Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
16/04/2024, 08:36
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://hps.investorweb.ky/
Resource
win11-20240412-en
windows11-21h2-x64
8 signatures
150 seconds
General
-
Target
https://hps.investorweb.ky/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133577301969097970" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4364 chrome.exe 4364 chrome.exe 72 chrome.exe 72 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 4364 chrome.exe 4364 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe Token: SeShutdownPrivilege 4364 chrome.exe Token: SeCreatePagefilePrivilege 4364 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe 4364 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4364 wrote to memory of 4684 4364 chrome.exe 80 PID 4364 wrote to memory of 4684 4364 chrome.exe 80 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 3924 4364 chrome.exe 81 PID 4364 wrote to memory of 5044 4364 chrome.exe 82 PID 4364 wrote to memory of 5044 4364 chrome.exe 82 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83 PID 4364 wrote to memory of 3484 4364 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://hps.investorweb.ky/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4364 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff94dbdab58,0x7ff94dbdab68,0x7ff94dbdab782⤵PID:4684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1536 --field-trial-handle=1820,i,7134337986347491488,7518589810571880767,131072 /prefetch:22⤵PID:3924
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 --field-trial-handle=1820,i,7134337986347491488,7518589810571880767,131072 /prefetch:82⤵PID:5044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2152 --field-trial-handle=1820,i,7134337986347491488,7518589810571880767,131072 /prefetch:82⤵PID:3484
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2896 --field-trial-handle=1820,i,7134337986347491488,7518589810571880767,131072 /prefetch:12⤵PID:4648
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2904 --field-trial-handle=1820,i,7134337986347491488,7518589810571880767,131072 /prefetch:12⤵PID:2512
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4784 --field-trial-handle=1820,i,7134337986347491488,7518589810571880767,131072 /prefetch:82⤵PID:4676
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4436 --field-trial-handle=1820,i,7134337986347491488,7518589810571880767,131072 /prefetch:82⤵PID:4804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1460 --field-trial-handle=1820,i,7134337986347491488,7518589810571880767,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:72
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:72
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168B
MD5af3e832d8dac3692915661d45c548562
SHA109b2e74f54a16b7b7271930210e14e4652e91b41
SHA256ca789b1b4d8d8a83cfc99adb6285144cdc2d2539e7584d89d708580425848c55
SHA512d28b46c8eee9660a911fa945f576188810ba1b7b0f6d850205ddd801ccf0ff6a274aa6d6aaee669c39726ac581ba30e91e77061f14ab59fc875e2123890f6ebd
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\2cbfd236-5905-4002-9bcc-a9965ea5491c.tmp
Filesize2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
1KB
MD5ad4fda932432116ff310a2fe392351df
SHA18c36f864ce57f2a5947c3c8693579082c29709b5
SHA2562214902423fcbf324033710887f4174fd1132d82110cb92def1b16abe0b6a1a5
SHA512da80c0f1b667492d32f94c1d58e325cd8b88d734a45e9b33e3aae45ecc8c7559d5e9713e3a08d25fcdb83a3da2c620033512429a2e0114de19cc1d0fbb2f34ff
-
Filesize
1KB
MD562efbc9cbbbe1162d4f73df2eb253c2b
SHA169570537edfef815c7c9eece6a5a67217634783c
SHA25618e627259b2c42537593033ad2a482b61e5c4420724e775425fb681494f34eef
SHA512e3df3c7e6db96380846abe6de89a18b427f91d2c073777b4fa36b1c1815368884c393b4152d702b2949a9e4d5b4c2d9a5669d635a08302dc64a558c23a91bce0
-
Filesize
524B
MD57d27fa36f220c768639ae1fe885ca7c8
SHA13b0d513f7b5334b2df59b0bd48bea7b01526e9dc
SHA256d98438c3c62a09ecd53c70788540ca102f33f367e4d4049df29406242434ea80
SHA5121388be886866d94b4e926680e680c4577bcfea3c16aad64c5a89ca8dba8a0012256717458fe875a3e47521a947ea8ee672ce90538dde12208ee5080644cd352a
-
Filesize
7KB
MD57355a670476fc2d1dfaf93af5a56b3ba
SHA120e2ce9253adeabe1a8e2aac928b4db81d4945a8
SHA2568b11795323f94a61ea99b42416654045c9f7e4e931fa8b5f63893700a269eaea
SHA5124f6467eadee3d45fd9957835bdfb0c8b69bd0befb471334fa68facc1c56337a3b6bc44788eb0c872f9e9ff0a32fa4b7c779cc77e4313ee2910a5e4221a73861b
-
Filesize
127KB
MD506008037dd9d10fbc79aa2c066f28dff
SHA17c9a7168a9eb9875b5c14780c6c202778b9641e4
SHA2567d20a9f85456fafea002af79bdcc43cc8484c096fd114f6b04226fee826407ec
SHA51277478fe55ab4469f3995729eab67e6a1cf41d1d771948768661a005679858cb020f5e6abc48a5a8d64ca0688ab883db0c0247bee6d81455a6cf03b57d1bdb98c