Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
600s -
max time network
602s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
06/04/2024, 02:32
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.mediafire.com/file/3884i4n4al1io82/ZCLO_Auto_Spoofer_1.zip/file
Resource
win10v2004-20240226-en
General
-
Target
https://www.mediafire.com/file/3884i4n4al1io82/ZCLO_Auto_Spoofer_1.zip/file
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133568445758455807" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4732 chrome.exe 4732 chrome.exe 5232 chrome.exe 5232 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4732 wrote to memory of 1892 4732 chrome.exe 91 PID 4732 wrote to memory of 1892 4732 chrome.exe 91 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 1436 4732 chrome.exe 94 PID 4732 wrote to memory of 2828 4732 chrome.exe 95 PID 4732 wrote to memory of 2828 4732 chrome.exe 95 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96 PID 4732 wrote to memory of 4428 4732 chrome.exe 96
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/3884i4n4al1io82/ZCLO_Auto_Spoofer_1.zip/file1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffedafd9758,0x7ffedafd9768,0x7ffedafd97782⤵PID:1892
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1708 --field-trial-handle=1864,i,15865791984211422712,6298186035725139865,131072 /prefetch:22⤵PID:1436
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1728 --field-trial-handle=1864,i,15865791984211422712,6298186035725139865,131072 /prefetch:82⤵PID:2828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2236 --field-trial-handle=1864,i,15865791984211422712,6298186035725139865,131072 /prefetch:82⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3108 --field-trial-handle=1864,i,15865791984211422712,6298186035725139865,131072 /prefetch:12⤵PID:2092
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3252 --field-trial-handle=1864,i,15865791984211422712,6298186035725139865,131072 /prefetch:12⤵PID:3996
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4596 --field-trial-handle=1864,i,15865791984211422712,6298186035725139865,131072 /prefetch:12⤵PID:2528
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5616 --field-trial-handle=1864,i,15865791984211422712,6298186035725139865,131072 /prefetch:82⤵PID:3828
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5612 --field-trial-handle=1864,i,15865791984211422712,6298186035725139865,131072 /prefetch:82⤵PID:3384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4648 --field-trial-handle=1864,i,15865791984211422712,6298186035725139865,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5232
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3176
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:81⤵PID:5804
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1392 --field-trial-handle=2256,i,9172343514068348080,519219714517961765,262144 --variations-seed-version /prefetch:81⤵PID:5572
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54985ad784c82759713c39e364103ca2d
SHA111a5ff1b3147f1aa491c98140612817f9c448f60
SHA256045aabd11bdeaf80f39df41e4ce2c117f67b2d615ff2faa01d18bd02d9b533b8
SHA5129618afd254db56ede9316222cce47b1476bddbfe8eee791d9392bc088c3f71b6b6fd77d25aea081ec8c056f93db4a8037070750eb137b9e3c2788569cd949e5f
-
Filesize
7KB
MD53a7b8c97f3d617d1f46c6fb82307348e
SHA17a75555a1456abaaabfd90d947bb54b36d2068ab
SHA2563afbba6b9d71ac77a69e23bdaa2f007122846128b6d7eb8b8e261844f6688c87
SHA5123e0edba43c625995fed999d11124d045bfb60b909dc0eb76cde10d5996510079bcb34f597b970e9fa8a2ca772efc3d156e1e242beee6fdefcd876900705866e0
-
Filesize
1KB
MD59d262cd79138da2a5ed9cec3fc8cae88
SHA1881cfcc4283d8cc284b649254a9abe158219b8eb
SHA256a82d3d75b39bcf964f30247461294e6c5d6666b058f6e94bd0869d849c5451db
SHA512c51fbc56c4bd9f76b9c3132c30fd1427e82559fd41d8664997aaee5a342c720592a1281ba5ea10020f5dc46e464fa9c0f4eb8abe80da0118eda6c21c3533bd94
-
Filesize
6KB
MD5e67c0a1cda92baffe990ffc9326fd987
SHA169139d431375e7f5be66db97321ca48e3d4dfe4b
SHA256569f115e5fc633b27c33a6fa45ea67dc3c35cb15812dfb5d4e8789942adff617
SHA51203a54a1e1073370e38a65572b7c0eb18cd0d673276bf1367b878e13e785657934f40f831594d48881d646f09e3052473136971e2c8fb6a394622263ee591049b
-
Filesize
253KB
MD59a4ecc859241a1e6399da7c2cd11ea4d
SHA1f4dcffaff178ee619642569c1184d08fe68586ab
SHA2569e0a11c98e39590f0d58cb89c194bd2ddd2dc8a76367b28f528c37e1f7f3c1e1
SHA512ba9fff294e0351492f72a8d8f8f895ea67bfdf18aff3b60962ee7598b6b1dc2f125546ee0b2d7403880c9358e81f72706939ba9e29a17d22c48049fa77c7b941
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd