Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
138s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
25/04/2024, 12:52
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://nvoptimize.com
Resource
win7-20240215-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
http://nvoptimize.com
Resource
win10v2004-20240226-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral3
Sample
http://nvoptimize.com
Resource
win11-20240412-en
windows11-21h2-x64
8 signatures
150 seconds
General
-
Target
http://nvoptimize.com
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133585231548415641" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2952 chrome.exe 2952 chrome.exe 3144 chrome.exe 3144 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2952 chrome.exe 2952 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe Token: SeShutdownPrivilege 2952 chrome.exe Token: SeCreatePagefilePrivilege 2952 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe 2952 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2952 wrote to memory of 684 2952 chrome.exe 79 PID 2952 wrote to memory of 684 2952 chrome.exe 79 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 4808 2952 chrome.exe 81 PID 2952 wrote to memory of 5064 2952 chrome.exe 82 PID 2952 wrote to memory of 5064 2952 chrome.exe 82 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83 PID 2952 wrote to memory of 2948 2952 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://nvoptimize.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2952 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe0272ab58,0x7ffe0272ab68,0x7ffe0272ab782⤵PID:684
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1488 --field-trial-handle=1788,i,11982279490660420669,9743074909811263733,131072 /prefetch:22⤵PID:4808
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2024 --field-trial-handle=1788,i,11982279490660420669,9743074909811263733,131072 /prefetch:82⤵PID:5064
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2112 --field-trial-handle=1788,i,11982279490660420669,9743074909811263733,131072 /prefetch:82⤵PID:2948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2944 --field-trial-handle=1788,i,11982279490660420669,9743074909811263733,131072 /prefetch:12⤵PID:4908
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3196 --field-trial-handle=1788,i,11982279490660420669,9743074909811263733,131072 /prefetch:12⤵PID:4816
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4268 --field-trial-handle=1788,i,11982279490660420669,9743074909811263733,131072 /prefetch:82⤵PID:1220
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4420 --field-trial-handle=1788,i,11982279490660420669,9743074909811263733,131072 /prefetch:82⤵PID:3140
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2412 --field-trial-handle=1788,i,11982279490660420669,9743074909811263733,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3144
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:3720
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\ba2d0f0e-fa2a-4f37-abf6-db4dbb4b1273.tmp
Filesize7KB
MD50f7a8a76711c2a074235943854bce3e7
SHA193866877e86d8396f4b54617f01b4049f6990bb0
SHA256c24bfca62acab9530b4e459bbb877788c7a839ddf14cba47c8ee6fcc62e8acc4
SHA51280d954bbb95354c739ea1a3922c201f79c2647b88b65810d3e198705e92e73a0b96a6a802b02340efbe5e0b8b3eb74e64af663b6267a50f10fe706569435bedf
-
Filesize
127KB
MD5ff8f645e982fb1ed134ae71f59fb103f
SHA1ff2baa7df73ca3a38b4d1c6b16b17426918ccdb4
SHA256f0dea8b1013ce49da0d46d28e2103143ed9768c26290c6779f305b81262c6199
SHA51218dc6b8dba7740bf864269d37b224f5bbbcfa525579636e52d96038b348b5b72c21da861900babbbf9f3c8979fa5e4a3a0231a8e8986688b760e4b6d67c7b957