Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
59s -
max time network
48s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
27/05/2024, 01:12
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
https://zpr.io/W6m7eYGnFQsA
Resource
win10-20240404-en
windows10-1703-x64
8 signatures
60 seconds
General
-
Target
https://zpr.io/W6m7eYGnFQsA
Score
1/10
Malware Config
Signatures
-
Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe -
Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry chrome.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133612459375529142" chrome.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 500 chrome.exe 500 chrome.exe 500 chrome.exe -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
pid Process 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe Token: SeShutdownPrivilege 500 chrome.exe Token: SeCreatePagefilePrivilege 500 chrome.exe -
Suspicious use of FindShellTrayWindow 26 IoCs
pid Process 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe 500 chrome.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 500 wrote to memory of 4948 500 chrome.exe 72 PID 500 wrote to memory of 4948 500 chrome.exe 72 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 2804 500 chrome.exe 74 PID 500 wrote to memory of 1600 500 chrome.exe 75 PID 500 wrote to memory of 1600 500 chrome.exe 75 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76 PID 500 wrote to memory of 4604 500 chrome.exe 76
Processes
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --disable-background-networking --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://zpr.io/W6m7eYGnFQsA1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:500 -
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xcc,0xd0,0xd4,0xa8,0xd8,0x7ffc8b519758,0x7ffc8b519768,0x7ffc8b5197782⤵PID:4948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1516 --field-trial-handle=1844,i,13186010472891250766,10624331970307429537,131072 /prefetch:22⤵PID:2804
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1796 --field-trial-handle=1844,i,13186010472891250766,10624331970307429537,131072 /prefetch:82⤵PID:1600
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2056 --field-trial-handle=1844,i,13186010472891250766,10624331970307429537,131072 /prefetch:82⤵PID:4604
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2824 --field-trial-handle=1844,i,13186010472891250766,10624331970307429537,131072 /prefetch:12⤵PID:164
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2832 --field-trial-handle=1844,i,13186010472891250766,10624331970307429537,131072 /prefetch:12⤵PID:4820
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4340 --field-trial-handle=1844,i,13186010472891250766,10624331970307429537,131072 /prefetch:12⤵PID:2980
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3096 --field-trial-handle=1844,i,13186010472891250766,10624331970307429537,131072 /prefetch:12⤵PID:3948
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4964 --field-trial-handle=1844,i,13186010472891250766,10624331970307429537,131072 /prefetch:82⤵PID:3044
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4296 --field-trial-handle=1844,i,13186010472891250766,10624331970307429537,131072 /prefetch:82⤵PID:5008
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --mojo-platform-channel-handle=3828 --field-trial-handle=1844,i,13186010472891250766,10624331970307429537,131072 /prefetch:12⤵PID:4292
-
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=2216 --field-trial-handle=1844,i,13186010472891250766,10624331970307429537,131072 /prefetch:12⤵PID:4928
-
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵PID:3144
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\5a24cafd-c239-4f38-92df-8589e93e519f.tmp
Filesize5KB
MD521c2bd2dabae38ecd6773fd8b295c26d
SHA11cfe2dfa596ec224d62e1aa73c7756432a64a083
SHA2560c578b24b9542c7ee278e6db51222b579336f8eb23d5d38df993dc55a4cfb3c5
SHA512250217bb057d78c8d12c08654460e2cf80779f87e365f1cc213f31e06e167bb20674f1bf4d961bed67309febd4f2fb27d8f696c294b979064d78597993101eff
-
Filesize
5KB
MD5ec1ff09e0d07d77d745c3958655d233c
SHA10a89f0dc974c01216db772ba7b3473b5a13608d4
SHA256092d77e4d8512bc3b5f8dbce8bf765aa145a38052fbe3bf3e5f01cc3f810b9cc
SHA51275c70be2331d35e027d8378546de3e1611aca1299e0171d9050fb22ef79694ef729a52a4d775fcd4694b896623ad47f63c068685525b60c230e7dd7a259c116c
-
Filesize
136KB
MD5c6be1d9eaed48af90f0f5c7601d11e78
SHA1a48cc601267d93ad6189f0cbe6f2a610b4c4f555
SHA2566f6797d2591b414fb036d68ebdb1ecfbad05e9092953d792fea8cb6d4df718ef
SHA5126b81db98438297869751e4be1d7d4be21a7185a3ed56760740fa181221aa2856ed4518fa49da90a63c720a6a8f42bccb401475e6c583add51fd8fdd32eab79da
-
Filesize
2B
MD599914b932bd37a50b983c5e7c90ae93b
SHA1bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA25644136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
SHA51227c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd