Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1800s -
max time network
1685s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/03/2024, 18:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.peakpx.com/en/hd-wallpaper-desktop-vcana/
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
1800 seconds
Behavioral task
behavioral2
Sample
https://www.peakpx.com/en/hd-wallpaper-desktop-vcana/
Resource
macos-20240214-en
macos-10.15-amd64
1 signatures
1800 seconds
General
-
Target
https://www.peakpx.com/en/hd-wallpaper-desktop-vcana/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133543975970446807" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2636 chrome.exe 2636 chrome.exe 5332 chrome.exe 5332 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe Token: SeShutdownPrivilege 2636 chrome.exe Token: SeCreatePagefilePrivilege 2636 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe 2636 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2636 wrote to memory of 3044 2636 chrome.exe 89 PID 2636 wrote to memory of 3044 2636 chrome.exe 89 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 3816 2636 chrome.exe 91 PID 2636 wrote to memory of 1788 2636 chrome.exe 92 PID 2636 wrote to memory of 1788 2636 chrome.exe 92 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93 PID 2636 wrote to memory of 1560 2636 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.peakpx.com/en/hd-wallpaper-desktop-vcana/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2636 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc6b999758,0x7ffc6b999768,0x7ffc6b9997782⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 --field-trial-handle=1864,i,4685401413073631574,17057482012395278960,131072 /prefetch:22⤵PID:3816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2120 --field-trial-handle=1864,i,4685401413073631574,17057482012395278960,131072 /prefetch:82⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2156 --field-trial-handle=1864,i,4685401413073631574,17057482012395278960,131072 /prefetch:82⤵PID:1560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3056 --field-trial-handle=1864,i,4685401413073631574,17057482012395278960,131072 /prefetch:12⤵PID:3196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3064 --field-trial-handle=1864,i,4685401413073631574,17057482012395278960,131072 /prefetch:12⤵PID:4108
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4760 --field-trial-handle=1864,i,4685401413073631574,17057482012395278960,131072 /prefetch:12⤵PID:4728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4592 --field-trial-handle=1864,i,4685401413073631574,17057482012395278960,131072 /prefetch:12⤵PID:2588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=5344 --field-trial-handle=1864,i,4685401413073631574,17057482012395278960,131072 /prefetch:12⤵PID:4724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5464 --field-trial-handle=1864,i,4685401413073631574,17057482012395278960,131072 /prefetch:12⤵PID:1536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6172 --field-trial-handle=1864,i,4685401413073631574,17057482012395278960,131072 /prefetch:82⤵PID:1280
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5852 --field-trial-handle=1864,i,4685401413073631574,17057482012395278960,131072 /prefetch:82⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4940 --field-trial-handle=1864,i,4685401413073631574,17057482012395278960,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5332
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1672
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
696B
MD572ab0c2734425c801990fe0730d399bf
SHA1239fd90b34e3168f878baa69a274fc301e0a7b62
SHA256e7a971f985d12ea5290cf5f4f28b57f55497852c04daec43c584affd5cfce2a6
SHA512b5f6ad0932fa4a184cd526ada4d83e0d5692fb643c938fb675867b37fecd1181c3c071e1d98eb420c5327f043e99bd7622cd71324a65e5fbd4bc4ea583f73a87
-
Filesize
5KB
MD5c04522bc667454068a9094815c42ce2a
SHA1c8a9fa1cb438ea2f938336eb84d113033e563451
SHA2563938efeab8eb9a643de1c572dc5ffd2ac06a6562258dc88ebc37cca69f848d5e
SHA51280065adcd3731d7ce21bb55b97215ac6ea696425bc5d42cce3961da50fec437e00523810f7f7561288ab8de45d838e1a6fdfdbef34562b41ad85c0ee706b3ec4
-
Filesize
1KB
MD5ea23ad08310d85d8dfb4a7af6527a2c9
SHA1f32211581963186ef46982bd3ab4154fbb5ba67e
SHA256b2f6f21fae79958673b0fb1be17dd0db76f458fb3170eff53a2d19414a7e3abf
SHA512d800286776e4c4148717ad3b6e10ef1277a0205d5748c795180c946ab879e0ee8faa65946e795fe7d29ee0cea59fb0cf18c644556e5fb8c819bba7f449842e11
-
Filesize
6KB
MD509bad414907f826c8fe2979fb3ac4934
SHA19da87089e04199f37f6496ac9c7ee7baca367fe5
SHA256267aa283c7123f477011740a11dea5783b3c6e6e208a78910828cd5baead4df5
SHA512bd6f5e581d23b1cec1c05e50bcca5474237b483364a266a4c1b830378b2c2c7c15024ec51397f85446435ac58847526213521a5e2ce899050f9d3c8a2feb4853
-
Filesize
128KB
MD5618806a6d7ac11b2ebd6aeda71726515
SHA125ae5ed4c4a8db1dfce7426162ed6e2d7807f249
SHA256c3aed74325ab6195428116557f7ee44a983fc2b7feaacee39c44a00db62ec7c2
SHA5123847dd81656d843c342c0350606d0a0649adee9fcf834e5f054d715f3bb05fb367d7a77b8d1b4f6553919aba48c77a4962aa0ebf579b184d586a33781d9d74b9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd