Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/04/2024, 12:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://nvoptimize.com
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
http://nvoptimize.com
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
http://nvoptimize.com
Resource
win11-20240412-en
General
-
Target
http://nvoptimize.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133585231611265531" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe 1424 chrome.exe 1424 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe Token: SeShutdownPrivilege 5064 chrome.exe Token: SeCreatePagefilePrivilege 5064 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe 5064 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 5064 wrote to memory of 4744 5064 chrome.exe 91 PID 5064 wrote to memory of 4744 5064 chrome.exe 91 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 2196 5064 chrome.exe 93 PID 5064 wrote to memory of 748 5064 chrome.exe 94 PID 5064 wrote to memory of 748 5064 chrome.exe 94 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95 PID 5064 wrote to memory of 1912 5064 chrome.exe 95
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://nvoptimize.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5064 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffcb2a39758,0x7ffcb2a39768,0x7ffcb2a397782⤵PID:4744
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1668 --field-trial-handle=1892,i,17878109685622887523,3866055419367020204,131072 /prefetch:22⤵PID:2196
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 --field-trial-handle=1892,i,17878109685622887523,3866055419367020204,131072 /prefetch:82⤵PID:748
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2240 --field-trial-handle=1892,i,17878109685622887523,3866055419367020204,131072 /prefetch:82⤵PID:1912
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2984 --field-trial-handle=1892,i,17878109685622887523,3866055419367020204,131072 /prefetch:12⤵PID:5076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3076 --field-trial-handle=1892,i,17878109685622887523,3866055419367020204,131072 /prefetch:12⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4328 --field-trial-handle=1892,i,17878109685622887523,3866055419367020204,131072 /prefetch:82⤵PID:2984
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4324 --field-trial-handle=1892,i,17878109685622887523,3866055419367020204,131072 /prefetch:82⤵PID:4792
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1820 --field-trial-handle=1892,i,17878109685622887523,3866055419367020204,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1424
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:4228
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4232 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:81⤵PID:5028
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD562d7346d7b9f50f2d31ad125e2bcc2c1
SHA13291711e2cee255f481d45abcc77a5090e9df694
SHA2564aad6e063ab6e5ef439554134da3c3c18707713c467234e26915daf92e38d87a
SHA512020b87f4a0d2f71bf554453bb7d2b36050b0ebf88170c1307e0b0713d9f180981e5085d3d23ae6f5321a487c2bae2d5e34cc3b04aca2d40463a177809dc7f2f2
-
Filesize
6KB
MD565089df98832bba2b7899840d4509a07
SHA116df73460ed7ca4549e919f5c654111c6562aaf0
SHA2561609d0d8ff6377ff842b1420764982a9cc27099806dd912047012d2c727cb2fc
SHA512f2624e25b8681dc72e938a91e22cb91a3f8ac44c50e447a38d7f94dcb348b82dcb7b86e0aae46442f4f393d92a0d6c4fea696cfe967e448dbd062559018dba89
-
Filesize
5KB
MD5dc1f427c96d3b418a1879a3295795e1f
SHA17998ddcabeeecd382d5db0729793bb0256a8a562
SHA256613038c4de1cf312dff2bc3839605d4b0538b2df36a1de0ff91ffdf7d26020fc
SHA512425265e0a8b8164c8d8652e9451eacfa6576edb8b77d93a43eebc619e0a39939fb8b83147a0ffbf599ddd70d82d5b67e9c6780c95977cedd2f7545e3f6a0f90d
-
Filesize
128KB
MD5320570cc9782136da58f7363b5932f5d
SHA1978db0a28fd417029214ce2ea06281cbb20471fb
SHA256a43f407970149d717f3c610fb27295762c280c1fb134887820613f1c0fcc8117
SHA512e2122c308a42130c2eaf5556827b168cfdeb5846d456023f0336f07ade42058b67329315914be6eeb3961e9adef2aac1dcf9e562c2efc0ac6049629e7d774302
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd