900 --field-trial-handle=1880,i,9089777907526979180,6035940228663092805,131072 /prefetch:12⤵PID:3224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1704 --field-trial-handle=1880,i,9089777907526979180,6035940228663092805,131072 /prefetch:22⤵PID:4500
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2908 --field-trial-handle=1880,i,9089777907526979180,6035940228663092805,131072 /prefetch:12⤵PID:1684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4624 --field-trial-handle=1880,i,9089777907526979180,6035940228663092805,131072 /prefetch:12⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1880,i,9089777907526979180,6035940228663092805,131072 /prefetch:82⤵PID:4584
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4892 --field-trial-handle=1880,i,9089777907526979180,6035940228663092805,131072 /prefetch:82⤵PID:4996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3700 --field-trial-handle=1880,i,9089777907526979180,6035940228663092805,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4580
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54d8ab4bfa392c023891c29ee5e25d53f
SHA18341b0745fb0e44322c4925e30ce986c8a7b12ba
SHA2564c1d4f7a6be95eee162bdd9bb14a727cdba22c2377dba640b1c67298aef1bb29
SHA512af3c176c1f56b0c1344fa88be28e0576273eaf908ded5f73e8c27bab1a0b5a1d4eed592e419ce655320ee7e639d0c46b90a8d9f291f9b0705c90cc7d3dd151f2
-
Filesize
707B
MD5d233bc08e41c35a7391118f112aa16b5
SHA103a3b303d32c52b26bf284097c7b1b2a0ab27ac2
SHA256153c065e95add774b28b89d19620e4e26c41b05c3f2cffce39d442ae64ebe9f6
SHA512609ed3e29b4c97dcde2e07d46fe80bc631ad0b25a7ad731129a5f72ac0437dda7c4a84d7a625ad2ad6c2349c66cb995651334c2a8d40f873102ced2445f8f71a
-
Filesize
6KB
MD523f240bf961526a6092036e5f26326a9
SHA17c742ab4eaae7e4fde937a2b333b830ab991313f
SHA25687d3321e322ab96d6d9b516038472a7ee6153f1ebff158413e65f985acda3d72
SHA512ff055cc257cbe562d89f94e15ade28cad4c3df052584f0bb13cd8f1a21c27b64f059876099b9674b79d8d508c568b834f570a41b3ce3b7efe2c8b0869b5ba1db
-
Filesize
130KB
MD5ea0b1b154d8ff7420f859999e6fb126c
SHA1441f2f5f9e71d8c3ec6dcc053a06f73cde4c3c48
SHA2566d4cce0f53a2fd8468ae30e35aef8ef702640b0e2e1f9feffa16b5fd55ec402d
SHA512e66be4fc788ab96d93f512ed7e66503e87f04662c48de03b953ed10a9ef07bcb1799496dd3439b06f06859c2f53f191f96c556c292b50b3cebf9ace0ab8b2157
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd