Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
20/05/2024, 00:47
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://www.tactical-tech.net/docs/Databases/AIMSEnterpriseEdition3.1.zip
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
https://www.tactical-tech.net/docs/Databases/AIMSEnterpriseEdition3.1.zip
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133606396511971444" chrome.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000_Classes\Local Settings chrome.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1572 chrome.exe 1572 chrome.exe 3636 chrome.exe 3636 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
pid Process 1572 chrome.exe 1572 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe Token: SeShutdownPrivilege 1572 chrome.exe Token: SeCreatePagefilePrivilege 1572 chrome.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe 1572 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1572 wrote to memory of 1152 1572 chrome.exe 82 PID 1572 wrote to memory of 1152 1572 chrome.exe 82 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 3776 1572 chrome.exe 83 PID 1572 wrote to memory of 2324 1572 chrome.exe 84 PID 1572 wrote to memory of 2324 1572 chrome.exe 84 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85 PID 1572 wrote to memory of 2276 1572 chrome.exe 85
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.tactical-tech.net/docs/Databases/AIMSEnterpriseEdition3.1.zip1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=110.0.5481.104 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd9418ab58,0x7ffd9418ab68,0x7ffd9418ab782⤵PID:1152
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1652 --field-trial-handle=1740,i,13804488598421285598,6333718854389276669,131072 /prefetch:22⤵PID:3776
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1932 --field-trial-handle=1740,i,13804488598421285598,6333718854389276669,131072 /prefetch:82⤵PID:2324
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=2252 --field-trial-handle=1740,i,13804488598421285598,6333718854389276669,131072 /prefetch:82⤵PID:2276
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3028 --field-trial-handle=1740,i,13804488598421285598,6333718854389276669,131072 /prefetch:12⤵PID:4116
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3036 --field-trial-handle=1740,i,13804488598421285598,6333718854389276669,131072 /prefetch:12⤵PID:2120
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4664 --field-trial-handle=1740,i,13804488598421285598,6333718854389276669,131072 /prefetch:82⤵PID:4556
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4912 --field-trial-handle=1740,i,13804488598421285598,6333718854389276669,131072 /prefetch:82⤵PID:3992
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1548 --field-trial-handle=1740,i,13804488598421285598,6333718854389276669,131072 /prefetch:82⤵PID:4400
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2404 --field-trial-handle=1740,i,13804488598421285598,6333718854389276669,131072 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:3636
-
-
C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"C:\Program Files\Google\Chrome\Application\110.0.5481.104\elevation_service.exe"1⤵PID:4648
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1756
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57975e256c23d8a27d5648108902f612a
SHA14abecb58a0fd37fe990e1a6f44b2f47bb2c9b453
SHA2567e1c26b74db7f2a4c1b52a69baff216c897a177e7ac67c82ca2867a14fbb3cfa
SHA512f42af4776e2b3dc613407d4ff18504173fcfb38e336865521ef3f4537118751e41b944a6d18bc02dd9e4d9ad36f2ba8135a280b4d030ac13dc5ac35cb4b1576d
-
Filesize
2B
MD5d751713988987e9331980363e24189ce
SHA197d170e1550eee4afc0af065b78cda302a97674c
SHA2564f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
SHA512b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
-
Filesize
6KB
MD5dd0a5244b2c7ff4a0915a67d99b9b15c
SHA1f6b0207b6a84fc34722f9d41f74d7496cc09a5af
SHA256b75f8f8c68a198391bc8b0c9c5324eb8da50f817b9281a90071ea685b6d77871
SHA5125c38aa0a6e1e4c922835419389b3fc32f349c20c686f9955c5469e23e08d1003974bf4f8a81b11298869485f8a9da2f00685d6c32722ba36ffd0c71edb5413fd
-
Filesize
130KB
MD5fac715e2c2b571a8f0daa21c2777889c
SHA10f3c8865336fcf3ad3012b8250b48d80ba3fcf03
SHA2567bf96bc22c5a81547b6917a625161bbf278491b6e4b793bbac144608ee644ebb
SHA512f80123b052a1d172e8073608e18c5d9b458d1b32d74e00b24819a566406747907a19b9effbc477330a33e17c59f7c05300f45c0824d46ba71aad0fd1c32568de
-
Filesize
98KB
MD58902eacbdaed59ceb68ae037f1a92eb1
SHA1c01869fd9211690be80d1f012940f8af448e55aa
SHA256535dd9fdc5657664caf4396247f5560d0b645df899db1d13b29a20c32e2f4ec7
SHA51218ddf0fd878ddeedd9ab4adc114281a308417dc009acca95e45587dd7ae61fa2e5838d548e2ed715e7b336b13cea321db6b9f67171e3b4e070e4843a84740127
-
Filesize
94KB
MD54084794ac0824753bab5eb2b2ba85437
SHA12842e7b000f577cf8e185f945aa1b0a0c6118ab8
SHA2567f54a4066e7751e69b09a577924a56a7be0e581c724ede3e4fd9aa9d07531b4a
SHA512d1e89dab6ce9fcdffa661233136bd5e0b0c1f46a955494894d8157e5b28fac7ea2e5779a6f48c7a5f90898072bccbcaf360016b2329f349d18f27d013f260a8a