Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
389s -
max time network
365s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/04/2024, 18:44
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://s-cs.rmp.rakuten.com
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://s-cs.rmp.rakuten.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133572482990249238" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4272 chrome.exe 4272 chrome.exe 1300 chrome.exe 1300 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe Token: SeShutdownPrivilege 4272 chrome.exe Token: SeCreatePagefilePrivilege 4272 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe 4272 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4272 wrote to memory of 4284 4272 chrome.exe 86 PID 4272 wrote to memory of 4284 4272 chrome.exe 86 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 1096 4272 chrome.exe 88 PID 4272 wrote to memory of 4948 4272 chrome.exe 89 PID 4272 wrote to memory of 4948 4272 chrome.exe 89 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90 PID 4272 wrote to memory of 2176 4272 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://s-cs.rmp.rakuten.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4272 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd796b9758,0x7ffd796b9768,0x7ffd796b97782⤵PID:4284
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1664 --field-trial-handle=1936,i,8947831377732495868,3776638421442168210,131072 /prefetch:22⤵PID:1096
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 --field-trial-handle=1936,i,8947831377732495868,3776638421442168210,131072 /prefetch:82⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1936,i,8947831377732495868,3776638421442168210,131072 /prefetch:82⤵PID:2176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2872 --field-trial-handle=1936,i,8947831377732495868,3776638421442168210,131072 /prefetch:12⤵PID:1588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2880 --field-trial-handle=1936,i,8947831377732495868,3776638421442168210,131072 /prefetch:12⤵PID:3460
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4820 --field-trial-handle=1936,i,8947831377732495868,3776638421442168210,131072 /prefetch:82⤵PID:1376
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 --field-trial-handle=1936,i,8947831377732495868,3776638421442168210,131072 /prefetch:82⤵PID:2620
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4948 --field-trial-handle=1936,i,8947831377732495868,3776638421442168210,131072 /prefetch:12⤵PID:1308
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 --field-trial-handle=1936,i,8947831377732495868,3776638421442168210,131072 /prefetch:82⤵PID:704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3428 --field-trial-handle=1936,i,8947831377732495868,3776638421442168210,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1300
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2384
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
904B
MD5918d21506272757946cdd0e0444005c2
SHA18b7a8d143a83ef6c8b278e6778daead935e56a01
SHA25697504eaf023e102b9347eab382fa5ecd7998bc3839e9f886469d75879d169907
SHA512870b173cfb590b7c82e6529dddc23d640d1d17518211ad896fabaaaf982f8e8eb6b9f77a5eb9467f3813cf1cb3d35bacf9c81906bc57f509555f797555a63bbc
-
Filesize
6KB
MD5ea8576f6c0a1995949c311a31f44b18d
SHA10f7fef5f95071454dc341bc938b1918dad5e964d
SHA2566e3a95e154b73eb640bf0bcad541cbc56a4e34544885828e44e90a777280f5b9
SHA512a4baf7997687939490b22d9a82997ed9ed1742aa9d4b76c61d3402b0f9e47a7fa1b9d8dad9d3b91330fd4229a6ec0b1752cfecee74f6e464da83524dc884b53a
-
Filesize
7KB
MD5f76b9146e27cae55e63c227c9e01b1b5
SHA1f59a164eeed3190d8529479c8e9b9b2db1b4339a
SHA2564e6f1c060dc8da8c0d45fd480588e114842c04d7b161afcba2184bfee868acec
SHA51250f3288a9bf93ffd9a0fbb4f95942e6fa19910690bd8a91b7d44624947ec6211c0010b11f62bdf25584c67ba5bc45b05c6a022afebecdd770668734df5a17baf
-
Filesize
128KB
MD56d7b0865615d16f85e15e00c366c3712
SHA14ed9630f83458fa61a208248dd96e65cc056148d
SHA256ca2648a2a449de6516ad6c176cdded277ac0c10e83cb1017e5698a6d69df4329
SHA5124367a338bf7ab4b8692f6efafc6665342e50af92a048aaeb5ee0c7d78a106b670acc04506b9ab35a36e08026a5a0797afce3ea52a0df47c96350a68e77b0ced7
-
Filesize
101KB
MD5c6b6afb3e5cac165eec32ca0796cdc58
SHA1ff101875e4bbe7bf3ff5615a53a2870693289aef
SHA256c8a75882d5b43a968b954ce18fc4e6043e4281f4659c2964fe7b3d1c418497e0
SHA512edcb0e2964503e0bb73fdc4e443bad179d13143c07b4fca0ae9c202bb5e1adf5df1bc1a42c05c925de624bf6a7fa9e07ef148c4d88f84b3284879b92bb41aa55
-
Filesize
97KB
MD5d32c3631b5157b0ee121caf5414dfe6e
SHA144412c1c9f18e2d850ee07964b18633506b49cf0
SHA256b6f2333d4f8a5b19696a442d7034d01c6ca638a5f57f779f5c1e6174400f5462
SHA51294c60c6e5b4d8092a5660b2ab9706d6c5c48f6cbafe8aca9a9efdb74850f06ee653c8ded8aca217b6e7094347cb48d74285d6d52edccb7aff2a4725c203d09a7
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd