Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1199s -
max time network
1170s -
platform
windows11-21h2_x64 -
resource
win11-20240214-en -
resource tags
arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system -
submitted
10/03/2024, 05:08
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com/free roblox exploits
Resource
win11-20240214-en
windows11-21h2-x64
8 signatures
1200 seconds
General
-
Target
http://google.com/free roblox exploits
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133550705724792166" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4876 chrome.exe 4876 chrome.exe 744 chrome.exe 744 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4876 chrome.exe 4876 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe Token: SeShutdownPrivilege 4876 chrome.exe Token: SeCreatePagefilePrivilege 4876 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe 4876 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4876 wrote to memory of 4412 4876 chrome.exe 78 PID 4876 wrote to memory of 4412 4876 chrome.exe 78 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3028 4876 chrome.exe 80 PID 4876 wrote to memory of 3292 4876 chrome.exe 81 PID 4876 wrote to memory of 3292 4876 chrome.exe 81 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82 PID 4876 wrote to memory of 2956 4876 chrome.exe 82
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com/free roblox exploits1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4876 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc72689758,0x7ffc72689768,0x7ffc726897782⤵PID:4412
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 --field-trial-handle=1824,i,2304808339451138521,16176881864443199063,131072 /prefetch:22⤵PID:3028
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1824,i,2304808339451138521,16176881864443199063,131072 /prefetch:82⤵PID:3292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2160 --field-trial-handle=1824,i,2304808339451138521,16176881864443199063,131072 /prefetch:82⤵PID:2956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1824,i,2304808339451138521,16176881864443199063,131072 /prefetch:12⤵PID:2628
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2964 --field-trial-handle=1824,i,2304808339451138521,16176881864443199063,131072 /prefetch:12⤵PID:676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4688 --field-trial-handle=1824,i,2304808339451138521,16176881864443199063,131072 /prefetch:82⤵PID:2552
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 --field-trial-handle=1824,i,2304808339451138521,16176881864443199063,131072 /prefetch:82⤵PID:2220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2424 --field-trial-handle=1824,i,2304808339451138521,16176881864443199063,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:744
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:5056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1013B
MD542999632d34a27219fc55bef227787af
SHA1c0bd2f41366d42ff4d3697e69bb69ecf623ab802
SHA256eb49378579073ef993ca4f67e820c35b93022e68c97af3f91dafd34817f6da2e
SHA512d7cf03a0c4e518d983df49e061fe33a4795e54f52778a740560478c7e5f85453a1a06b1e48d16f018b7c959870d87f7822ffff11c0a058119e27ce44b34aadac
-
Filesize
827B
MD581e731d97fcd77cdebc8e28ef681d151
SHA18bedc9cb09a98f8975b03d6bf11bafec5901e954
SHA2569425adc4442def2edf191cdc40f410a12f6d76bc8edc107dd197fdee2fac05b9
SHA512b013d18a83a06a347b0c380d4b2c1f0bb6f454e5866116aa90f637b8183f811a85653a644106f531e3593f62025a76945b41e599f46c2e186db8a4d0ce1bfadd
-
Filesize
1KB
MD5b73929ab4e376cc58a834347c62e373b
SHA1e740055fd1a3e26dcacbb0114e2358db2a4b0eeb
SHA25626eb97615062c7ecfe5e4b971584c8a0d614ce5c12f769617d003c930c22437d
SHA5123bc54b6a27b50dda0c01f33adc5172ffeaed58c3c9f37fe6d46a8b28b23f7c4b25b5b99948ad278681e363914620f3775ea0ddf8392e8543e5f62e2527359145
-
Filesize
6KB
MD5afa7de2f4934b4763f37ff730569da2d
SHA148c033cdf92a44b14b77d053eded25b3d4f5e84f
SHA2569965385cf7853c28e060b6d5833f24f3e7e99f117a7a330a58f6e16bdfd557dc
SHA5123f95c7d4931ef67ce9be4c71a4efad1dc30a5661d1586c78aa5ae6970fef70e43c108e34b47daade746d7bf255e7783009e274db16a9602c74abee6f65783559
-
Filesize
129KB
MD57801d0805298213311ccf263ac44029d
SHA1ca7e7d46446a38e34d392b10c51e0f00c98ffe99
SHA2565a7b94c78bd15f957488aa0025ae27f659e737b7c63f99b2918211a4952d9c04
SHA512f88bf25192ac9fe1600ce34ff6a36f76f811b95759b56ac408f5a97030267e02cbf220a3b75dbb01b8eceabc091caf4f5f9b3b666751e1032b4a75d6878c6afd
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd