Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
07/03/2024, 06:54
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://tracker.club-os.com/campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=eckbergdesigns.com/psp/QLDFI/bGFsYW5hQGFzaWEubG9ja3Rvbi5jb20=
Resource
win10v2004-20240226-en
General
-
Target
https://tracker.club-os.com/campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=eckbergdesigns.com/psp/QLDFI/bGFsYW5hQGFzaWEubG9ja3Rvbi5jb20=
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133542680925381627" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe 5704 chrome.exe 5704 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe Token: SeShutdownPrivilege 1900 chrome.exe Token: SeCreatePagefilePrivilege 1900 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe 1900 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1900 wrote to memory of 1444 1900 chrome.exe 89 PID 1900 wrote to memory of 1444 1900 chrome.exe 89 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 440 1900 chrome.exe 91 PID 1900 wrote to memory of 1448 1900 chrome.exe 92 PID 1900 wrote to memory of 1448 1900 chrome.exe 92 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93 PID 1900 wrote to memory of 2348 1900 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tracker.club-os.com/campaign/click?msgId=d738c6bd137e6a03157c6c728cbc659e734fc398&test=false&target=eckbergdesigns.com/psp/QLDFI/bGFsYW5hQGFzaWEubG9ja3Rvbi5jb20=1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1900 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xfc,0x10c,0x7fffa93d9758,0x7fffa93d9768,0x7fffa93d97782⤵PID:1444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1916,i,16186102838756324112,12796599552821920946,131072 /prefetch:22⤵PID:440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=1916,i,16186102838756324112,12796599552821920946,131072 /prefetch:82⤵PID:1448
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2192 --field-trial-handle=1916,i,16186102838756324112,12796599552821920946,131072 /prefetch:82⤵PID:2348
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1916,i,16186102838756324112,12796599552821920946,131072 /prefetch:12⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2980 --field-trial-handle=1916,i,16186102838756324112,12796599552821920946,131072 /prefetch:12⤵PID:2240
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4888 --field-trial-handle=1916,i,16186102838756324112,12796599552821920946,131072 /prefetch:12⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4636 --field-trial-handle=1916,i,16186102838756324112,12796599552821920946,131072 /prefetch:12⤵PID:4128
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3716 --field-trial-handle=1916,i,16186102838756324112,12796599552821920946,131072 /prefetch:12⤵PID:512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3136 --field-trial-handle=1916,i,16186102838756324112,12796599552821920946,131072 /prefetch:12⤵PID:3088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 --field-trial-handle=1916,i,16186102838756324112,12796599552821920946,131072 /prefetch:82⤵PID:384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 --field-trial-handle=1916,i,16186102838756324112,12796599552821920946,131072 /prefetch:82⤵PID:1924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2492 --field-trial-handle=1916,i,16186102838756324112,12796599552821920946,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5704
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2864
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
120B
MD512cd8e947b47737625619ad25e3d4c54
SHA12efbfc6cf0e65df4522ec69eb5a13b123fefd29d
SHA2564bfd130dc60520044fd57ea57c4843a4d4dd9847de124d9f8e97fbc43c535118
SHA512355366e49d30311fb0bc6845e8f05c7e06c1843de070be66e7b9ea597686c2481ac3b6b9362794824bfe13774c4c4287e9871bd70986c000bcb6c112a245a99d
-
Filesize
240B
MD5751e96f5cb402026d34ca729913b436d
SHA1b7331889c7b858479865ce3570b7fb3b08e35095
SHA256371373da6de95dc6ae862da78b1e03d8eef3cb0e5497e7fbf6ff10c11ba03675
SHA512da6d9590a5fb4d5d54d7c34074ca85a668f11627bf87573d94ced7f3d5c63939709c3e92692b0f385be175f749d7a49249594dc733c4f069484692518a9e0e97
-
Filesize
2KB
MD5772ce44565e48e70a2c458935b3c4971
SHA177392e6f73d7790063b31904e635d398cdd1d4a3
SHA2566df42fdfebdb11f5e75e773dca6e637b08fd36b558a5c993ca272fff08c4547d
SHA512b1549ab79f1a561e01ca8a453eb97e035b8702d4f6346a37275de8b76150c133b5330ea8a5471d52d2d191e2f948ec6ecb6f73e35a798012a26c5ca8eaf81ce3
-
Filesize
2KB
MD5d5b745e0260041f8f7bde3a5131b9c9d
SHA180403aa77a698c0bd9fa3b1834b682ad3a43951e
SHA256222ba47a84e2bc592e80231e88adf321eebd6df318335205031fff6e7b2efffd
SHA5125ef957203b7548dbe87ee39252510ff6e8167e847433803cd02adf16476bac0d279313a1687c3fb73fad64cbc36372f428e55021475930fec606a1ebf996265d
-
Filesize
539B
MD5fbd52593f5bc062d715bd80440c3ba53
SHA1953a598664ad2d1e674bf69355285b8fd8e34cc6
SHA25670cc51948379772b42091112a7be70d6297bd7b07b6792237f14a37797bfee12
SHA512ef97ff086642c5dcf70eb5803bf04cc3901316578a751aa5b07c75c73081c0270ea77e899b916cd86ffddfa2d3724a207392828f49bf277d40f5c9f38f29d2f3
-
Filesize
6KB
MD5dead2f60bd5567965d65227389fe5e72
SHA16123b70d12e89c651e170c10a9b01409cdc20875
SHA2569e35541226b05c52d1055c6d02afdccf65b7faf054ed85a2f91e48b982ad1378
SHA51200f84760bd05168bad16ff1ee2756216f84f29490cd3973f7276e69b61e3d1e965e170d8b016ec5859164b1e7ecc89b0d3b41fdee53701e71fe16f65da3d491c
-
Filesize
128KB
MD562a79fdbf6ee22d5b6a54dcd1f989ce7
SHA1bb8241a3864116298f8e911efc2768566108c425
SHA2568afdd6fcc28ea81d43e92777d44b1f4c570e1ab9ee211094dad5adea8e9c6921
SHA512c53f69626bce999d6c38b5a4a42faaca5241f73207e250370a691e1ad29d302fa9febe7bd28283405cebf333c5af0c0d32302fd8eda4e9ebc418466f6e672e27
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd