Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
11/05/2024, 00:59
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://2bag.mz6j7.com/rqahuctipnhpckofsOEKuLuURYGEHBBMDQKRSPGZUCNERKMQAFPKNFFCEGCCLCPVJFYOFNGJLGUJ?ftmemPABAgPwbWFUxFYAnAhOpCaLpyRFLVDRJLNIASXDPUCALPMLPUBBZDY
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
https://2bag.mz6j7.com/rqahuctipnhpckofsOEKuLuURYGEHBBMDQKRSPGZUCNERKMQAFPKNFFCEGCCLCPVJFYOFNGJLGUJ?ftmemPABAgPwbWFUxFYAnAhOpCaLpyRFLVDRJLNIASXDPUCALPMLPUBBZDY
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133598628111114629" chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2508 chrome.exe 2508 chrome.exe 1696 chrome.exe 1696 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs
pid Process 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe Token: SeShutdownPrivilege 2508 chrome.exe Token: SeCreatePagefilePrivilege 2508 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe 2508 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2508 wrote to memory of 3404 2508 chrome.exe 81 PID 2508 wrote to memory of 3404 2508 chrome.exe 81 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 1136 2508 chrome.exe 83 PID 2508 wrote to memory of 212 2508 chrome.exe 84 PID 2508 wrote to memory of 212 2508 chrome.exe 84 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85 PID 2508 wrote to memory of 5020 2508 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://2bag.mz6j7.com/rqahuctipnhpckofsOEKuLuURYGEHBBMDQKRSPGZUCNERKMQAFPKNFFCEGCCLCPVJFYOFNGJLGUJ?ftmemPABAgPwbWFUxFYAnAhOpCaLpyRFLVDRJLNIASXDPUCALPMLPUBBZDY1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffee036ab58,0x7ffee036ab68,0x7ffee036ab782⤵PID:3404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1612 --field-trial-handle=1832,i,17959125723803313340,15885669972987330599,131072 /prefetch:22⤵PID:1136
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2116 --field-trial-handle=1832,i,17959125723803313340,15885669972987330599,131072 /prefetch:82⤵PID:212
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2180 --field-trial-handle=1832,i,17959125723803313340,15885669972987330599,131072 /prefetch:82⤵PID:5020
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2920 --field-trial-handle=1832,i,17959125723803313340,15885669972987330599,131072 /prefetch:12⤵PID:4268
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2940 --field-trial-handle=1832,i,17959125723803313340,15885669972987330599,131072 /prefetch:12⤵PID:1408
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4260 --field-trial-handle=1832,i,17959125723803313340,15885669972987330599,131072 /prefetch:12⤵PID:2520
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 --field-trial-handle=1832,i,17959125723803313340,15885669972987330599,131072 /prefetch:82⤵PID:3920
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3268 --field-trial-handle=1832,i,17959125723803313340,15885669972987330599,131072 /prefetch:82⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2376 --field-trial-handle=1832,i,17959125723803313340,15885669972987330599,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:1696
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4960
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5b388f5a602f14cc63ebaabe0fc0366e7
SHA1c25e24727d003196f81acba6771d435fc0c3ad2f
SHA25628397a10e7d8533f41529553c81ba7d16b587e82cdddca86e5e1b7541bc65e52
SHA512a67172a6b6b11c35591385642f3390c7807fbfaa0938eeaca6bf2bf4687aff3f46ebd21a989626521f096bc1b15508c71b5bd1b6a827b7c7f94e26472e75f6f2
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5f4f428b4693aa0621a5b83bd9f2f9633
SHA1072a34c69d5fa5c8af72fd0201ed7bdcde4ee630
SHA2566cc5c30087aeaa173cc8ae28f33bbcd00f3aad22a184fee0be9254d1da37bdba
SHA51219a2f6cc49c96648e456691b6e3cf43ffc5bc08d64faea34675ca51d1a7ca0b0222a479dfe39911b58d649ca5714452d5f3393726d5361783076c5689b88b6ff
-
Filesize
129KB
MD5e0b84112b9ec2ce286457cf595385381
SHA146953e518af6e85a16f40491ccfb88fa98ff86e6
SHA256bcd9743dc7818e05ad6b45c54c75a388d2578d51b7f2c2ff6a6ad598db094c86
SHA5125843b99e32fb876efb7ba58d6b2785864b9784c39e95d85715692159bdd7371d32a6bcc54f1c50dcfaaee06a40ef111fa79fb5ebc0dd126447e849212503e8e7