Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
1799s -
max time network
1693s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
22/04/2024, 19:43
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://Google.com
Resource
win10-20240404-en
General
-
Target
http://Google.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133582899862438694" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 540 chrome.exe 540 chrome.exe 4332 chrome.exe 4332 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 540 chrome.exe 540 chrome.exe 540 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe Token: SeShutdownPrivilege 540 chrome.exe Token: SeCreatePagefilePrivilege 540 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe 540 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 540 wrote to memory of 2452 540 chrome.exe 73 PID 540 wrote to memory of 2452 540 chrome.exe 73 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 1176 540 chrome.exe 75 PID 540 wrote to memory of 3004 540 chrome.exe 76 PID 540 wrote to memory of 3004 540 chrome.exe 76 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77 PID 540 wrote to memory of 4832 540 chrome.exe 77
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://Google.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:540 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffcca029758,0x7ffcca029768,0x7ffcca0297782⤵PID:2452
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1588 --field-trial-handle=1852,i,13102740832502504893,3943159923281358902,131072 /prefetch:22⤵PID:1176
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1780 --field-trial-handle=1852,i,13102740832502504893,3943159923281358902,131072 /prefetch:82⤵PID:3004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2028 --field-trial-handle=1852,i,13102740832502504893,3943159923281358902,131072 /prefetch:82⤵PID:4832
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2568 --field-trial-handle=1852,i,13102740832502504893,3943159923281358902,131072 /prefetch:12⤵PID:2396
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2584 --field-trial-handle=1852,i,13102740832502504893,3943159923281358902,131072 /prefetch:12⤵PID:4208
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4380 --field-trial-handle=1852,i,13102740832502504893,3943159923281358902,131072 /prefetch:12⤵PID:4760
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1852,i,13102740832502504893,3943159923281358902,131072 /prefetch:82⤵PID:4776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3044 --field-trial-handle=1852,i,13102740832502504893,3943159923281358902,131072 /prefetch:82⤵PID:3768
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.15063.0 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3748 --field-trial-handle=1852,i,13102740832502504893,3943159923281358902,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4332
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3204
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336B
MD5195f4d580f5cf96e80f577624c210902
SHA1d330c48462458d4f84638d6486a010bf677dd859
SHA25629903afeaadc54219c87280ac2a328a4ae8bfc1f73c4e3ce42218106729970dc
SHA5128fa1af1ef6ff194468acf69ea41e91fc4a3171db183cb7c5b928fdcb72f2dd9d72e78bd5411a66f4eb7dc2d401a59be2922baa3dad6b197c4a2608b79ca0c506
-
Filesize
2KB
MD5adbeb9f218235a803f14c86b49204a22
SHA1f9e174046ad0a1229d34a1d9ee4b98798a64fd14
SHA256fbe536e93c24dfd493469ed34b392b93b208b95bbf980858a919c8ea8373db87
SHA512327d9e19d5aba777723620cd60b82b185afa1c9fdf6d978f0666f89fbc30fd0e26e0b470537fc6c13b38fe00e371e287e7c59683138b603354be23b3bb0c8aa4
-
Filesize
2KB
MD528a3da93c88a425ee451c502ad89366f
SHA13b5870c21c87132872bd26f86ee9d42ffbfe02aa
SHA2566c6ea19c9a28827acbb9e563d88762e248276ced917541169e36e7d05c078525
SHA5128c0b508e69521b9a7d52de9b5d0e7fbba69314217846a536f101f16a0493adda53402d44a765077d2e76b759743a168e51b143dafd92ada961b43a32f3952fe3
-
Filesize
2KB
MD54dfe759ea4e9c9fe5191c99ee89f3456
SHA1b0f4d8bf97405ab41755230372ebb16b909a60c0
SHA25629588d1c2bbe8df577364457f3c156033e8354cb4824b6294fdd7a3147380d80
SHA5126995256baba8a0c9f7df434a5069a34dcc78637bb8be2a909d6b6ea5bb9ff08a8002733ea480d106d3265c0f53c93ef5f6ebdf467897d1e8daf4ec87c720b2c9
-
Filesize
539B
MD50f31b2900d4e138b1e0e117cbcbd8e1e
SHA193c1a34a41ab51fc022c8f35b3acb32586e94f6f
SHA256e0deadd4cae0dcb5cc48bd8b5a9e087351703fe4adba415dd15868840698e6f6
SHA512851d0ea78f822cbd7740e76fae85ed4e1809b18aaa746e32cf0d6b45e74ca18c4a2555b3264771bb54e24dc9033cde7820dff8b36ba97cfd25ee73927a5e6ddc
-
Filesize
6KB
MD5d2063e55411e2e1239cd947958dd55d1
SHA1ee1fa1ed3c58aab2b63afd8c7f27a3a406f41199
SHA256391dc7a4048caf4e97ce27593850f41ae0d751d9a9e124aeb70766aa40ed6fb6
SHA512e9e0caa3f7cc80c2967e9f44402651f92b31322a31a6ef0c04127d5121d7742616e28afe9163491845f1cf311b107baaa21d371203fce52addbb519e5f4dae91
-
Filesize
6KB
MD5502ebb5b888f0b2d035b431e0d8b2335
SHA14e0e16e3ecb835dd24f5123ec215a714772733e7
SHA256dad9c887b179f911f65c3c193e974af468a82610a0ebf6e23ec3dc3b41713dd6
SHA512459919d682fe3e933bfdffc416688e8f66d7e434d0e935773dc747954bfea8e77deac9ba03ff19f4c5e2f472e93f22841293934f7d2630fcdfa2983ac8cca6db
-
Filesize
6KB
MD5ad92e65b0004710aad90947361301486
SHA169201f3f2b3431216ff1a9df81884a4e982e0bd3
SHA25661211e7ad6c1781e16f393ea0d645b9f3f322883cde2192c093c9f0d0b5df4da
SHA512e41f2aa8642a8762e1ec8cb6a0adfb41bc99ef94ba58848702fd38c0a11fb605a13ed78fc7a955b7088c434f3002960c376d682ac07042a3fcbb836a13d097b9
-
Filesize
136KB
MD5aa613bfe5683d2c4d963a0bb2a142c5c
SHA19dff56da22f279be81a6d5b954f8e203dd97133a
SHA25681b1ebb926410588a5a8bc6301e27891dc11f90c5073724f92bf87a64c70d797
SHA5122cde983e78dc80fb230dc5f76b734c45d9bb9e4efe34a66bfbe08555bf232bc622845979786aeabb9750202d0d1675dc789fdcffd57e47dc20b5bcf0241ac094
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd