Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
33s -
max time network
41s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
04/04/2024, 22:22
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://zzb.bz/3fuEh
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
30 seconds
General
-
Target
https://zzb.bz/3fuEh
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133567429836550178" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4936 chrome.exe 4936 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe Token: SeShutdownPrivilege 4936 chrome.exe Token: SeCreatePagefilePrivilege 4936 chrome.exe -
Suspicious use of FindShellTrayWindow 53 IoCs
pid Process 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe 4936 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4936 wrote to memory of 1008 4936 chrome.exe 93 PID 4936 wrote to memory of 1008 4936 chrome.exe 93 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 1780 4936 chrome.exe 97 PID 4936 wrote to memory of 5004 4936 chrome.exe 98 PID 4936 wrote to memory of 5004 4936 chrome.exe 98 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99 PID 4936 wrote to memory of 2892 4936 chrome.exe 99
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zzb.bz/3fuEh1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4936 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa36af9758,0x7ffa36af9768,0x7ffa36af97782⤵PID:1008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1660 --field-trial-handle=1884,i,11682446782081952052,178792873735009509,131072 /prefetch:22⤵PID:1780
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 --field-trial-handle=1884,i,11682446782081952052,178792873735009509,131072 /prefetch:82⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1884,i,11682446782081952052,178792873735009509,131072 /prefetch:82⤵PID:2892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2988 --field-trial-handle=1884,i,11682446782081952052,178792873735009509,131072 /prefetch:12⤵PID:3812
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2996 --field-trial-handle=1884,i,11682446782081952052,178792873735009509,131072 /prefetch:12⤵PID:3876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3656 --field-trial-handle=1884,i,11682446782081952052,178792873735009509,131072 /prefetch:12⤵PID:1172
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4212 --field-trial-handle=1884,i,11682446782081952052,178792873735009509,131072 /prefetch:12⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 --field-trial-handle=1884,i,11682446782081952052,178792873735009509,131072 /prefetch:82⤵PID:5292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5364 --field-trial-handle=1884,i,11682446782081952052,178792873735009509,131072 /prefetch:82⤵PID:5480
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4688 --field-trial-handle=1884,i,11682446782081952052,178792873735009509,131072 /prefetch:12⤵PID:5568
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3876 --field-trial-handle=1884,i,11682446782081952052,178792873735009509,131072 /prefetch:12⤵PID:5648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffa36af9758,0x7ffa36af9768,0x7ffa36af97781⤵PID:3104
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:624
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40B
MD585cfc13b6779a099d53221876df3b9e0
SHA108becf601c986c2e9f979f9143bbbcb7b48540ed
SHA256bd34434d117b9572216229cb2ab703b5e98d588f5f6dfe072188bd3d6b3022f3
SHA512b248162930702450893a112987e96ea70569ac35e14ef5eb6973238e426428272d1c930ce30552f19dd2d8d7754dc1f7f667ecd18f2c857b165b7873f4c03a48
-
Filesize
5KB
MD5a4868e8d9ce12fc17f7897016eeec1db
SHA14945c7ed2b2985365de06d9f8885e42ea129611c
SHA2561de8fe506f34b76a2058ebfbf2bcde5b9ab35c99c7a87a247e64839b595ba0a7
SHA512caa069092ce2b6c4a02dfa89bbb6a192d9566bcc715f3509f99c66a15f5af9348265f257951730e758d4f4623c36dec8b41c887cc89eab94955f397a1896ad41
-
Filesize
5KB
MD51866a0f536e18783ae5343778bc58cef
SHA10ad9107e6d3dca1778c14483b7072b54b8db87cf
SHA256bc76c4dbd5cbbed919b8493bf2413083602c31be8360ead5fe06fc9b10768e0b
SHA512821f8dfbd336024a1f5fe3ba17eacca9aa1e8feee93c7d6797f3b50c2d3adb7fa2f27848b6ddbce459550c72119016f38bbc615b113b7633aecdb158119174d8
-
Filesize
128KB
MD59870d3ece617cb25bf1e27bc00f78bbf
SHA1cbc95293e991405ae7ae7d61d2ce30428f94a979
SHA2562ae62dc96d2051f838ef2f311f834b813890b9e72882c8cd2f6b93c0f21cab03
SHA512fec3eca7702bbb1a9338d846f8bdf27fc709b54143d6599446cf77c4e29761413889e6cd5fb68d8ed151eb82c10e987b64a7c39cb6878e3a7c162d3a3661a546
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd