Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
201s -
max time network
202s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
11/04/2024, 14:18
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://omelin.s3.amazonaws.com/control_anspouse.html?login=dGVzdEBleGFtcGxlLmNvbQ==
Resource
win11-20240221-en
General
-
Target
https://omelin.s3.amazonaws.com/control_anspouse.html?login=dGVzdEBleGFtcGxlLmNvbQ==
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133573189398800258" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2620 chrome.exe 2620 chrome.exe 4136 chrome.exe 4136 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs
pid Process 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe Token: SeShutdownPrivilege 2620 chrome.exe Token: SeCreatePagefilePrivilege 2620 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe 2620 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2620 wrote to memory of 3272 2620 chrome.exe 79 PID 2620 wrote to memory of 3272 2620 chrome.exe 79 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3364 2620 chrome.exe 81 PID 2620 wrote to memory of 3960 2620 chrome.exe 82 PID 2620 wrote to memory of 3960 2620 chrome.exe 82 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83 PID 2620 wrote to memory of 492 2620 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://omelin.s3.amazonaws.com/control_anspouse.html?login=dGVzdEBleGFtcGxlLmNvbQ==1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2620 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffce3dc9758,0x7ffce3dc9768,0x7ffce3dc97782⤵PID:3272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1228 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:22⤵PID:3364
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2100 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:82⤵PID:3960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2172 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:82⤵PID:492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2956 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:12⤵PID:2544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:12⤵PID:2540
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4660 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:12⤵PID:3040
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=5100 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:12⤵PID:1788
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5328 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:82⤵PID:2940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5408 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:82⤵PID:2884
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2964 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:12⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3936 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:12⤵PID:2148
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --mojo-platform-channel-handle=1596 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:12⤵PID:920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3024 --field-trial-handle=1800,i,7295376968245458822,14911115674391027463,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4136
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:2344
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\16621b4d-5e5f-4ad3-95b5-23709c9ec96d.tmp
Filesize7KB
MD5280927b37527528908fe3bd1716d7a56
SHA16b145a1fadfde758bc499cbbc6d59d03e120c5f8
SHA25670779a254888465b8e5aa9616d6ec5f8726e8078ecd5958c7bb3315516aec161
SHA512bc3e483ffa74f40c82f621331c91e1f6049aea2654357749345a2b96841b7d39228751df3343e6c1f4cc26b9552bf0d6bed3a47e0a56aeac1655283f1808ba0f
-
Filesize
168B
MD5e3d8e3b2878a9d3b2c76f973efb3de11
SHA17b39589b7fde02c1a150568087855793a05cf899
SHA2567a71798ef4fe73f451b3a475c9762567b51f71abfa14bbc96582d0534eaadc23
SHA512fa8690e12e954ab3aad3df6551465fc76801860ee45260b52feec7e322d96d0556958f93cabb73ab037c478789989bf844379323110cebc6fc32d0ba523e77e4
-
Filesize
312B
MD58ce018c1413f9d8fe6b72b96f6894790
SHA11f5bc56dd2653a2c3d09c3f53cc8d4114fc3a9fe
SHA256dc72d1f06061c20c8005488b9f73dcda76b8cac417595470c9b50105336924d8
SHA5120c945d56a8058842bc1a8eaebdd841a6e098f30e34e2696ce7f44e933f1fe48ef0b80104877435bb628938ca1d781d369c00deaec736db525289be01506ff257
-
Filesize
3KB
MD550b8b2d1e77dd5a7c9b60875d23353cb
SHA100ac54028d6341c96d2027bf5ab7f84a02fa931c
SHA256c2cdfcf3667ff30178b621a5dec8450a2fcc5218afd6d7d97695696f17f602e0
SHA51215773e34f0903bca343c9fdf1ae4e32fabeb32f3127e88652ba52a7757b0bcf01cc2f5a67c59fa5c57c51d6fedec3d205e65a3d4f6bb4fd1d57f2a6e2f7720f6
-
Filesize
2KB
MD5bf636d07cf353b674bc52e0367a92866
SHA1e61a2b53d3a8226120271bbda9888d07a94f7bf2
SHA2562bd2b66f9977c9585a9de5b521ebb76606dc18fe8ffd91e38906ba9835b9d283
SHA512724405ccd4a56890fa4a1bc1142557b01033d8735f36da15aeaf38c5fb6117958d986aebb3a025bd8ca7321138c0b53fc570634e1f7d23836ddb1aa543b50565
-
Filesize
537B
MD5579cd1e9fe0c25bac35f49dd10d74357
SHA1d55d1d023303e0748f4cd37ed9d375093b7f551d
SHA256baea56d7d286d6100d606008a61e240bb2bb2b1aa7c2122a90847885bf395803
SHA512512247f16b71472f386b8728bd1c925de0ce02b56b31800c1a5a7390b02ecfde0dcb404975896d7fee1483c23b6eb16295ef572611df2ed431c7e39dee5f3e58
-
Filesize
130KB
MD5a89c4da3503befbb37b4caa151b10016
SHA11fd502ab620464e8b91723b82c2cac424fb3832c
SHA256b884e119a7563e351f342a3b1853310dc8b87a61f47589f6a40c8124ddc39c79
SHA5121c7010a5046b6e0256ed576ae748ce725d99cb5da46096290a9801ad1b251d494dded51e9eac1628ae33a301b950649642272afa217d77e0a97ca33a123e6b4e
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd