Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240319-en -
resource tags
arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system -
submitted
05/04/2024, 16:39
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://urlaubspapa.de
Resource
win10v2004-20240319-en
General
-
Target
http://urlaubspapa.de
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133568087691442005" chrome.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 4476 chrome.exe 4476 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2884 chrome.exe 2884 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe Token: SeShutdownPrivilege 2884 chrome.exe Token: SeCreatePagefilePrivilege 2884 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe 2884 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2884 wrote to memory of 4236 2884 chrome.exe 94 PID 2884 wrote to memory of 4236 2884 chrome.exe 94 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 1880 2884 chrome.exe 96 PID 2884 wrote to memory of 4452 2884 chrome.exe 97 PID 2884 wrote to memory of 4452 2884 chrome.exe 97 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98 PID 2884 wrote to memory of 4872 2884 chrome.exe 98
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://urlaubspapa.de1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2884 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff895419758,0x7ff895419768,0x7ff8954197782⤵PID:4236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1904,i,6842124887719571847,92667186241880291,131072 /prefetch:22⤵PID:1880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2060 --field-trial-handle=1904,i,6842124887719571847,92667186241880291,131072 /prefetch:82⤵PID:4452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1904,i,6842124887719571847,92667186241880291,131072 /prefetch:82⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1904,i,6842124887719571847,92667186241880291,131072 /prefetch:12⤵PID:3332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2984 --field-trial-handle=1904,i,6842124887719571847,92667186241880291,131072 /prefetch:12⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 --field-trial-handle=1904,i,6842124887719571847,92667186241880291,131072 /prefetch:82⤵PID:5720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4984 --field-trial-handle=1904,i,6842124887719571847,92667186241880291,131072 /prefetch:82⤵PID:5804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 --field-trial-handle=1904,i,6842124887719571847,92667186241880291,131072 /prefetch:82⤵PID:5368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3748 --field-trial-handle=1904,i,6842124887719571847,92667186241880291,131072 /prefetch:82⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1856 --field-trial-handle=1904,i,6842124887719571847,92667186241880291,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4476
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2956
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4252 --field-trial-handle=2224,i,17688331074622862378,73816879873678745,262144 --variations-seed-version /prefetch:81⤵PID:2012
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
155KB
MD572abce26096daba167fe4d0c250602b0
SHA1c2e8a2a359f8b74fc96054c5c62d573c32fda0aa
SHA256933a91aa459a22d9dc2532b06fa2f83636fabcd2df781d6bc71357496e194b37
SHA512fc50924387f12e8c99385bede93cbfcba1fff0dc3dc478891230b0ea3eaa78c19103f84aba099227d9fa9c1d12a1e55eced020405014125b632a0c9c539c9c32
-
Filesize
600B
MD5216b9dd6d4736fa8c38bf7411d0a3d97
SHA1d8c61812e63a0a2f94e5d030626de020eb3e9331
SHA256e2531000561dea1ec35fab9a873b07657d4a32b00cee253d700adc2746286531
SHA512119b9eebc94fbe2b52f64da8c4e8377168cff164f10e7a660a8e8fc8ad82c0c445f2ebc1cecc7f2e8ff0a690ca54658ab0ca74f44e365bf16b1502037f4ec870
-
Filesize
1KB
MD5142d970141763e0a03c8145ba54be731
SHA1a0b0c1fc30540dea21e764d2dec4bfe759e12a44
SHA256af50baefb2cbe69b23c6b48f7b6530e6813151e59e96be547e38d0259b11b0fc
SHA512de07ae507f63c1832af37b3f801a5d90011eff1ac01bee5978af565a1352878d397ee7dee84efbca02bb0b11c4395defb8a9ff29d65095c250fd987720e7f65d
-
Filesize
538B
MD51a751891b8ff22d922581f1478e1c8ed
SHA16d7ac6c3cae69522fcdc5d2817193514f9d78df8
SHA2569922934fdf80fdace29a228c5093b75c1b681cbd193d8b5478cff1e389b9331d
SHA5126beceb5e73c4c8c8a430c1242f93cd6842086654ccc382901f01433594f6226ef6a4e55c26c93fe365ceff33fb65468edb82316f70569d0d0d92055df1fc116e
-
Filesize
6KB
MD50a3307ab5beb85bfb05a70a8f7f86e29
SHA1cd7aaf8b5a23f2a46c7cfbebee18d24649def451
SHA256a8571f29e0fa338c8a64f5cec83650eaa314f094c2d83a57263ef17418d78b91
SHA512fb8adb9dac8e873c711cba6639c1edf8ccb624c4dba5436734f92fb29939f1ea4672b2125e9c0fc29809f48febeb27e4e667c5b18efdd57eb43744417bf58988
-
Filesize
136KB
MD5ba3dc9cdd2308c457a25ae28f126fe20
SHA17bce5f9daf9e6d22aadf2dbc769016edb85e0009
SHA2565cc0e963ec351fe21c76a3c4915fadf265cbab2a3b1fa60396ca1c45c2019ac1
SHA51254f8dea5a51bb28edd61a5e32935fe08be616acf26f00476fed7987d0f224e70f5a23507e86100f5e218eb6f9d8763f37460963c781bdc643fe2633a3d6ec717
-
Filesize
136KB
MD5892291f43325f065ea4b1cbc828bc1e2
SHA15440f83dadd8f25e8596032f2ef598339b4c6467
SHA256eaf37647198b2d8a3a080129d2619fb772c1aaa3e5b8dc58229546efee530f02
SHA5128828aec58977c1e381460963dc6250fa889a9002b7e2f587a4dee94ec7472f14da809eb388318f6d16daddd61beacaf9dfd5d8b3846cd57cd8a8d8bb740ab2ec
-
Filesize
136KB
MD5c9d5bdedd8e733423d0288e0e747e884
SHA1cbfb0a7e45c492b78054b3356fe19a46c019c147
SHA256993642afd935b5854cebaeee3bf1bae9c566bfd3b4d650e7107a8294a63619c5
SHA5124c281560f48412283ab70398f8e185538a48c5e6713009ce070eb108a979bfdbfe48db3d4739cfa7598128f38c1993c94a06054cb267e54c94c347a17ddadc0d
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd