Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
23s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 04:37
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://cdn.jsdelivr.net/npm/@popperjs/[email protected]/dist/umd/popper.min.js
Resource
win10v2004-20231215-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://cdn.jsdelivr.net/npm/@popperjs/[email protected]/dist/umd/popper.min.js
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544326442577872" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3148 chrome.exe 3148 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 3148 chrome.exe 3148 chrome.exe -
Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe Token: SeShutdownPrivilege 3148 chrome.exe Token: SeCreatePagefilePrivilege 3148 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe 3148 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3148 wrote to memory of 4912 3148 chrome.exe 85 PID 3148 wrote to memory of 4912 3148 chrome.exe 85 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 396 3148 chrome.exe 87 PID 3148 wrote to memory of 3836 3148 chrome.exe 88 PID 3148 wrote to memory of 3836 3148 chrome.exe 88 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89 PID 3148 wrote to memory of 2056 3148 chrome.exe 89
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.jsdelivr.net/npm/@popperjs/[email protected]/dist/umd/popper.min.js1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffed2ea9758,0x7ffed2ea9768,0x7ffed2ea97782⤵PID:4912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1884,i,9314961693144484627,4944508333774572823,131072 /prefetch:22⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 --field-trial-handle=1884,i,9314961693144484627,4944508333774572823,131072 /prefetch:82⤵PID:3836
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 --field-trial-handle=1884,i,9314961693144484627,4944508333774572823,131072 /prefetch:82⤵PID:2056
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2876 --field-trial-handle=1884,i,9314961693144484627,4944508333774572823,131072 /prefetch:12⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2884 --field-trial-handle=1884,i,9314961693144484627,4944508333774572823,131072 /prefetch:12⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5084 --field-trial-handle=1884,i,9314961693144484627,4944508333774572823,131072 /prefetch:82⤵PID:3944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5072 --field-trial-handle=1884,i,9314961693144484627,4944508333774572823,131072 /prefetch:82⤵PID:3324
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1136
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
538B
MD5f8e8ef9ac866762b4bb5ee4874d7c315
SHA1c6aeb45545dbc66b18412dd2dd4a17091d478792
SHA256caf49d9d05e4511533b27679e627c995144722e09ab650daec5ae8e374063320
SHA51213552c9437ed8b04b962b0cc95ca74e4952eaf59e3e55ee0728ed7f3074b7e00e2a974a4aa393bec78e5fd2fe9814e9a7fbbe996b6260e060f2c1643d0ec692b
-
Filesize
6KB
MD5ca07db7c3f3ff77574a7a3a187ae8744
SHA14616fd8f5abaa693625d0f2d784c33032a8d9e7d
SHA25623faa2e9a2faa341db5afcfdd8ed2d78d549f9d243a561aaedf1d826bc4ed9ab
SHA512683ccd53e4f1f138b1835911c9e20fb3b0487447d374b329d2abb7abda5deafc6f8c110f6d5a79dee8b0d5aae339ccc184c577e8cdb7695630bad8805e86ef9a
-
Filesize
114KB
MD5a3ffc647658a4b953f9b8253a3aa8d17
SHA15692306e47ec536610ad85c182ca183f94dea11a
SHA25602fa26d9fecdc794a8119a976a224703ec674a92a422ac1df74e1119c197eb11
SHA5124b882c1ae66b794a90f12a7f413e3063391001ba316bc04208d80f0b783d65f2231d027a462567c472b14ab78defb329ab5b18af711f6a5b58826be3b34b0820
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd