Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
40s -
max time network
45s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
15/05/2024, 21:04
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://assets-usa.mkt.dynamics.com/7017289c-7f11-ef11-9f85-000d3a106137/digitalassets/standaloneforms/0b20dbaa-8511-ef11-9f89-6045bdda6e71
Resource
win10v2004-20240508-en
General
-
Target
https://assets-usa.mkt.dynamics.com/7017289c-7f11-ef11-9f85-000d3a106137/digitalassets/standaloneforms/0b20dbaa-8511-ef11-9f89-6045bdda6e71
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133602806712012054" chrome.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1508 chrome.exe 1508 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe Token: SeShutdownPrivilege 1508 chrome.exe Token: SeCreatePagefilePrivilege 1508 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe 1508 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1508 wrote to memory of 2472 1508 chrome.exe 83 PID 1508 wrote to memory of 2472 1508 chrome.exe 83 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1404 1508 chrome.exe 86 PID 1508 wrote to memory of 1956 1508 chrome.exe 87 PID 1508 wrote to memory of 1956 1508 chrome.exe 87 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88 PID 1508 wrote to memory of 5012 1508 chrome.exe 88
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://assets-usa.mkt.dynamics.com/7017289c-7f11-ef11-9f85-000d3a106137/digitalassets/standaloneforms/0b20dbaa-8511-ef11-9f89-6045bdda6e711⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1508 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa808cab58,0x7ffa808cab68,0x7ffa808cab782⤵PID:2472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 --field-trial-handle=1900,i,18384603231589153731,14595861935516223570,131072 /prefetch:22⤵PID:1404
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 --field-trial-handle=1900,i,18384603231589153731,14595861935516223570,131072 /prefetch:82⤵PID:1956
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2204 --field-trial-handle=1900,i,18384603231589153731,14595861935516223570,131072 /prefetch:82⤵PID:5012
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3020 --field-trial-handle=1900,i,18384603231589153731,14595861935516223570,131072 /prefetch:12⤵PID:3328
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3028 --field-trial-handle=1900,i,18384603231589153731,14595861935516223570,131072 /prefetch:12⤵PID:4152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4228 --field-trial-handle=1900,i,18384603231589153731,14595861935516223570,131072 /prefetch:82⤵PID:560
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4468 --field-trial-handle=1900,i,18384603231589153731,14595861935516223570,131072 /prefetch:82⤵PID:4472
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=4380 --field-trial-handle=1900,i,18384603231589153731,14595861935516223570,131072 /prefetch:12⤵PID:4880
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=4796 --field-trial-handle=1900,i,18384603231589153731,14595861935516223570,131072 /prefetch:12⤵PID:2964
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=4808 --field-trial-handle=1900,i,18384603231589153731,14595861935516223570,131072 /prefetch:12⤵PID:3256
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4456 --field-trial-handle=1900,i,18384603231589153731,14595861935516223570,131072 /prefetch:82⤵PID:1072
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:2892
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD54edc02688d758eacdcdb71c37152d9d0
SHA1bea3510e35da40a210c0f446614c07792ac3feec
SHA25606d1bf19f4e92f66c9af66a91e7b81c5ae81b820958aafc2ffada820d00c9080
SHA5129f424ce019166d6d3355881d547be97908bd88fe9c538009c443ed20733d3e3f3ccc28df97f349a99c191266908efa6730e0b9b8238862c545c78c48dd73524a
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
860B
MD5a904fae840bd8f6496254b33d1f8b08a
SHA1da42129938d8e954dd56afedda73228d767fed8b
SHA256d61d913c61a8cc3ef5f7379d49fca45e4ad38098afdbdac8703e409a42865979
SHA5126da18abbb91edbdc87ff449f4c5db6c923e31c45c531de411bdbb175ce0d4e221232f5072a623eafc69aace841a550a96e8618e4a9f195579261c5544fede66b
-
Filesize
692B
MD5dc42007bfa817f03b167d227f4d031a4
SHA10a178a27a264843d98c83555adbc386760b8b245
SHA2564be440c5b33279260173e859338f1d986247cb131d4bf5a4012d0bee81dc4dba
SHA51216c606c6d6868f4546878c20d0bd0126a4bb619708a9d3c346c6b91d39817032a7a607d0a14962ca3b25b278162264dd222e30c505283c2d050528b3e41b8746
-
Filesize
7KB
MD54a1c66edc7fe3835fb182275bd8b8790
SHA1353a0089213eb3bb6fc7d346b38ae76b0c3dba0d
SHA2569090ff58c54973c09a8cee2a4fc3f451429b2892f806898f6bae1022b312dae5
SHA512917cdda341586b193c7bc344d42ebe007284d088bdd0e008ab6489c81b28dea6b6639e743c9423d7afc4acfef1564226b3bc70ae82a44b89e0a506af7527a354
-
Filesize
129KB
MD5e17a4e4eb3d98031e2c5d236004cf397
SHA1018186903a1fc37c344337c063e380fd67de2020
SHA25624aa57400a57d2983068b85c2a2af068f0574e3dfc1265f0d166f77aaaac2be9
SHA512d18809af6fee2b50bdb853ecb44a96124ae2c7e17d42eea2e9d49c16ccaa1997b3a4ff143885894f14916dc176fc9d7a90c6f9abd7353aa72afee410efd12fff
-
Filesize
2B
MD5f3b25701fe362ec84616a93a45ce9998
SHA1d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA256b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
SHA51298c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84