Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
41s -
max time network
39s -
platform
windows10-1703_x64 -
resource
win10-20240221-en -
resource tags
arch:x64arch:x86image:win10-20240221-enlocale:en-usos:windows10-1703-x64system -
submitted
14/03/2024, 14:20
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32023R1214
Resource
win10-20240221-en
General
-
Target
https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32023R1214
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133548996726080358" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2364 chrome.exe 2364 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe Token: SeShutdownPrivilege 2364 chrome.exe Token: SeCreatePagefilePrivilege 2364 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe 2364 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2364 wrote to memory of 4732 2364 chrome.exe 73 PID 2364 wrote to memory of 4732 2364 chrome.exe 73 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3792 2364 chrome.exe 75 PID 2364 wrote to memory of 3968 2364 chrome.exe 76 PID 2364 wrote to memory of 3968 2364 chrome.exe 76 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77 PID 2364 wrote to memory of 3116 2364 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=celex%3A32023R12141⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ff9b8f59758,0x7ff9b8f59768,0x7ff9b8f597782⤵PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1600 --field-trial-handle=1764,i,8666747682194912483,1050994383575468134,131072 /prefetch:22⤵PID:3792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1828 --field-trial-handle=1764,i,8666747682194912483,1050994383575468134,131072 /prefetch:82⤵PID:3968
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2060 --field-trial-handle=1764,i,8666747682194912483,1050994383575468134,131072 /prefetch:82⤵PID:3116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2840 --field-trial-handle=1764,i,8666747682194912483,1050994383575468134,131072 /prefetch:12⤵PID:1672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2852 --field-trial-handle=1764,i,8666747682194912483,1050994383575468134,131072 /prefetch:12⤵PID:1508
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5192 --field-trial-handle=1764,i,8666747682194912483,1050994383575468134,131072 /prefetch:82⤵PID:3728
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5040 --field-trial-handle=1764,i,8666747682194912483,1050994383575468134,131072 /prefetch:82⤵PID:4736
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4980 --field-trial-handle=1764,i,8666747682194912483,1050994383575468134,131072 /prefetch:12⤵PID:4112
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1356
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
936B
MD50db0d8e2d365503e283359db0d070a2e
SHA17967de97944986dc1e2a8b6b97556d30ef81bd5c
SHA256f829b4ac0847afd5014f28bb9540ef2bed0710240c525eb3436ef1182b4cfaf9
SHA512f14fda3ff63760874f3466143105ad02dd971faa10732e143ea51ae62030b20ff8545e0d4f808fe3d685c15a6761db82382d880326eb7d12405a8fa343763e42
-
Filesize
1KB
MD5c89db8b8e2b007b19fa9b781021baee2
SHA146ec9176bc19fd6315720cddd46154ef33bd4ec7
SHA256aaa726300cf675ff77a2a90659a3bdb588234a44a18261813bff307e539df565
SHA512ac8738aa8958fdd949a0cd608b40c1cfc483a0197c756b2f0e294a7d6c8101a2d2584f0f326db66bda693034b317ccfaa4c5c23200b326a0d391f87f21aeedf5
-
Filesize
874B
MD538a7fd68991d1d9f14f12adeba081304
SHA19e9c85d2582ca31a37e314914dbcca55f8450378
SHA2568610f632c7e82265ab493f672ad782a85678f316eb0c2e2deaac7be7064b9452
SHA5124e1692a61b417af5792bba9a87e6c21fd70af86371287cc54cce1b90546447dfb45220127f1794ab5519425180119e1b866757fbe771d7b6eda8ea76e89414f4
-
Filesize
5KB
MD5ec94c0cfcd957e35ae5c7d73c389f9bb
SHA1f623a79b593dfdc743f8072ccaf16e304693fd44
SHA256599ed9ef98462fe4ea51b57ae21877aeaf5c04cf55001c70d1e97a02c796377c
SHA51231798ef3e52dd0c4667907e9b8d58b592fa4968ce1cf3efa2a4df52e1cab2f710ed3c8f702081c602c6e5b8d0c3a46d05f70fca02de5eabcdeb686d4a8b10b35
-
Filesize
5KB
MD54cf30bb37c057ec1c2a38d2a82c86b34
SHA1b90e142d0bfb1bd282b2cfb6cae57fa354ab7083
SHA25612855d5b32d981fa2ff4fe47265779ed7fed1eedab843e140f01225210e7a648
SHA51229dc94a9f55a9c12e29c0d0c92d9d4b12edc58a0a2d2d5edc187a10be1b90c34d7aa19120a30001c5bfcebe66c8cbf37b00abe6add9915b0d9ba9be4a5ffcc22
-
Filesize
5KB
MD5e42c2b1b560b8070297d8a814242e45d
SHA1900b180753c4f711f1da47c2954dd39e4ccfba04
SHA256e7e8e2648c9a1701751095d957dbdaa52f5a9fdfe26b87bc899d230a2da6a957
SHA512e7908b82bfccee46cd0874076d4c63fcd1488d8b107da42c18b3fe90c78ed52375ce3ffd80afc7e48bb08688efe0c97bf8fd96e732e166ababba4452bc6c086f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3bfa032ddf16b54a0c5eac158ac05366309ec1ef\7f4b32b2-7570-4a6f-9bda-25c9468719ff\index-dir\the-real-index
Filesize72B
MD50f9c5de4972cdfe3ea976052a38d8151
SHA13da9d2c7aeb7db21871268229061d5cb89fa4d2e
SHA2566a960badc9366150ae74a675e11ea603357faab3704dd4f358042b4ca0e8a36b
SHA5122eae63ac4aca8d9ee1df4a1fb96c41169208431267edec94a0732312f761c94369c153a096eb6e5452fe5dd26a6690a721ab5429d26b718b371be3addbaf9563
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3bfa032ddf16b54a0c5eac158ac05366309ec1ef\7f4b32b2-7570-4a6f-9bda-25c9468719ff\index-dir\the-real-index~RFe57d4b5.TMP
Filesize48B
MD57f7cad6f8c9f702bee8058c26a8d133a
SHA1b02dc8d6c521ae7ab0407581636c5cf98797d1ad
SHA2569913164997e11fccd3065aeafe6a1c80907833c8fb34761ea818c1330ebb2eee
SHA51280636b99aa79b7ae515a0f4456c91b8c1dd47eabcb849cb31c57ee4ae95042da095bad602a7b0b55da2a3f104fbdd4c0c30b3be4f1fc8529eed7ea516e6ffccb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3bfa032ddf16b54a0c5eac158ac05366309ec1ef\index.txt
Filesize134B
MD5ba5ee1cb2fa0163a2a4f2fca5552872e
SHA1d5382fa7f88abd2836f4398a663f875fe012f999
SHA256fcd63cd0154661f5b8db8f30b5cc6c65ca16a40c6dbc66de976340bf71c4f1db
SHA512d26dbb17bebae2c2a75ee32c068a0f1c8ef18a132865918c8f25149183642226d6fbfc4b489e6b83bae072a176f88a25d09fa58476ca239cc28f9ab4c6029ada
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\CacheStorage\3bfa032ddf16b54a0c5eac158ac05366309ec1ef\index.txt~RFe57d4e4.TMP
Filesize140B
MD5bff7e7e5f9669acc0e8c5d54ae752273
SHA18abf7b8141137e980dff9fde43a4204f018890f7
SHA256b94a248d4e2f08a2c2c62e545549144d24be66563d6d8fd212c2ea9eacfbaaad
SHA5120f0412617b7587610465dcad135fe5460423b06a43479fd91dd12447a242dc2ad018a3d35a4339c3ba7dd50b3e3cbb0dc5cc4c3cf6758a3578e9b83306f6aae7
-
Filesize
130KB
MD51480b1a82d6f704b85fbf9c3d2f2a53c
SHA1b004293925548b3bfb971ec7d345d050f7868e62
SHA256974ab6c5f707a36fb5eb06396c10dd0e221986d767d64fce9e7a69d30a12d666
SHA512641ec7ef373f209a2160ff06b99cface5634d4aa4093b8e9469682dadcd359e4fd0aee022176ff93bb145e3654d369385947f35c6227945595951aeff6d357a1
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd