Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
27/03/2024, 09:20
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133560048479121109" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3444 chrome.exe 3444 chrome.exe 1776 chrome.exe 1776 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe Token: SeShutdownPrivilege 3444 chrome.exe Token: SeCreatePagefilePrivilege 3444 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe 3444 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3444 wrote to memory of 2136 3444 chrome.exe 93 PID 3444 wrote to memory of 2136 3444 chrome.exe 93 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 3668 3444 chrome.exe 95 PID 3444 wrote to memory of 2840 3444 chrome.exe 96 PID 3444 wrote to memory of 2840 3444 chrome.exe 96 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97 PID 3444 wrote to memory of 4752 3444 chrome.exe 97
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ajax.googleapis.com/ajax/libs/jquery/3.4.1/jquery.min.js1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9bdf69758,0x7ff9bdf69768,0x7ff9bdf697782⤵PID:2136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1656 --field-trial-handle=1896,i,6904767227548100113,13995320034065330085,131072 /prefetch:22⤵PID:3668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1896,i,6904767227548100113,13995320034065330085,131072 /prefetch:82⤵PID:2840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1896,i,6904767227548100113,13995320034065330085,131072 /prefetch:82⤵PID:4752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3084 --field-trial-handle=1896,i,6904767227548100113,13995320034065330085,131072 /prefetch:12⤵PID:2744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3100 --field-trial-handle=1896,i,6904767227548100113,13995320034065330085,131072 /prefetch:12⤵PID:4064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4532 --field-trial-handle=1896,i,6904767227548100113,13995320034065330085,131072 /prefetch:12⤵PID:3436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4812 --field-trial-handle=1896,i,6904767227548100113,13995320034065330085,131072 /prefetch:82⤵PID:2916
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4920 --field-trial-handle=1896,i,6904767227548100113,13995320034065330085,131072 /prefetch:82⤵PID:5224
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2856 --field-trial-handle=1896,i,6904767227548100113,13995320034065330085,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1776
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3776
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1420 --field-trial-handle=2700,i,14629483171127516024,12350888228055326066,262144 --variations-seed-version /prefetch:81⤵PID:1640
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d31a842f0bd89409bc8ced24c73032ec
SHA1e1aaa3b490b990f6f86ce91b70868c623f29403e
SHA256c9ee636c9632a99da12d8babac388bef0f9a4b6538c311566071c4b4c7680810
SHA5124fa29a7ac5644efd7ad7b9adcda92780338a0289274bc757f4ff9b705b6894263bd4798c38d5b79e15a80c4715468a8715bff0f17fe75a2e817b474fa1532d8c
-
Filesize
6KB
MD53d260ed855029a0de62c9bcd1fc7002e
SHA1a83d008acaad7207391deeb450b33b24d733cd8e
SHA2564c50e5398f124207edc8330ef23ecb32cdd0db1ccfe6516027e59191d69c283d
SHA51213c2bfd98a716c81481599e7a6adb36930fd9e88acf38d408d599815af47ce6f1be07e256074185c5aebc1b26a71ad0f71c5f08028ba4f9b198286333459cc60
-
Filesize
128KB
MD5c246a301bb15235af244d41b9483fe54
SHA1c84d14fc0e2aa7011d5d9f41a5519208fc4181ba
SHA25636e9939acb5640c00ee61b470618888c530f6b48479db44297efde6d5ede272f
SHA51279c8d01e173985838b67ab443f324e41cf2f30d3ade2038a07a4cc1d1f4192aec4d7ab4eb186bf5d720600a34ded51a4186379e2403d89e0550e7d23b3b3fced
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd