Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/05/2024, 21:49
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.businessairnews.com/feedback_form.html?fbo=13931
Resource
win10v2004-20240226-en
General
-
Target
https://www.businessairnews.com/feedback_form.html?fbo=13931
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133598514111796818" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 412 chrome.exe 412 chrome.exe 4960 chrome.exe 4960 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 412 chrome.exe 412 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe Token: SeShutdownPrivilege 412 chrome.exe Token: SeCreatePagefilePrivilege 412 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe 412 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 412 wrote to memory of 5004 412 chrome.exe 92 PID 412 wrote to memory of 5004 412 chrome.exe 92 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 764 412 chrome.exe 94 PID 412 wrote to memory of 4168 412 chrome.exe 95 PID 412 wrote to memory of 4168 412 chrome.exe 95 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96 PID 412 wrote to memory of 1112 412 chrome.exe 96
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.businessairnews.com/feedback_form.html?fbo=139311⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5f149758,0x7ffc5f149768,0x7ffc5f1497782⤵PID:5004
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1688 --field-trial-handle=1896,i,12808905407347208639,10550840556821566077,131072 /prefetch:22⤵PID:764
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1896,i,12808905407347208639,10550840556821566077,131072 /prefetch:82⤵PID:4168
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 --field-trial-handle=1896,i,12808905407347208639,10550840556821566077,131072 /prefetch:82⤵PID:1112
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3144 --field-trial-handle=1896,i,12808905407347208639,10550840556821566077,131072 /prefetch:12⤵PID:4068
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3156 --field-trial-handle=1896,i,12808905407347208639,10550840556821566077,131072 /prefetch:12⤵PID:732
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 --field-trial-handle=1896,i,12808905407347208639,10550840556821566077,131072 /prefetch:82⤵PID:2488
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4932 --field-trial-handle=1896,i,12808905407347208639,10550840556821566077,131072 /prefetch:82⤵PID:796
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 --field-trial-handle=1896,i,12808905407347208639,10550840556821566077,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4960
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3036
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3720 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:81⤵PID:448
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
336B
MD5c5cab9096e14fae34a8bf86dd117e5c2
SHA13a3102783a01c6a9dc677e2ee3c2d87c166150af
SHA256ff6b1351e48b0f93ae31c3204ec459e04a4feb23f3022b6090607c04a1e10fbe
SHA51282866f5ae21b3cc6ed8cf2c3434641cc6a83da064cc98cd3fc7f6d725df84ca9e118a64e1e0f98341207d91860c9aa672f5392fefc37f89a31952f00bb0cb2ba
-
Filesize
3KB
MD52901da6c4b3c1d66781bcb8fe2108ac1
SHA1067f33418796d37e94fa5fee5720d256d92da220
SHA2561b8f75c3c7bd8736a5f572e983a98284b73792108abfde3ca9e8b40ddfa9e514
SHA512bea0fc8a4026f5da39d6a8784cbdf0930997df8c293907d3c2875423f9230c62d9b1105c40c5befb5fe89649c5628687c14f3296335357fc0fec895fabcb707a
-
Filesize
1KB
MD5912ca43d8a3db18219e9d304d0b49e85
SHA125edb184b0e329b229295537745863320eb1e8fb
SHA25618593906aadaa5887031e75591f2360c6b7f53332b50e8383646aaf6f40f17bb
SHA51212733f4fcfcf9ecf424c080a8b25bdf517d44ee11e42950bbff08c7535c2b1ebd7799584bf1ce34becf9ae925fd6be72b05f1ce7b0949f0610b24fdef97c19b0
-
Filesize
6KB
MD5f80c086c4bb72eaf8194a9de8df8c8ee
SHA1c32db6c6f76d94d34b4580c935fcc8198c8ccdd9
SHA2567a807c68a8f036daec780342f54534ae4a0566c533ecefbd29f19c89231fadd4
SHA51204fdb2a33c962ab140248d259ddde42403de0f4c61f7c415fda322e7ef602e2303c4c69d83f81b0731e4c6df2cfa0cb5847dc4d6a3584397d629a5674320c6eb
-
Filesize
6KB
MD5de304c9fc499aa6095162e62c0ae7e67
SHA1ba8bb4326ebfceeebbaef820c524ad24e80fab2a
SHA256051d051df9d72f6b8d14659a5f4f258025b9bce51f6ccbbad3a7d0fe4df01321
SHA512578a18e51e9d48dae96b7d0b6bc41169832c432f22bee24143f65b8846d31d25605206b9791d8eeada8e428b206916c64863d5d9a8adb1a7b3b387d0d681ac5b
-
Filesize
6KB
MD5cbdc539246e29e4d4a969822ba6ffe18
SHA1ee91f70cf4fc0e6d4ebf9bac746fef84c4496bf0
SHA2569fd5ac9c626cbe1ef557db6fc8da9b199aceda56da094bba6272faec6d1d3ce6
SHA512f9e9c450f09a7550129768fed33e680b165050e886b528e1af91de5e8e3ec6b8f92eb465cd6b79350332b9495ef51c3b5c5a91d896150277be30d81e216d3445
-
Filesize
128KB
MD53fb972b4ef4b47c398721997c62eb318
SHA14a0d62e6f78bee10cbfe355728df6be551d94619
SHA256d937227af13fa7e2cb69ff49f22643beb64d17a88df943abf345653901990e67
SHA512d0e94686a589d59bec7aae9aae5a41f841f6437af08412cf411c0c342a67e4dbd34c3847df0fa890439208d44ee70ecefae45a76f14475ed902f623b62834139
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd