Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 03:31
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://regionalevents.okta.com/techcampphilly/TechExecs
Resource
win10v2004-20240412-en
General
-
Target
https://regionalevents.okta.com/techcampphilly/TechExecs
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133576255054437497" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4732 chrome.exe 4732 chrome.exe 5068 chrome.exe 5068 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe Token: SeShutdownPrivilege 4732 chrome.exe Token: SeCreatePagefilePrivilege 4732 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe 4732 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4732 wrote to memory of 4544 4732 chrome.exe 84 PID 4732 wrote to memory of 4544 4732 chrome.exe 84 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2864 4732 chrome.exe 86 PID 4732 wrote to memory of 2236 4732 chrome.exe 87 PID 4732 wrote to memory of 2236 4732 chrome.exe 87 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88 PID 4732 wrote to memory of 1356 4732 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://regionalevents.okta.com/techcampphilly/TechExecs1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4732 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeed73ab58,0x7ffeed73ab68,0x7ffeed73ab782⤵PID:4544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1736 --field-trial-handle=1896,i,10329175212476732400,3805683004230286142,131072 /prefetch:22⤵PID:2864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1896,i,10329175212476732400,3805683004230286142,131072 /prefetch:82⤵PID:2236
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2244 --field-trial-handle=1896,i,10329175212476732400,3805683004230286142,131072 /prefetch:82⤵PID:1356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3016 --field-trial-handle=1896,i,10329175212476732400,3805683004230286142,131072 /prefetch:12⤵PID:3668
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3024 --field-trial-handle=1896,i,10329175212476732400,3805683004230286142,131072 /prefetch:12⤵PID:1756
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4260 --field-trial-handle=1896,i,10329175212476732400,3805683004230286142,131072 /prefetch:12⤵PID:1800
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4788 --field-trial-handle=1896,i,10329175212476732400,3805683004230286142,131072 /prefetch:82⤵PID:3904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4472 --field-trial-handle=1896,i,10329175212476732400,3805683004230286142,131072 /prefetch:82⤵PID:2604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4508 --field-trial-handle=1896,i,10329175212476732400,3805683004230286142,131072 /prefetch:12⤵PID:1592
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=2920 --field-trial-handle=1896,i,10329175212476732400,3805683004230286142,131072 /prefetch:12⤵PID:396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1896,i,10329175212476732400,3805683004230286142,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:5068
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:5056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
912B
MD5411ce43a862c44f4d9b1f0a95ebdc821
SHA1bb494f3508e78dd0fea85c1b9425e082f37f724e
SHA2568904fe5352346b6e88273c266399ead92e9a1a5da3ebabc8ec211755da07ba83
SHA512e25b2fddbbca262b743e7f13c0ed01ee2b3ff885091f106729d6e3f1fd48dbfef7713dd20f825d98198e25017070d8433ba5dcab1cdbf7cb52f655f779a2d134
-
Filesize
4KB
MD54b1dc2d65314b101680347a1430037af
SHA1f598aff14356b6db2e762792c48bbd7b5f83ce0c
SHA256ae722126be7096f1e4f5cec9874e56ae0ae40590793c0ae6be7e9820b9544e25
SHA5125f0b646ecf85c775f2804b5923700c4713ad088b2fe65eae3fc66af20bda62042e279aa34daecbeb8b6ede42cd971fdfaf38da9d855379edab66e067f182b090
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
690B
MD582dbd912eb6c936a7657c4545386a04c
SHA1d2f462e890f8d97661dbfe42b0035ad48fbd6299
SHA2569147a75e17aab12247784273733cbc2bafc9e0fce7ec8f160f6a810c79f00354
SHA5127e9ff24c063ab2e22dbb88743c692b0be9c47925dc77b46be72a94c9739f042c3746f3dc048f79a6c454ecd1b94f8da44e53907de4f381ef407cf69e93c3264c
-
Filesize
2KB
MD5c9c8fa2f8a12bd2879bb00a3119b609f
SHA10c460a25ca0544e1f60d6361cb3a8ab1799c0a67
SHA256166a6b5bb15d381d2699dbc47b914937285b263b1dfb9906eb1e7ef3cd8cd27b
SHA512ff86bb9088832c989330aaf4364784453d09c5d8907e9dbca6b47f0ee38c4fbb149e12f970a01c8ec08a876c0b619002b3fe678ec507343c5c8dab2905e0b56e
-
Filesize
7KB
MD5deda320bdbb1f51ee83e27e9bb3d859f
SHA1f3b921e168a1c77533dea0ce68d8b929fdf62266
SHA256e3dadf40bea71415c045e7ceee5e7821900fdf13068f9582a8233e697338d916
SHA5121d81dc652ab96ab5c6b958ed5984bad1fbb024cbff7ee7e4a261c217908e00ad81123956b91716904dd0a56942d0c6dab47e653788e8741de71ad5dbe002fc22
-
Filesize
250KB
MD5577cc176a625e828e25ac6888a8b77f2
SHA13aea8b44203ffa5890b48ccd78593e687c6210bc
SHA256e83ac5d3f425fd35482f3be3fab7f539bb15637efc3773a17080e89928dc1aae
SHA512ea2b76e25d0bbd5fce58dad2478882785dbf357bbba57966388a230a8ea86094ad0704d7fea2b0596a4e53ca3e6567a6b1cc38ea373d939f9ce9df1844e1f82d