Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system -
submitted
25/02/2024, 01:19
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://uinvest.pro/4874c92b59857035?l=8
Resource
win10v2004-20240221-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://uinvest.pro/4874c92b59857035?l=8
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133532975689306917" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 4040 chrome.exe 4040 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe Token: SeShutdownPrivilege 4796 chrome.exe Token: SeCreatePagefilePrivilege 4796 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe 4796 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4796 wrote to memory of 4600 4796 chrome.exe 67 PID 4796 wrote to memory of 4600 4796 chrome.exe 67 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 2068 4796 chrome.exe 87 PID 4796 wrote to memory of 472 4796 chrome.exe 88 PID 4796 wrote to memory of 472 4796 chrome.exe 88 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89 PID 4796 wrote to memory of 5052 4796 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://uinvest.pro/4874c92b59857035?l=81⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4796 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff858489758,0x7ff858489768,0x7ff8584897782⤵PID:4600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1632 --field-trial-handle=1876,i,8771739640025885237,11372018459026586050,131072 /prefetch:22⤵PID:2068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,8771739640025885237,11372018459026586050,131072 /prefetch:82⤵PID:472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1876,i,8771739640025885237,11372018459026586050,131072 /prefetch:82⤵PID:5052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3100 --field-trial-handle=1876,i,8771739640025885237,11372018459026586050,131072 /prefetch:12⤵PID:2096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3132 --field-trial-handle=1876,i,8771739640025885237,11372018459026586050,131072 /prefetch:12⤵PID:960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1876,i,8771739640025885237,11372018459026586050,131072 /prefetch:82⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 --field-trial-handle=1876,i,8771739640025885237,11372018459026586050,131072 /prefetch:82⤵PID:3308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 --field-trial-handle=1876,i,8771739640025885237,11372018459026586050,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4040
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1604
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
-
Filesize
96B
MD556abccf38e1efd638739762cffaecebd
SHA1b088cd80849be95958473952ce818952eb6dee8c
SHA2568776387ecd46e026a90bfd501310743904de16d1e46fb7ce68c7e233eba37205
SHA512d2b898594c79b2434c4bf9a1227f7beb2d290176f8d1f3d0e563d35871eb7adf52909e3ad994c5cc816633a3e4726af1e3509118436d2ead85715c6e2669dec8
-
Filesize
1KB
MD5542254f64bd1823f12ee3edcf3866d9a
SHA116ed8cf69854c3960053046b597cf4f421c07305
SHA2568e7f85b6aced2735373492796b2b638a1ffb33e120bb5c2001f42e43b1b6033a
SHA5121f4a5e24cda30403f341534e1b5f1b26aa9855e9ca672014193b7fffdce0e2a7c609b478384751c1e63dc05a40aa1c091a0a0e6f826358a59a2f2b2772467072
-
Filesize
1KB
MD562a8117c0f66c9d761109f0e72e91dec
SHA1c7839c35f2349bb567ccf1f9624acf75fea2e157
SHA2562c2dd18af1bf0026eccb4a484e1a9067a7f2548bf4d5752e8f4de92c62fcd3aa
SHA5128cf5830b5eebac5d11dc4b2a1eff2ff0a0b19cbb5eec8af27587dbeab87db4209c8fed762cf2143b19d93f785c0cefa6f0c027ede0d0f775b0ba169e2d53fe0a
-
Filesize
6KB
MD5866bc31e1ff479b9ad8efd88c78077f6
SHA1e2b823af8f73f04be3bc3d04a34dade82408d29b
SHA256f1308e4356189d3084a7d754845ef6cd99d6ea0bb307a879a4bed9863288d858
SHA5126a67fe5592dacaded8f857dc0c46e7b077cda0f2c48dcf51279ada68c3a5faba5a1b27084888d3f19fc249f5c3fbfdabcdf67feaba0c4e76178c062bf850b64d
-
Filesize
130KB
MD54383c2cc0605e9356560c1f0fbd01984
SHA10fe22fded2dc9e4eacae1b03e08f247a1e61f4c5
SHA2566aae6ba6f860582ee94859ae9db7f4d72dc04b1604fe16d36cedc08d9b4aaf8f
SHA5124aed5c1048cbeb1851d8926df642dffe666e56b1020c3121b954b526b8e8f8f086f44bb6d788248f139ac9d6db463d7a31ea794401cec7ac2a595fc9cdf0d44c