Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
25s -
max time network
24s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14/05/2024, 15:58
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://ns.attribution.com/ads/1.0/
Resource
win10v2004-20240508-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
http://ns.attribution.com/ads/1.0/
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133601759166689598" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2444 chrome.exe 2444 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe Token: SeShutdownPrivilege 2444 chrome.exe Token: SeCreatePagefilePrivilege 2444 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe 2444 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2444 wrote to memory of 2124 2444 chrome.exe 82 PID 2444 wrote to memory of 2124 2444 chrome.exe 82 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 3724 2444 chrome.exe 86 PID 2444 wrote to memory of 400 2444 chrome.exe 87 PID 2444 wrote to memory of 400 2444 chrome.exe 87 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88 PID 2444 wrote to memory of 2664 2444 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://ns.attribution.com/ads/1.0/1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2444 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae94dab58,0x7ffae94dab68,0x7ffae94dab782⤵PID:2124
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1740 --field-trial-handle=1896,i,10782481960589633298,6179474778148514424,131072 /prefetch:22⤵PID:3724
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 --field-trial-handle=1896,i,10782481960589633298,6179474778148514424,131072 /prefetch:82⤵PID:400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2232 --field-trial-handle=1896,i,10782481960589633298,6179474778148514424,131072 /prefetch:82⤵PID:2664
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2996 --field-trial-handle=1896,i,10782481960589633298,6179474778148514424,131072 /prefetch:12⤵PID:4088
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1896,i,10782481960589633298,6179474778148514424,131072 /prefetch:12⤵PID:2704
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=3680 --field-trial-handle=1896,i,10782481960589633298,6179474778148514424,131072 /prefetch:12⤵PID:4652
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3012 --field-trial-handle=1896,i,10782481960589633298,6179474778148514424,131072 /prefetch:12⤵PID:4548
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4120 --field-trial-handle=1896,i,10782481960589633298,6179474778148514424,131072 /prefetch:82⤵PID:3012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4052 --field-trial-handle=1896,i,10782481960589633298,6179474778148514424,131072 /prefetch:82⤵PID:1840
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3668 --field-trial-handle=1896,i,10782481960589633298,6179474778148514424,131072 /prefetch:12⤵PID:4104
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=3244 --field-trial-handle=1896,i,10782481960589633298,6179474778148514424,131072 /prefetch:12⤵PID:2824
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:5056
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5905056c311a89c34a2deab6588c63841
SHA11d737b242b06e68ec5d5b6f754d619a25a39529c
SHA256b25dc0f8827aecfaf163be162123e3e5462c41eabfa57d2861cbb46431cc0611
SHA512d425a530be559c7de6dc47fec3904ad336ea8e1a45dbced4937493a7a0a1bbc7a975f14def856d238b10bb0461b97677834c5d33c19ff2ef505fa413b619c1a5
-
Filesize
255KB
MD55ad15e1d9d5d7a17660f7d214e183084
SHA1ef5f1e5422c98aaf8296fc39ecdbd3c05a90eb64
SHA256bcca27bdb45a262f50c51e28db2fe39eff87c254c84e20b4e0b6b1ff14b22c97
SHA512f2e4d17a98592b5c52c2857e730587e31945414bf1c0c5a48db6fccbd589e5a899ccbf740f7d2160182c6bd2d431ede272356d230d3c2186eacffb793ed5f839