Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
08/04/2024, 20:29
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://wix-l.in/k-YC0g4BaB
Resource
win10v2004-20240226-en
General
-
Target
https://wix-l.in/k-YC0g4BaB
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133570818058079770" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2644 chrome.exe 2644 chrome.exe 1856 chrome.exe 1856 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe Token: SeShutdownPrivilege 2644 chrome.exe Token: SeCreatePagefilePrivilege 2644 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe 2644 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2644 wrote to memory of 4388 2644 chrome.exe 85 PID 2644 wrote to memory of 4388 2644 chrome.exe 85 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 1896 2644 chrome.exe 89 PID 2644 wrote to memory of 3972 2644 chrome.exe 90 PID 2644 wrote to memory of 3972 2644 chrome.exe 90 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91 PID 2644 wrote to memory of 452 2644 chrome.exe 91
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wix-l.in/k-YC0g4BaB1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2644 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffefe469758,0x7ffefe469768,0x7ffefe4697782⤵PID:4388
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1764 --field-trial-handle=1896,i,16156058749159315838,13919604727663452777,131072 /prefetch:22⤵PID:1896
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2032 --field-trial-handle=1896,i,16156058749159315838,13919604727663452777,131072 /prefetch:82⤵PID:3972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2208 --field-trial-handle=1896,i,16156058749159315838,13919604727663452777,131072 /prefetch:82⤵PID:452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1896,i,16156058749159315838,13919604727663452777,131072 /prefetch:12⤵PID:2072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2928 --field-trial-handle=1896,i,16156058749159315838,13919604727663452777,131072 /prefetch:12⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4416 --field-trial-handle=1896,i,16156058749159315838,13919604727663452777,131072 /prefetch:12⤵PID:4488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=4744 --field-trial-handle=1896,i,16156058749159315838,13919604727663452777,131072 /prefetch:12⤵PID:3536
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3308 --field-trial-handle=1896,i,16156058749159315838,13919604727663452777,131072 /prefetch:12⤵PID:1772
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5424 --field-trial-handle=1896,i,16156058749159315838,13919604727663452777,131072 /prefetch:82⤵PID:3956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 --field-trial-handle=1896,i,16156058749159315838,13919604727663452777,131072 /prefetch:82⤵PID:3264
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2980 --field-trial-handle=1896,i,16156058749159315838,13919604727663452777,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1856
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96B
MD593244d78d7288290dca8ae496195ad50
SHA1a6f3b4eccb1c801014e922bbd7436399254667f5
SHA2565c52cc746fdc0a63dcf62ce7661a04183474dd9f2aa26db696eda85675462f2d
SHA5126ef2143dc1385814d8058b5a72700513ddb97865a3124f62525d7831b2bf227cd99c3a808b096754d52cb7595de21576c0ad37fb4f697cca2a4ab61871bab609
-
Filesize
4KB
MD51b994bdd788ef8721c91fc46d20fd8e5
SHA10f0e94c56d1215e6d84597188d0bf285e040386c
SHA256bc0acccd89947ed0fed77544f7bd2fd66dc48b1d4821b5483c45134af3a3cb95
SHA51275c9d3041c0a667336122f88030613fc46fee441c388d92ad035f1192a63e5eb27ec0877cfd82520613e82dea103d3bf53113ece9aba29f69c258c22e0473911
-
Filesize
1KB
MD50b9d5d8cd3b44fff2199595b7e19b339
SHA1ee515c974c5d378288bd4fd6d1705901d3b6bae9
SHA25608b3adc11a2f31aa1e7e9d44c2dd099578e85a5b5069b3ab71b4831d1d76b44b
SHA512fde0570a66127f3d94fad8ecc2a754a5ed412e2ae3b8cc77f47af271ec35df32997f9ba9bfa68be1697073638d9bf931be80e6027057adbd8c4b3b983508743c
-
Filesize
2KB
MD55f421859e61f847df364d244816b9da3
SHA1dc05a78ed212873b4b2c66cd5beec4401628a494
SHA25651da2e656985d2603d0dce5efc6d9146bc097e3251cb1c7a2b02b0caa9e6632b
SHA512577801780080ccc2ea651d02e227313daf493ad2a2f9400412c29052e2003c2aca8f52890dbd9c3c04d7b253e65778b327d60b214a2d3b254294181b84816fbf
-
Filesize
6KB
MD5fe21b3144e1186db0ec235b3bf843d62
SHA15cec967d7831a354da62da82c47e2b105ca25abb
SHA25695d741b4164eab2ed0278e5a4499d6baac911a2bb3fc7cb993a658fae1e84583
SHA512296681d9528867de244493f0e7289501260f23dfe338b6247b447cca5df2790bb421b8201b6f5b2b031c40ba867e57e7c59d9666be0a1f468ef64059a533d93d
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize72B
MD5c5743128611e7813e72da26808d6a7d5
SHA12e4182c04ceb7dcd4b4564e9ce9b29001a61e207
SHA256d81d0a6325ca334b26392ccd08ae50d25836b60d784f0d0a253af0a887fd4589
SHA512048dc82e2fde5e4180c616d4033b0e777f5dabe27faaa0e6c393371344c2e82533a37d80a951fe1b2bf84c128379b965528a9450d4af31078367ec08b74042d6
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c2d3.TMP
Filesize48B
MD53b57bd8353cf58fc7a4d26defbb4f7a5
SHA13ff851b49e231c48f32d6d92710b6b534670c353
SHA256e6cdf1d38cea61e2da087b30a8cab4854b3e10f1475e0ad8b3892920415e7b7b
SHA5129e53421c54f740ea23cf97a858ada2e6e2a0c2686867c9d5c3099c6761868d8b17efb64c498667e27aaf8ee6ea7de8679514e5756a3e6b84af44ace13ca64811
-
Filesize
128KB
MD53f65fb033e3ea9421b61a0e3c0114ec4
SHA19653ac7ff11d7d425534ead27af7f319ec475f43
SHA2564a208a6f08b68322e66f2b15431a45e40f2c464eab29798b4ed3dbf00829f10d
SHA5120d2a1ce4f55b9aa4c68a8b178d1f42eb99249d72e03869d908d6f3cdb24b1bb4ca2867de30453a10b32d6e23e573188447ae9eb117e2160f1b3a9e5ef8bd2488
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd