Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
22s -
max time network
24s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15/04/2024, 15:09
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://steamreview.org/BlenderSourceTools/
Resource
win10v2004-20240412-en
General
-
Target
https://steamreview.org/BlenderSourceTools/
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133576673933348399" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe -
Suspicious use of AdjustPrivilegeToken 42 IoCs
description pid Process Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe Token: SeShutdownPrivilege 2348 chrome.exe Token: SeCreatePagefilePrivilege 2348 chrome.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe 2348 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2720 2348 chrome.exe 86 PID 2348 wrote to memory of 2720 2348 chrome.exe 86 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1144 2348 chrome.exe 87 PID 2348 wrote to memory of 1272 2348 chrome.exe 89 PID 2348 wrote to memory of 1272 2348 chrome.exe 89 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90 PID 2348 wrote to memory of 4072 2348 chrome.exe 90
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://steamreview.org/BlenderSourceTools/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeda0eab58,0x7ffeda0eab68,0x7ffeda0eab782⤵PID:2720
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1864,i,6338912860855967410,7165171637841614110,131072 /prefetch:22⤵PID:1144
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2124 --field-trial-handle=1864,i,6338912860855967410,7165171637841614110,131072 /prefetch:82⤵PID:1272
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2192 --field-trial-handle=1864,i,6338912860855967410,7165171637841614110,131072 /prefetch:82⤵PID:4072
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3004 --field-trial-handle=1864,i,6338912860855967410,7165171637841614110,131072 /prefetch:12⤵PID:1048
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3012 --field-trial-handle=1864,i,6338912860855967410,7165171637841614110,131072 /prefetch:12⤵PID:3168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4248 --field-trial-handle=1864,i,6338912860855967410,7165171637841614110,131072 /prefetch:12⤵PID:2156
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3208 --field-trial-handle=1864,i,6338912860855967410,7165171637841614110,131072 /prefetch:82⤵PID:3332
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4524 --field-trial-handle=1864,i,6338912860855967410,7165171637841614110,131072 /prefetch:82⤵PID:3588
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4632 --field-trial-handle=1864,i,6338912860855967410,7165171637841614110,131072 /prefetch:12⤵PID:4596
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4860 --field-trial-handle=1864,i,6338912860855967410,7165171637841614110,131072 /prefetch:12⤵PID:1652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3168 --field-trial-handle=1864,i,6338912860855967410,7165171637841614110,131072 /prefetch:82⤵PID:1776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4940 --field-trial-handle=1864,i,6338912860855967410,7165171637841614110,131072 /prefetch:82⤵PID:4608
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:884
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4160
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5a11dd5746728d04a9e6e9a3c571ef683
SHA1d3c478d538bb5ceea09af3bd0346dd26312c3944
SHA256da1f4ed87b3749d326073b9041f1585365b3dae1c7707d27ee0093faa319e8ce
SHA512fa73c55cdbf458c833ebdd39fb86810126ea2e78111234523407eb5d7f43757467de6b2d8d008a770f1213651fb8ce5876f521baaac5d9a4ef00517a121a0135
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
7KB
MD5503d49a273966d4152234c8878a9d308
SHA12fe01c5f638cf63425a6e1141e9ade0952be92f3
SHA25656993faf895f23f24e5ab628ec661b41621702bce234aaccc8ff6dbcba669db6
SHA512f3a32fed94f6b8ebbf9fe2113777edc8d6469d760cad7d0fa686db80f0291d3898c6e0872c5216363d4e3d2b8b08359694a630837594104880333949866b03d5
-
Filesize
7KB
MD59736012a11fdebc765b85189f2cb91d0
SHA100e04904f9d78096a51a198636f1d69bb873961c
SHA2565ccd3b03897ad7f0cfef755adbfa7d2f5e56e5a5740845c2d069efa8204343c5
SHA512e37267df0c4663df029e1dbe5e3f08e77e1e9c4782d6b4efe29531d2ea437b349cdcaa24285ac570b7311b8ded4fd9cf3c746d1c295b68a9e36598259a765537
-
Filesize
250KB
MD544632172eb65d01ed114a6fb63a7a211
SHA1af24031332587f2fe217ec852c1de5934887190d
SHA256bab1b57cf12010be453517ef85d30d3dee992d1344b79ee08723d91dec434b0e
SHA5122133376e97f0856839c80005d4eff874695606f9756b28ca5dbd719869a3182252f1b2838262abf8c1eef835d69541a3b0bef509be00ae092ce690dec15babc6
-
Filesize
250KB
MD51677340779eecbed30177e5139500ef8
SHA126c3d2092d8b6434055d8fb75fbf2f2be51edb82
SHA2562a2ff5316bd91f4b8830e2c911e5429c18501f5a98eb84716718c5b369df0f0b
SHA51229c89014b7b3ccc1e64626a43195c4865f102b2576959e863f48b034859916480ac2e65d0b2ced6a78b9296f3e9a95f889d4bd6791ce3238b598d52abc0c7a78
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
-
Filesize
79KB
MD5ca38a3fc0a4cd0470570fc83b3203050
SHA19f511f4925ff337d0b91885bd31405476465f990
SHA2566fae40268239c8969b7ffcb86acef171f306d802ab029ebf9493b8a539aa9aee
SHA5123851aa16f228904c62825b26bc0a762059606802a8e07609457186876b0e3f0fd785698f4ff1f1581a7aba1fd577b64714e1dade77e4e01ffab624b73585e565