Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
14s -
max time network
18s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
12/05/2024, 00:34
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://www.bqewh.solxyxiwn.com
Resource
win10v2004-20240426-en
General
-
Target
http://www.bqewh.solxyxiwn.com
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133599477009265208" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 448 chrome.exe 448 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe Token: SeShutdownPrivilege 448 chrome.exe Token: SeCreatePagefilePrivilege 448 chrome.exe -
Suspicious use of FindShellTrayWindow 27 IoCs
pid Process 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe 448 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 448 wrote to memory of 404 448 chrome.exe 82 PID 448 wrote to memory of 404 448 chrome.exe 82 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 3544 448 chrome.exe 83 PID 448 wrote to memory of 4960 448 chrome.exe 84 PID 448 wrote to memory of 4960 448 chrome.exe 84 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85 PID 448 wrote to memory of 4952 448 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.bqewh.solxyxiwn.com1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:448 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcc531ab58,0x7ffcc531ab68,0x7ffcc531ab782⤵PID:404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 --field-trial-handle=1932,i,16207338428254053728,17385226114809551855,131072 /prefetch:22⤵PID:3544
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1932,i,16207338428254053728,17385226114809551855,131072 /prefetch:82⤵PID:4960
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1932,i,16207338428254053728,17385226114809551855,131072 /prefetch:82⤵PID:4952
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2972 --field-trial-handle=1932,i,16207338428254053728,17385226114809551855,131072 /prefetch:12⤵PID:3516
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3000 --field-trial-handle=1932,i,16207338428254053728,17385226114809551855,131072 /prefetch:12⤵PID:1972
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4224 --field-trial-handle=1932,i,16207338428254053728,17385226114809551855,131072 /prefetch:12⤵PID:4824
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3228 --field-trial-handle=1932,i,16207338428254053728,17385226114809551855,131072 /prefetch:12⤵PID:4680
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4552 --field-trial-handle=1932,i,16207338428254053728,17385226114809551855,131072 /prefetch:82⤵PID:5060
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4716 --field-trial-handle=1932,i,16207338428254053728,17385226114809551855,131072 /prefetch:82⤵PID:3492
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3960 --field-trial-handle=1932,i,16207338428254053728,17385226114809551855,131072 /prefetch:12⤵PID:2356
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4696 --field-trial-handle=1932,i,16207338428254053728,17385226114809551855,131072 /prefetch:12⤵PID:2208
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:556
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5e88692d396c2c45c1f9978be99d22f23
SHA163f966cc5d98c9a0b6a988189904b1acea77d875
SHA2561e6f2af4d68581bb19007209d0f28e23257f6b8797507b08c54178d0f107c3d7
SHA51273abae7ddbab7d6be74db27efa31cf1b3a84da5b911cc13ea22676d05ba17f275ab64083780087698f28fe25f3c91378f37d5bd6ba915676f6be0659c970de96
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD51945427b15e2f953bfdea5e50be1643e
SHA144de4f3bad1dad55a35fa425df0a6adddd0599c4
SHA25616ade019efaa9da3e88511df51153c9751271bfd39e5762b6a7c1932d69af33b
SHA5127971151347c319c01dcf4551d070a20bcaeb567e5979db8d70e8b4d75285d7f75fa5911d505c83e54ffb0e06ca09af6f0615e046e4f75f6d5c10d1bcae713413
-
Filesize
132KB
MD5fd1a0c8413489566bf4ab3aaaac073d4
SHA12cf9a6838ee9e6caabd62031700ac1eca1c30484
SHA256e5e0112775d846f8fbcf64b20a81be93bef84d41c3939a18583277d15f36a2c9
SHA512556d3b6edd329801fe2c0e50e6bcab93e8e8ee2f670cca38f6338062bb7b706901f208bb459f19e9b082de1c365b6604a07a97f4076227152943c97504f01daf
-
Filesize
131KB
MD5db10d2c3361418521442e89604fbe105
SHA1b7e8c0728a71a67b5dfda4e636c8e6ceb0193678
SHA256a37628ad76669e33a110200e948d9cf9e69c48360e9b0515e0272801df289bad
SHA512225cb8bdd3718a3d1298936e7fe4e67ee0e81acd3f5851ce5d6c6b2f5ae164de01e2f75a286a8ee4c326bc57b97096c6276b7d0de36f2f70cf235a18ab2c29c5
-
Filesize
132KB
MD5e5c725f310ed476dddf13b6ce2c3c5c0
SHA1626b7c1ab7103dceee6b61b689dc6105cd16f1f3
SHA2561b714bcf6cd46749b5d7a718cd6710076cd848ba56a3c89842aaba271ce604d7
SHA5122da7b5171ea11e73bb8b0bafb79061c311eb7cc06fe0e5ba2e00f0da4cdd88142a3d6691c635622e510d0cdb2366df03f981804177efa60d4fb608dbc5233710
-
Filesize
264KB
MD5f50f89a0a91564d0b8a211f8921aa7de
SHA1112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA256b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
SHA512bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58