Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
79s -
max time network
79s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
06/03/2024, 07:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://weixin.qq.com/r/5RLw6N-EToIxrZuL90f3
Resource
win10-20240221-en
windows10-1703-x64
8 signatures
150 seconds
General
-
Target
http://weixin.qq.com/r/5RLw6N-EToIxrZuL90f3
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133541856397553747" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2816 chrome.exe 2816 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe Token: SeShutdownPrivilege 2816 chrome.exe Token: SeCreatePagefilePrivilege 2816 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe 2816 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2816 wrote to memory of 2908 2816 chrome.exe 74 PID 2816 wrote to memory of 2908 2816 chrome.exe 74 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 4952 2816 chrome.exe 76 PID 2816 wrote to memory of 3868 2816 chrome.exe 77 PID 2816 wrote to memory of 3868 2816 chrome.exe 77 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78 PID 2816 wrote to memory of 4552 2816 chrome.exe 78
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://weixin.qq.com/r/5RLw6N-EToIxrZuL90f31⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc378e9758,0x7ffc378e9768,0x7ffc378e97782⤵PID:2908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1520 --field-trial-handle=1832,i,5015683907095331115,14590458769102705091,131072 /prefetch:22⤵PID:4952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1776 --field-trial-handle=1832,i,5015683907095331115,14590458769102705091,131072 /prefetch:82⤵PID:3868
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2052 --field-trial-handle=1832,i,5015683907095331115,14590458769102705091,131072 /prefetch:82⤵PID:4552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2600 --field-trial-handle=1832,i,5015683907095331115,14590458769102705091,131072 /prefetch:12⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2608 --field-trial-handle=1832,i,5015683907095331115,14590458769102705091,131072 /prefetch:12⤵PID:1992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3804 --field-trial-handle=1832,i,5015683907095331115,14590458769102705091,131072 /prefetch:12⤵PID:1092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4500 --field-trial-handle=1832,i,5015683907095331115,14590458769102705091,131072 /prefetch:12⤵PID:2144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3732 --field-trial-handle=1832,i,5015683907095331115,14590458769102705091,131072 /prefetch:12⤵PID:3188
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3804 --field-trial-handle=1832,i,5015683907095331115,14590458769102705091,131072 /prefetch:12⤵PID:1564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1832,i,5015683907095331115,14590458769102705091,131072 /prefetch:82⤵PID:1112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1832,i,5015683907095331115,14590458769102705091,131072 /prefetch:82⤵PID:4916
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4244
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5efc2f88092ba2a7af787a67dd0e0cd18
SHA110de4527f6a20717ee94247d2dff8633cb781a3a
SHA256167dd19b7e7f70fbe77d5ebe12d81a64bd72999a83c34b945f6b563b98439bd8
SHA512d70009e5692da77f1f1301980213f808fb55ac9041f112bf001760078b753f583d6facb7fbdb44577fc75648dd0c0b34888caf2636cc0f8a047b8c53f82bb30a
-
Filesize
1KB
MD521a88236bdb8e9f8f35f5805d897d4ef
SHA18cdb837b99c8b19e9c60210c082a4dcbb14b2d5d
SHA256c03280c1855aa0ca71587b51e48018e2cb706075a14639ba7186da2bb6a52f82
SHA51247aa919b7c89b9e72480ba66a532847dbc395d7b0eb54ed549365c2d26fd486dfad98ae0e70b60084f6053c588dace15748bd5525230382ac3016e39d2650371
-
Filesize
6KB
MD5294003d50ca1fbdf61d15d8273dcdf8b
SHA1053d0064aa114079d8d0b8878f25758ca307ed26
SHA25652f65f1963157534a86989f1a50a5cd17ed71a3119798d5b6d0f65c53494613b
SHA5122b4626e32e6c5d278f048b0e822f6b5c44712c529333487c0bd62e8062a0bed5c25d4e434f98982cd3591751d05e814fda7f56a2d682b8f9f728770010a14102
-
Filesize
130KB
MD5122e899b9283d891a30c19f0bb8b7787
SHA19349a074b207ad9a06f03393342dbd4d93d06df8
SHA2563a57d570a16065eba8727921c022ed9f461e3230ec9f0eabd253ef7617d43262
SHA5124b8273db8ad8953e9f1fc5a8f2972f6cbc6181e697d79df678bb7c0a495371b7d534d0b98b09fc0298a87f77550e8eabf887daffc3df056b7a60b6aec2011974
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd