Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
36s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 19:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://goo.su/ep9a7r2
Resource
win10v2004-20240226-en
General
-
Target
https://goo.su/ep9a7r2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133544847029741218" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1916 chrome.exe 1916 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs
pid Process 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe -
Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe Token: SeShutdownPrivilege 1916 chrome.exe Token: SeCreatePagefilePrivilege 1916 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe 1916 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1916 wrote to memory of 4552 1916 chrome.exe 89 PID 1916 wrote to memory of 4552 1916 chrome.exe 89 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 2152 1916 chrome.exe 91 PID 1916 wrote to memory of 1268 1916 chrome.exe 92 PID 1916 wrote to memory of 1268 1916 chrome.exe 92 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93 PID 1916 wrote to memory of 692 1916 chrome.exe 93
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://goo.su/ep9a7r21⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb52179758,0x7ffb52179768,0x7ffb521797782⤵PID:4552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1648 --field-trial-handle=1812,i,170696831322648150,7452661030312490569,131072 /prefetch:22⤵PID:2152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2108 --field-trial-handle=1812,i,170696831322648150,7452661030312490569,131072 /prefetch:82⤵PID:1268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2188 --field-trial-handle=1812,i,170696831322648150,7452661030312490569,131072 /prefetch:82⤵PID:692
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2952 --field-trial-handle=1812,i,170696831322648150,7452661030312490569,131072 /prefetch:12⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2960 --field-trial-handle=1812,i,170696831322648150,7452661030312490569,131072 /prefetch:12⤵PID:468
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4644 --field-trial-handle=1812,i,170696831322648150,7452661030312490569,131072 /prefetch:12⤵PID:4284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5776 --field-trial-handle=1812,i,170696831322648150,7452661030312490569,131072 /prefetch:82⤵PID:1020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 --field-trial-handle=1812,i,170696831322648150,7452661030312490569,131072 /prefetch:82⤵PID:720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=5248 --field-trial-handle=1812,i,170696831322648150,7452661030312490569,131072 /prefetch:12⤵PID:5260
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1808
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
672B
MD52cafd4290139de7937b52f9d16e10f98
SHA19cda977586e79ff94d6e01f6dc8a5a50b8dd763e
SHA2563dc81e4e1ec81609f8086f8d0259dd4fc1e61c641f037733dcfe5a5b8a8b03b2
SHA512f5f5f1b3c39332a022e565cc174188397c57ce9a6089ee4a87115dfeea449c2d9f15d76a92d5c9e615a87c658e5508de62225663d937f3caf630094600622abe
-
Filesize
16B
MD546295cac801e5d4857d09837238a6394
SHA144e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA2560f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
SHA5128969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\File System\001\t\Paths\MANIFEST-000001
Filesize41B
MD55af87dfd673ba2115e2fcf5cfdb727ab
SHA1d5b5bbf396dc291274584ef71f444f420b6056f1
SHA256f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
SHA512de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
6KB
MD56046b9f94b0d4ed1f61c20c6bf53f79d
SHA12fc9d5f3d52c1e132678f8864fef60816e18a688
SHA256dcd3e6cc85a95bff36dcac545b567c5d093d3c5c615c2fa91b17567df6184a80
SHA512b5c4cc7d5196ebab5277eb3dc27a7629474b0a3b14fcf537293d1ee8f80ac64dbe3d871e5c7452c0e66b05847b2f0fee96bc6494a20801ec7704adaf7d10e928
-
Filesize
2KB
MD5c4f037191450b155912d1c67664f465b
SHA117348ee47c8f798b6e695ebde97f3298aca7d7e5
SHA256e66f05d22031414629b801a09eb2f6792066f2d90d4e22ae062e697f231febfc
SHA51207c2084a5398abb7601292d8d4899dbd3f3e88ecb6d59309d000f18ddfcdd2ee587caa0f62d3e15ce2e955c2cff31ca8c6e35dcf01d69b108524196917b9a0bd
-
Filesize
2KB
MD529f36c3043626f34ceda5df073c318df
SHA1ccc13dbd6d67c3606a672831dac01d4e0b877899
SHA256c422e6befe8c7e0d88ff53b5181dbb4171156bd137e44c753a69db6169829a9c
SHA5128d4899faab80fa53f8306eeaebdd13b4ba91d049c65f0fd35686dca8d9062f84aa6cf74ae467be4e97e9a76bfaa532943eedff94c193f2b2c29a8e82f1a5f2ac
-
Filesize
6KB
MD59c0b06f9334e5565888721a5ca4ca49e
SHA1f6c64a7f34da25636267708d1b13deeba1d74755
SHA256b108bdaabe93107699690e152777f3942e02330b285b06b0381098a622860619
SHA512e77d7f977db492a9d809b9fd0b8f1c945a80d0731739ace85e09e97a5ea88261dd8327d2cc2916324c53f99263bcad2e6eae71093a9e736213c7e0938841fbf8
-
Filesize
6KB
MD56d668b55693db669249bbc94a7b0079b
SHA1fcbc7574eff8e37cdb5c390f8b0898920f7dfa14
SHA2569f9430b9d8c81f83b73a63b441b4b737144bfc57b2741539c7b0ea9466ef350f
SHA5124eb26fc2594290794cdf24eeb2b2e4c84356aa21cfc450ef4bb5762e408dbf798ee89f94b15a2f3f70013d178d352a9d1f8e67e880c36f52c4ac5ade09d7fa24
-
Filesize
7KB
MD546d3959aa1bbb375fdb49bf71ee6e57f
SHA1d888108936d5481680d08a979d9b06c864cb0d83
SHA256717d2859c199bfae10a620a1f412f2d6e85571d86411763f5e447e8fd945fc28
SHA512d8c39640516c9b11a7a291872c5ad7dd3d4f1771d80d1ea9c8c8c9aa08b2b9663196dfd4fd9503a024518bfae0319701dcb36d3010f8d03ea95d9e20bad6c239
-
Filesize
128KB
MD5ffc6d2921eb82f0fc25130bbd078badb
SHA1e2edd9e9d94a45a2a8d4f519cba605477a0b9ed0
SHA2566dbbdf6cf0ca4438e86427f518794ec58035006c4c094a058d144aa540cf6768
SHA5120d0b2ee2cd18a59ac79b1253f53f562ff9d452d0d78bf6fa4876d5f911cdde1e1e65db851e47ad9a62d1175f1fe97bd585ecff803121fb5f2646fc4aabe7b531
-
Filesize
128KB
MD5b38399241a2e0dfdf748a82b6593a419
SHA124dfb6aca434664f73991704ee5ca9f1160d82b2
SHA256450cac55af7372b004f7c16fe9ea55e53c64e68fd9a58236647304c1d89f40b1
SHA512e7337917c4f8b668755965b9528c94dfe769a47aa6a7280f860ae9f3c73060d2316e15f6b806cd85675f83fe920963ea4b07990ca16c154bd9fe4e23203c5fd9
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd