Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
48s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
18/03/2024, 18:38
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://voltexc.com/draxco/4ffd6c0.php
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://voltexc.com/draxco/4ffd6c0.php
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133552607400611278" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1532 chrome.exe 1532 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1532 chrome.exe 1532 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe Token: SeShutdownPrivilege 1532 chrome.exe Token: SeCreatePagefilePrivilege 1532 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe 1532 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1532 wrote to memory of 3032 1532 chrome.exe 87 PID 1532 wrote to memory of 3032 1532 chrome.exe 87 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2988 1532 chrome.exe 89 PID 1532 wrote to memory of 2516 1532 chrome.exe 90 PID 1532 wrote to memory of 2516 1532 chrome.exe 90 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91 PID 1532 wrote to memory of 3216 1532 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://voltexc.com/draxco/4ffd6c0.php1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff819689758,0x7ff819689768,0x7ff8196897782⤵PID:3032
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1872,i,1721690466311663861,15138141890574692774,131072 /prefetch:22⤵PID:2988
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 --field-trial-handle=1872,i,1721690466311663861,15138141890574692774,131072 /prefetch:82⤵PID:2516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2176 --field-trial-handle=1872,i,1721690466311663861,15138141890574692774,131072 /prefetch:82⤵PID:3216
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2928 --field-trial-handle=1872,i,1721690466311663861,15138141890574692774,131072 /prefetch:12⤵PID:4716
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2936 --field-trial-handle=1872,i,1721690466311663861,15138141890574692774,131072 /prefetch:12⤵PID:820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 --field-trial-handle=1872,i,1721690466311663861,15138141890574692774,131072 /prefetch:82⤵PID:3772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4888 --field-trial-handle=1872,i,1721690466311663861,15138141890574692774,131072 /prefetch:82⤵PID:3580
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4240
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\48355b56-8bbe-4204-a951-a39bdae5e38d.tmp
Filesize6KB
MD5a521f2ddd86e7e64eba4a5383a0ffb33
SHA1640dcb2150a994a0e743192b5e2896e197ce2818
SHA2565e21c9fc464279dde31e324a7357edb596b69e26554abe53a5ab34d446e53352
SHA5121945268d6cc3bcab57a834999159a585beb9d2e84b8b4a63264f90dcd2727877192af02cfe82f5a9a9a0bf71e3b72ece9fde6b35a5fd593de96823bc80c4558b
-
Filesize
6KB
MD5cda876544cf9eacf24d281b41d777a46
SHA1d43a928fe737ecc0333d2a8d2b61c8dfd55e8460
SHA256a2e646b8b491df5a55cebe2d22290048e8489961f0ec1a2594ec8448b06d501a
SHA512d25481044f8ee5e307e33320c54579c11aa84a793f1fff9262f45d7d7bb21ea21c93878c0869a336b4cb9a7ad086b58c6aa3ec17d8fe958ca8740215ffb416eb
-
Filesize
128KB
MD520a32fb1cdbd5cb60d5dc120be063357
SHA16c947efa3a6a50655fa0275325d18a808050430c
SHA2569482e8935516b6e74421880a28889057386bd70b2445ce3fbd5ceab64d568bb9
SHA512bc7df950ab4c19f2ce89303dd6f5f3c100403aa9930ad5f210b6b80302f54ea4b228c6de84370fa900196b6bfc3c2f20663392f2d525bfdb3e7123c97aaed406
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd