Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
32s -
max time network
33s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system -
submitted
29/04/2024, 17:43
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://HSCTAIMAGES.NET/CTAS/V2/PUBLIC/CS/IL/?PG=3B3B38F5-FFB8-4660-9240-8F7057F3438E&PID=21669165&ECID=ACSPRVTEJVKJIKD-0B9A7UHASALJAQH-GG42OYGVZRN42DHMOVXEPUWVNRCZMA35NUNPVM19IDTY&HSEID=303864315&HSIC=FALSE&DSF=2
Resource
win10v2004-20240419-en
General
-
Target
https://HSCTAIMAGES.NET/CTAS/V2/PUBLIC/CS/IL/?PG=3B3B38F5-FFB8-4660-9240-8F7057F3438E&PID=21669165&ECID=ACSPRVTEJVKJIKD-0B9A7UHASALJAQH-GG42OYGVZRN42DHMOVXEPUWVNRCZMA35NUNPVM19IDTY&HSEID=303864315&HSIC=FALSE&DSF=2
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133588862079648619" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 928 chrome.exe 928 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe Token: SeShutdownPrivilege 928 chrome.exe Token: SeCreatePagefilePrivilege 928 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe 928 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 928 wrote to memory of 1944 928 chrome.exe 83 PID 928 wrote to memory of 1944 928 chrome.exe 83 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 876 928 chrome.exe 84 PID 928 wrote to memory of 4304 928 chrome.exe 85 PID 928 wrote to memory of 4304 928 chrome.exe 85 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86 PID 928 wrote to memory of 2384 928 chrome.exe 86
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://HSCTAIMAGES.NET/CTAS/V2/PUBLIC/CS/IL/?PG=3B3B38F5-FFB8-4660-9240-8F7057F3438E&PID=21669165&ECID=ACSPRVTEJVKJIKD-0B9A7UHASALJAQH-GG42OYGVZRN42DHMOVXEPUWVNRCZMA35NUNPVM19IDTY&HSEID=303864315&HSIC=FALSE&DSF=21⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:928 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.106 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffed93ccc40,0x7ffed93ccc4c,0x7ffed93ccc582⤵PID:1944
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1904,i,11044761489699297716,1494609860529878493,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1900 /prefetch:22⤵PID:876
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2128,i,11044761489699297716,1494609860529878493,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=2192 /prefetch:32⤵PID:4304
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=1584,i,11044761489699297716,1494609860529878493,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=1728 /prefetch:82⤵PID:2384
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3108,i,11044761489699297716,1494609860529878493,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3144 /prefetch:12⤵PID:4428
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3128,i,11044761489699297716,1494609860529878493,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3204 /prefetch:12⤵PID:2796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4336,i,11044761489699297716,1494609860529878493,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4672 /prefetch:82⤵PID:3940
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3652,i,11044761489699297716,1494609860529878493,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4696 /prefetch:12⤵PID:2424
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --field-trial-handle=3320,i,11044761489699297716,1494609860529878493,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=3428 /prefetch:12⤵PID:4008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --enable-chrome-cart --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --field-trial-handle=3868,i,11044761489699297716,1494609860529878493,262144 --variations-seed-version=20240418-180204.077000 --mojo-platform-channel-handle=4776 /prefetch:12⤵PID:4268
-
-
C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe"1⤵PID:636
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc1⤵PID:2748
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
649B
MD5157d642bf06672d791a9770b896d8558
SHA16fa20fbd074f2b0ddfd55626d450b284ea890c7a
SHA256ab58e56d1a59624d5012629c897fad5e7c452c4c2e15361178ba1e21b3c41238
SHA512e9eac1814d1d77f4decbbb26c9a7924e36f925f50a5654382d0b63fb72ecab4b7b3e23f690d68e8fba42edc17f206079a5dbc99168f823032bb82ec941998d3d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
8KB
MD55d852fde3422aeed4c9dfb089e133b12
SHA1d2e774928e64e0d78b71415986a60d6e87a8eea2
SHA2564c87c2b961685c3141d8a290927df6f18bd22501d0c93f18d42894426ca9aa1a
SHA5121025fe0aa14f2567fb53f22f9e08ce4b9467dc093e7850a3488975a32a5fd06fdde7bdde1b1b5ab267458cdfa5d0222dca7f717879e782152de8fe6e617ae459
-
Filesize
9KB
MD519f1f683b0417c63fb072041486c8fed
SHA12035b546b4c82db35dda0b6513f76af8516e16cf
SHA2562029c4a64577fa5138291971e697428b9978f61a9f639bf93637c5b89b81ebdb
SHA512caa2c55710bb643875adad3005be9d5b821d35e71b24847296b6ae18fdf489429c069c34fd61ee5a96188e5e457dd7d8548dbd7d0c20b1e0adee4b01603c8579
-
Filesize
77KB
MD5bc6e99c7b9164ad59f88e7e8b12a5089
SHA154e7922f41d05b625800bf711eba2f6459749236
SHA256bb785c5b82b5c5ad86a76afd246fb4b81134d8eecdbda8a525f43e71cc0819f1
SHA512e5c2f2f68993e7bb1146cfed3d1eeafa5178873838559cdb4daf68448dfd743627796600ce0744b2e8a71171b20d17faf0e5772ad7c93fa1802f19a21addd2fc