Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1199s -
max time network
1139s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
06/04/2024, 12:35
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://209.126.87.35:8888
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
1200 seconds
General
-
Target
http://209.126.87.35:8888
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133568817027266526" chrome.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5116 chrome.exe 5116 chrome.exe 4732 chrome.exe 4732 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs
pid Process 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe Token: SeShutdownPrivilege 5116 chrome.exe Token: SeCreatePagefilePrivilege 5116 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe 5116 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5116 wrote to memory of 2192 5116 chrome.exe 71 PID 5116 wrote to memory of 2192 5116 chrome.exe 71 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 3936 5116 chrome.exe 73 PID 5116 wrote to memory of 4200 5116 chrome.exe 74 PID 5116 wrote to memory of 4200 5116 chrome.exe 74 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75 PID 5116 wrote to memory of 4204 5116 chrome.exe 75
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://209.126.87.35:88881⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5116 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffe434c9758,0x7ffe434c9768,0x7ffe434c97782⤵PID:2192
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1540 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:22⤵PID:3936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1756 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:82⤵PID:4200
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2072 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:82⤵PID:4204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2604 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:12⤵PID:2768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2776 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:12⤵PID:204
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:82⤵PID:2344
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4304 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:82⤵PID:3420
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4404 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:12⤵PID:4176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=2816 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:12⤵PID:2688
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3540 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:12⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2844 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:12⤵PID:2112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3964 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --mojo-platform-channel-handle=2872 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:12⤵PID:4076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --mojo-platform-channel-handle=4956 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:12⤵PID:3368
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --mojo-platform-channel-handle=3848 --field-trial-handle=1860,i,8714073645856530406,1203025416056965563,131072 /prefetch:12⤵PID:3216
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:1828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD5a508fe5336603a47dbdf4b47f7cdd74c
SHA1d25207fae28cde2f1d97d42a11259dbcb34e46fb
SHA2568b5db24b0fb9eb3f9eceecdb2860a08c080448d142562517b2d2ce595597c2f0
SHA5120c0df2d64d4691cf81e07a99d96edfb0132a57fee0632c31745d5fbfc1857e93b18ba19ae886cf35cfb5556256c091836d8b2baed8382f2eae1d3bbdbae22abc
-
Filesize
5KB
MD55203099407f8c3f90d666a9c00e46565
SHA1bbf33817a277baee0934cb9dd652f148aac36907
SHA256a764eae1c7e1203ac500f5dc5f0b49d5a6536b3f83f927d264d30e11e66934f7
SHA512d39671b42e72af3467a35a7aa2ab706952d9ba5dbdba3aa7dfef4a66acb21ec11ac2ca18869708d326a13daffc469602ceddede1cd36ee5e97a74fdf77954f47
-
Filesize
5KB
MD5ea520b3e0c1635421517fabf7542f720
SHA1ba13461c2bbbd2967329a10ee001f49714ed4c23
SHA256e9ea29a72b28fdb9215413b8acf5c7c8b6d2232d5de3ab54c4525bca5cc64981
SHA5129e8f4726eb0512d9186b1eb4ffcb3c0b774d7a5409493c07aae2e36998db11e7936e5ba0cada4678ee8dfbb73fecbe9bdc1c3ba4f17459b92e6e2163d961f24e
-
Filesize
136KB
MD5cafc6da9c73c343d2e98c72b7d72a2a6
SHA1f0525566b267aa3cc587bf14b2c0cf17794ad330
SHA2561599daa9b79533bae0d327ebe09ebec739e85d6ae8593887f3cb91e9025cdcdc
SHA51278dfbdfb92138918f258e6ee6addcf01def53f1c0a9f94a6bc70917db5fee7259d8aa3127259847470993557e43afed15779a81990c95e8006d5919a5d288b7a
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd