Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
160s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
14/03/2024, 14:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://northstartransition-my.sharepoint.com/:b:/g/personal/jyoti_northstartransition_org/EQ1Ua1hfweZInbnm955DvskBycTg_Js5loJmhuWVDGNheg?e=FFmbds
Resource
win10v2004-20240226-en
General
-
Target
https://northstartransition-my.sharepoint.com/:b:/g/personal/jyoti_northstartransition_org/EQ1Ua1hfweZInbnm955DvskBycTg_Js5loJmhuWVDGNheg?e=FFmbds
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133549008244644365" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1940 chrome.exe 1940 chrome.exe 5108 chrome.exe 5108 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1940 chrome.exe 1940 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe Token: SeShutdownPrivilege 1940 chrome.exe Token: SeCreatePagefilePrivilege 1940 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe 1940 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1940 wrote to memory of 3144 1940 chrome.exe 88 PID 1940 wrote to memory of 3144 1940 chrome.exe 88 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 3168 1940 chrome.exe 90 PID 1940 wrote to memory of 4456 1940 chrome.exe 91 PID 1940 wrote to memory of 4456 1940 chrome.exe 91 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92 PID 1940 wrote to memory of 3988 1940 chrome.exe 92
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://northstartransition-my.sharepoint.com/:b:/g/personal/jyoti_northstartransition_org/EQ1Ua1hfweZInbnm955DvskBycTg_Js5loJmhuWVDGNheg?e=FFmbds1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1940 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe08ae9758,0x7ffe08ae9768,0x7ffe08ae97782⤵PID:3144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1960,i,12947419697438551094,17965921742423414712,131072 /prefetch:22⤵PID:3168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1876 --field-trial-handle=1960,i,12947419697438551094,17965921742423414712,131072 /prefetch:82⤵PID:4456
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1800 --field-trial-handle=1960,i,12947419697438551094,17965921742423414712,131072 /prefetch:82⤵PID:3988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3120 --field-trial-handle=1960,i,12947419697438551094,17965921742423414712,131072 /prefetch:12⤵PID:3172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1960,i,12947419697438551094,17965921742423414712,131072 /prefetch:12⤵PID:1296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4576 --field-trial-handle=1960,i,12947419697438551094,17965921742423414712,131072 /prefetch:82⤵PID:4440
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4908 --field-trial-handle=1960,i,12947419697438551094,17965921742423414712,131072 /prefetch:82⤵PID:3008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2372 --field-trial-handle=1960,i,12947419697438551094,17965921742423414712,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5108
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:936
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
240B
MD5b4e428fc8530a4d02c068d5e3f274584
SHA13b0a09447ab284f4a7166d50f32a3a48ea2f34a6
SHA2565bce728c6c888470318c917bd42d5e766d310b6e0a8bd901338fc8b75096ca20
SHA51253846fac9a7e46f764cc0499933c13caf9afb36187912f7aeb3cca225122736499e5cf555b408746c22311a120c8cbeb26d3c11fbc83354526dfc88f0b6961eb
-
Filesize
1KB
MD586583dc5452e46aac4979956ff29fd6f
SHA185054dbea9bd326706a2e9df490b4efbdee40452
SHA2569e16d6d05c3bb52d1582a29cd73d6163b72cc5bd53a30caff08639d751f641f5
SHA51234e7a381e8771b2a61f603a61de9c026037acea0425741c00b8ec6c6eddab2ac7af486843dc04ef91be19ea77ef2dcad659b5229a198a9992b577068a36658d5
-
Filesize
704B
MD5edfddd1d725e514bcbe93e3749e564d0
SHA1330962e44e60332e6ab78bd6ebe187cfba8909f2
SHA2567d934aaca1ee5c6de42f4f430618092aa045abe01be28bb4d59f2b78426f971c
SHA512cbb5e4956307021a25a1373e9521c953192601c915e4ba9d47b0f34e45ac87f7a6aefe469e20c115970e45eade9794ddd88cb8f44452b35390c39003447d0848
-
Filesize
6KB
MD57d078a40ce72bc45c8060a2017555bb2
SHA1c8c7422db7619653eb971f0277aa2a4cc26fb982
SHA2567c0d76e39aa82c434dac421cd9bd906918cb0988c42f0e3bae105fc87f7d94ca
SHA512b90c460f170992d9a621acd788b5b72e0dad7da0c69e82bf49afee0b3fd492ff588d45163524d8db5e0cb16007f2dcc1c93c894a23ca678fb486e6c3ae32c8ef
-
Filesize
128KB
MD5151902129824a32747cd214a31619e37
SHA119752b2396ae032a78160c1e271bb97c1396252f
SHA256d04e78ec91ba8c67e3be1b1504bae4a0270c8d4a3d9c1c1c4d8dfee25902314c
SHA512848e2f13ce802ac3fd63ad6db3176aa680be2f375bf4468b16bc0037d46792838dfb85c2e9a7a4513b0cc14a68dfd0992ed8d49a426824db85a447bc5a3b7ce0
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd