Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
105s -
max time network
108s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
09/05/2024, 20:57
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://WWW.COMMONSENSE.EVENTS/EVENTS/NL24-PLANNED-AI-DISRUPTION
Resource
win10v2004-20240508-en
General
-
Target
https://WWW.COMMONSENSE.EVENTS/EVENTS/NL24-PLANNED-AI-DISRUPTION
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133597619001751958" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2112 chrome.exe 2112 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 2112 chrome.exe 2112 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe Token: SeShutdownPrivilege 2112 chrome.exe Token: SeCreatePagefilePrivilege 2112 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe 2112 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2112 wrote to memory of 1076 2112 chrome.exe 90 PID 2112 wrote to memory of 1076 2112 chrome.exe 90 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 4872 2112 chrome.exe 94 PID 2112 wrote to memory of 3432 2112 chrome.exe 95 PID 2112 wrote to memory of 3432 2112 chrome.exe 95 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96 PID 2112 wrote to memory of 4132 2112 chrome.exe 96
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://WWW.COMMONSENSE.EVENTS/EVENTS/NL24-PLANNED-AI-DISRUPTION1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff95bb2ab58,0x7ff95bb2ab68,0x7ff95bb2ab782⤵PID:1076
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1700 --field-trial-handle=1940,i,2657818825110284987,3457080379163310634,131072 /prefetch:22⤵PID:4872
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 --field-trial-handle=1940,i,2657818825110284987,3457080379163310634,131072 /prefetch:82⤵PID:3432
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2256 --field-trial-handle=1940,i,2657818825110284987,3457080379163310634,131072 /prefetch:82⤵PID:4132
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2916 --field-trial-handle=1940,i,2657818825110284987,3457080379163310634,131072 /prefetch:12⤵PID:5052
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2948 --field-trial-handle=1940,i,2657818825110284987,3457080379163310634,131072 /prefetch:12⤵PID:400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4612 --field-trial-handle=1940,i,2657818825110284987,3457080379163310634,131072 /prefetch:82⤵PID:3080
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4352 --field-trial-handle=1940,i,2657818825110284987,3457080379163310634,131072 /prefetch:82⤵PID:4588
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4372
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4076,i,1809100026287847100,9768898026582633513,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:81⤵PID:3752
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
85KB
MD58fb70757bbae04df63d2a14520e1f6d4
SHA1a5e3da3b023f9541902452e3be0695f2aa53db3c
SHA2562e355c4e28534acb4416051758388b9459347e23480ad44fdb2fb9057cdc9722
SHA512c5ff4a3e4c2f0a53930a47b850d2a59b01d10de26dfcb4cdd167864f0f93f3f365b922406f42adccef076f4a4f0d1640abdc4dfb9e112f266014018278dfffd3
-
Filesize
45KB
MD5e8f51cd920ab451c862cf796a2cb518f
SHA1d92afedfd283c727bdf6f8f92cf5394c437bddb1
SHA2561fd99c1b916685ad50f347111d11cec2552beff170254eaa17ad8aa357eb47b6
SHA512a16dd1f4f5cef99376a2bb9c7e017807525924fd50f4efa6866e20492969137b973ff3308b306f2c1ac3021df3ee7d9b9e4dd66bc10809b781917ce2cb2c5aca
-
Filesize
1KB
MD5feac1d0af99bb9aaac6681212ab52d25
SHA1c3f3174eb9e6ae56b26469a22e1ece2fdb08dfed
SHA25607b00a29478400ee53e325b429cef07a4d15398597a8e99d1bc1c0ed8c361ad3
SHA5124490541a0250db3ded2ff36ab03f570a2c7bb6613567aa1f365a32ce8f409af6ee8d92f33480e305d26b29380fdca4716748da6b0a8bf490c2aea052936265a6
-
Filesize
2KB
MD5a966e1a0e630c5f951a9b12a5bc94f0e
SHA1cd3c28e313cb0f453d4d060cee159f460e79a51f
SHA2569f77b6fe48c7f27db22d3eeee63c4ab2a091c0f3bb2a496fc78f1ce8570aa26c
SHA5124315a76d4577eaf957f205d3296fd493287fff47e899876459d5ac4ec071fcf9dd81353b3bec8c52fa5568d0eb8293ca2b6399282669d00151c175f4f556ca75
-
Filesize
6KB
MD564bf0e1420db035afe31f02c62aa3692
SHA1443d03c1f8211481804366f38fe007e31d9c39dd
SHA256505f2eb61acba25ae7c8245ec04026e6d5f23f2c40b0d8a8aa94cd7aa400801b
SHA512b060de165eae8067b3798b4f34d70c9b5eb88a410ea85dc86aae7e02c780dd70e142c8edeba4d511d7eb56553d46385065fff93b595126eac07e7ed2bd0efd95
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
2KB
MD58fde4bb9d6a3ad07c82eefe9480edfba
SHA1e05676b75da7a3a1277068a818728e40ca4f3d35
SHA256e88a64c5afa97828a46de98d671a840de2a7b9d144bae32fd148a6bc469fdb59
SHA512bc6f00a9b86b9d5c91b0924b66fda2536beeaab64ec85c989572d9dc647fc22ff64cb91748f217543f06621be958e95633e65a94e0e37bcbc82d43d12fa9b03f
-
Filesize
2KB
MD5048577f4eda90121897f81f280e2ed7f
SHA10ec7dfe3d914eb416d205c32d01d735934a48d53
SHA2565ed940258be8b937fe9757dd94bab30f1c97f5bfe3bbc883635c1323750e3632
SHA512e43ae73de3b5fdbc6b56711bf375226a69553df909e68fd69ed0f43b5a73b2a373a35e167b7e7f8bd4c2a6f6b8458115ec88dd289d6bb7a4d965e3ef36049b50
-
Filesize
2KB
MD522fb4960d47a2864ba83571a918fd8ab
SHA13207057c0fcbc0799c589bae641399d4a6f604dc
SHA256df827a762015559defa3489540a8a94d06726828c1af79637db240c97d6c8498
SHA51219823744068627bf18cc9834647bfcbffa2b9868196be15eaf773a5098c78f28dcb910d7c9fd14dfe5ce1d8037376fc04e58341ab0c6bb1f560ad017c4ec9598
-
Filesize
2KB
MD5f14533f077bbd384a5d11e5aff6388c9
SHA106a64876d1d959599f64adfd76850051911c0b98
SHA25600c4b9fd51e84ff36499e61e50139b46a402fc3c7c7dcaa6a899eeadec1ac31c
SHA512eb23c634c1392745e1e4b14e71b42d1ee99e2608cb8aaebacd938ca18034214cc059a5c3b2c07709c4b703e52249664fd8c452d8f0e36b4243c7bbcf48e5ba72
-
Filesize
7KB
MD514e402e0f48d68b2a72bb294a1843607
SHA1c3984683747d4f377df986a374ae65dd2f7d9f25
SHA2564476674641f41fbd8f8063d7620c0d097a35e7ca4b60d30dd9de830deaef0084
SHA51272ade73fa6426847f13f31589233e445de73107a385fb9b304f4e9ec8e73fa695d3167e05b8dc528f9a26a9df8e088d014a0cf3872d4c78e9e750dba30e933a3
-
Filesize
7KB
MD5dc0f03b55e7ef892138dbfe8a38e6237
SHA1261081bac4aed3430282a065e372e4e55bf97fa3
SHA25672929e56f6474b0b6f6dd87fd9c406868d4ef08bba7f1213c4caf82aeca30fc8
SHA512b58770488a4bf114d1b68e857ab04b1edd9c665c31c3fbaf08c12ddab85a87dd3b5d9f80efb9c5afd943257ac93d8d4e67d75485b882d6bcc0a41810988aca1d
-
Filesize
7KB
MD5acae2909c8d53e6d8baedf87d396e47b
SHA195d77f5ce16c73d649515f8e10c9e6380f090047
SHA2565f62d4a0f278846bff070191f62cc60096ad21aec723e2b47d7989b1bec43f79
SHA512d71b93bf7d654822654427a5d9369bebd6bddd58911cd8d26cb163f9aac3a3799ddef2f0c8ebce0175a3aab55194b2a05efae6b6c170c3efe98eee33de1a65ff
-
Filesize
255KB
MD5ce2a1b6e15808622c213c115374749fa
SHA1abe2b94a31b309a9c939850e8f94780357c77263
SHA256321f4e4d4795bb18224f1e1514768b1ab92fa473fb9f29ec06371530521c2b9c
SHA512824af70bbc93f28438dad812df06908e2dcbf51697b55cebad2ae9e5073e082ad57b5c475531b82734d4e80c3b4ce4dcde2f3ecbdfc9be30dcaf98a7dcc0fd6f