Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
44s -
max time network
51s -
platform
windows11-21h2_x64 -
resource
win11-20240419-en -
resource tags
arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system -
submitted
29/04/2024, 17:06
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
win11-20240419-en
General
-
Target
http://google.com
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs
flow ioc 6 discord.com 10 discord.com 15 discord.com -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SystemTemp chrome.exe -
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133588840430877159" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 3696 chrome.exe 3696 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs
pid Process 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe Token: SeShutdownPrivilege 3696 chrome.exe Token: SeCreatePagefilePrivilege 3696 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe -
Suspicious use of SendNotifyMessage 12 IoCs
pid Process 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe 3696 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3696 wrote to memory of 3564 3696 chrome.exe 80 PID 3696 wrote to memory of 3564 3696 chrome.exe 80 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 1632 3696 chrome.exe 81 PID 3696 wrote to memory of 3672 3696 chrome.exe 82 PID 3696 wrote to memory of 3672 3696 chrome.exe 82 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83 PID 3696 wrote to memory of 1152 3696 chrome.exe 83
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3696 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8f5bcc40,0x7ffa8f5bcc4c,0x7ffa8f5bcc582⤵PID:3564
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1812,i,7527766911731672204,17547613161312359019,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1808 /prefetch:22⤵PID:1632
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2052,i,7527766911731672204,17547613161312359019,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2136 /prefetch:32⤵PID:3672
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2168,i,7527766911731672204,17547613161312359019,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2264 /prefetch:82⤵PID:1152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3016,i,7527766911731672204,17547613161312359019,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3032 /prefetch:12⤵PID:1936
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3020,i,7527766911731672204,17547613161312359019,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3268 /prefetch:12⤵PID:4752
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4112,i,7527766911731672204,17547613161312359019,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4560 /prefetch:82⤵PID:2296
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=4264,i,7527766911731672204,17547613161312359019,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4584 /prefetch:12⤵PID:3864
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3764,i,7527766911731672204,17547613161312359019,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4832 /prefetch:12⤵PID:1904
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=4632,i,7527766911731672204,17547613161312359019,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3008 /prefetch:12⤵PID:3444
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --field-trial-handle=5008,i,7527766911731672204,17547613161312359019,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3396 /prefetch:12⤵PID:3784
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --field-trial-handle=3672,i,7527766911731672204,17547613161312359019,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4644 /prefetch:12⤵PID:3292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --field-trial-handle=4356,i,7527766911731672204,17547613161312359019,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3680 /prefetch:12⤵PID:3484
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:4060
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:5088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD599f62d83262f5ca6654cd8e76af3e4be
SHA1a6a812df1b9fb8aac53db9afad31223931897676
SHA256aba57d0d6f880af306ba1aec975dcb8b5d6af6ec02548db18ff5eeab3dd7bd96
SHA5122c806c301a9f84a1f14c7219cb8bff9490e2a9297b778135528c9078d571eaadabbda0c6bc751b62ca3ce074d9c5f160d295bba20cd93afa721ea71074d08c43
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
9KB
MD54758ebb16544b299ddc41becbd436fed
SHA111dc633b7f4ce7b0006a959c05b9a2b9658df19b
SHA25621dcc7ae4dfd3846f5f0ef8c256f41860ed1dab257b17c9452e5bc6b29f672c8
SHA512e7ed80798025280a6a77729237189f4915bd6f3ddcb4373a844c55a8a8295531c067426a6c6419984f99aca8f66d0844c6192bcf679b1e5ac3cf7bceaab13beb
-
Filesize
9KB
MD522dbafe336a2447181940965943034f1
SHA108c30714cbede9ea2279c34235df0586c63db22a
SHA256ede8d2dfba9f245dc0a72d7a56565c7d8ce0330688b066f510262440c36f5b0c
SHA512f08122878bd26e0eff4463dc113dba7e96b40f1df8a9f6bc20129ad411f7a42fe7405417ea3162956ecb3e7459c619b666caac217187d3679f3b269b430f1136
-
Filesize
9KB
MD50270b1ab4e08ad2a12bca79a7e0fdd19
SHA150739ec43e9c90c6f85e25081cc05dbaf184d710
SHA25605c0fa7a357432cd2fc75a841b57b56dd11e8297eed70606d3f08e68677630f3
SHA512eb6b9aa0e8f49736015b4442b06766be7c8a0be0f222d9c6fa90dbd17fa382b634420a25e6088dfbc4a14927b1145eb64c17bb7d3c33b696b2524adaf64f8dfe
-
Filesize
77KB
MD5f763b91d81ae4b7c1c0e023aa0f32595
SHA11798b599c93cdb8ae51ed80717b178ec1c3ea554
SHA256d7921a68acf355056a0b482484abf7fd8f8336ff1ddad0671b632e7a2be8f274
SHA5127be967ba52669844943c5862d78dbc02df0463581f7e56eb9aca4c6b7eec4711e385048ffa37e81f781b16c8e76292867bd4b18278a9824a92d7a6c23ffa2b70
-
Filesize
77KB
MD5781af62f03c8a546bc3b7a3c4ce042f5
SHA1a00293f55c8e85f93ab063ffb9abe3c66c49e277
SHA256e26be5dabdeb88934bee39b1e8bcb609f37c7c52f73faa6beffc76877ed5c85a
SHA512428c5cfd1d1c611df3a5650ec40e203d1602b9fa0b206ae8f31c1a285163c35ce99c5b5d78a4e201fe248d7b390d0fdad897be6c1ebaee2dca28a2a8811c3129